SCIM & Memtime: How to Enable Automated User Provisioning

SCIM (System for Cross-domain Identity Management) is a feature that allows automatic user provisioning, eliminating the need for manual user management within Memtime.

Step 1: Make sure you meet the setup requirements

1. SCIM is available only for customers with Premium accounts and automated licensing enabled. The automatic adjustment of licenses must be activated. 

2. Access Token & Base URL: To set up SCIM, you will need a bearer token and an API base URL from Memtime to use within your identity provider. To get them, navigate to Customer Portal > User Management, choose whether login method you want to use, and click “Activate”:

 

 

The system will then generate an SCIM Access Token that will only be visible once, so we recommend that you keep it somewhere easily accessible. 

 

 

 

Once you close the pop-up window that shows you the SCIM Access Token, you will also be able to view and copy your SCIM Base URL, which will be provided for use in the identity provider: 

 

Step 2: Configuring Your Identity Provider (OneLogin Example)

1. Log into your OneLogin account > Applications: 
   
   

2. Click on "Add App", and create a new app called "SCIM Provisioner with SAML (SCIM v2 Core)."

3. In the “Configuration” tab, add: 

• The SCIM Base URL that was generated in your Memtime Customer Portal, which you can copy from there. 
• In the SCIM Bearer Token field, the SCIM Access Token you have saved, as it is only visible once. 
  
  

• Below, in the SCIM JSON Template field, you can replace the default template with the one shown below. The only difference is that in the one we provide you, e-mail is used as the username for mapping the user's identity.
  
  

{

  "schemas": [

    "urn:ietf:params:scim:schemas:core:2.0:User"

  ],

  "userName": "{$parameters.scimusername}",

  "name": {

    "formatted": "{$user.firstname} {$user.lastname}",

    "givenName": "{$user.firstname}",

    "familyName": "{$user.lastname}"

  },

  "emails": [

    {

      "value": "{$user.email}",

      "primary": true,

      "type": "work"

    }

  ],   

  "phoneNumbers": [

    {

      "value": "{$user.phone}",

      "primary": true,

      "type": "work"

    }

  ]

}

 

4. In the “Parameters” tab, edit scimusername and set it to “Email”. 

 

 

You can also add a parameter with the value “Phone”, but adding this field is optional.

 

This is how your parameters should look like: 

 

 

5. In the Provisioning tab, ensure provisioning is enabled. 

 

 

6. Then, go back to the Configuration tab and make sure you enable API Connection: 

 

Step 3: Adding users 

Once the connection configuration is ready, you can add your users to receive their invitations. If you already have users created in OneLogin, you only need to assign them to the SCIM app role to enable provisioning.

If, on the other hand, this is the first time you are setting up SCIM on OneLogin, this is how you create your users: 

1. Open the section Users > New User: 

 

2. Once you have filled in the user fields, open the “Applications” tab and set the Default Role for the user. 

 

3. Then click on Pending and approve Provisioner. 

 

That's it! The user in question will have automatically already received the invitation to your Memtime account, and will only have to accept it, download the app and follow the standard Memtime onboarding process.

From now on, the users you have added to this process will appear in your Customer Portal > User Management.