SCIM user sync

SCIM (System for Cross-domain Identity Management) lets an identity platform push users and groups to QwenWork. QwenWork provides a Base URL and Bearer Token and applies the configured account lifecycle policy to incoming requests.

​

Create the SCIM source

1. In Users → User sync, add SCIM and start setup.
2. Enter the source name and SCIM Client. The first identifies the configuration; the second identifies the caller in history.
3. Create a token and securely copy its complete value, which appears once. A token must be created before the first save.
4. Set the lifecycle policy below. If no source is active, save and enable. Otherwise save, then switch activation from the list.
5. Reopen the saved source, copy its generated SCIM Base URL, and configure the identity platform with that URL and full token. Test the push connection.

Admin console: SCIM push address, token management, and lifecycle policy. A masked token cannot replace the complete one-time value.

​

Set the account lifecycle

• New-user seat option: choose whether creation attempts a seat assignment, then inspect the actual result.
• Leaver handling: deactivate only, deactivate and reclaim seats, or delete and reclaim seats.
• Deletion alerts: set a count threshold and email to investigate unexpected bulk changes.

For a new source without another active source, use Save and enable. For an edit, save and check activation in the list. Only one source can be active; switching retains prior configurations and history.

​

Configure the identity platform

1. Open its QwenWork provisioning or SCIM app settings.
2. Enter the copied Base URL and full Bearer Token and run the platform's connection test.
3. Map a non-empty, globally unique externalId as external identity, userName as account, displayName as name, emails as email, and active as enabled status.
4. For Groups, map their members using the user resource IDs returned by SCIM. Names and external IDs are not QwenWork resource IDs.
5. Assign a test user and test group, then run on-demand provisioning or push.

Read ServiceProviderConfig, Schemas, and ResourceTypes to confirm supported fields and updates. The service supports Users, Groups, pagination, PATCH, Filter, and ETag.

​

Verify four changes

After each request, filter Sync records by source or SCIM Client, open details, and inspect users, departments, relationships, seats, and errors. Verify final state in Users.

​

Troubleshoot and rotate tokens

Rotating an existing token invalidates the old value immediately. Arrange the change, copy the new token, update the identity platform, and test. Revoking a token invalidates that token; stopping the whole integration also requires disabling the source.

​

Connect existing users and deleted resources

Match existing users by external user ID only. Account, email, phone, and employee number are checked for conflicts. If the external ID does not match but an identity value is occupied, creation fails. A successful update retains the QID and changes the management source. While that source is active, name, email, account, phone, external ID, and employee number are source-owned; department and status are locked when mapped. A deleted SCIM User cannot be updated or restored. The identity platform must send a new POST /Users. Success assigns a new QID, without inheriting the old profile, roles, password, groups, administrator permissions, seats, or departments. Identity conflicts with current users reject creation; correct the source data first. See Users / User sync / User sync overview for mapping and source-change rules. Return to: Users / User sync / User sync overview.