Advanced Configuration for SCIM Server UserSync Connector¶

UserSync SCIM Server connector properties¶

SCIM Server connector properties¶

Property	Description	Example
SCIM_SERVER_CONNECTOR	Identifying name of this connector.	scim-server
SCIM_SERVER_ENABLED	Enabled status of connector. (true/false)	true
SCIMSERVER_SERVICETYPE	Type of service/connector.	scimserver
SCIMSERVER_DATASOURCE_NAME	Unique datasource name. Used for identifying source of data and configuring priority list. (Optional)	scim-server
SCIMSERVER_BEARER_TOKEN	Bearer token for auth to SCIM API. When set, SCIM requests with this token will be allowed access.
SCIMSERVER_USERNAME	Basic auth username. When set, SCIM requests with this username will be allowed access. (Password also required)
SCIMSERVER_PASSWORD	Basic auth password. When set, SCIM requests with this password will be allowed access. (Username also required)
SCIMSERVER_SYNC_INTERVAL	Frequency of usersync audit records in seconds. Default value is 3600, minimum value is 300.	3600
SCIM_SERVER_ATTRIBUTE_ONLY	Sync only the attributes of users already synced from other services.	true
SCIM_SERVER_APPLY_MEMBERSHIPS_FROM_USER	Defines group membership based on the user record's group attributes.	false

SCIM Server Manage/Ignore List of Users/Groups¶

Property	Description	Example
SCIMSERVER_MANAGE_USER_LIST	List of users to manage from sync results. If this list is defined, all users not on this list will be ignored.
SCIMSERVER_IGNORE_USER_LIST	List of users to ignore from sync results.
SCIMSERVER_MANAGE_GROUP_LIST	List of groups to manage from sync results. If this list is defined, all groups not on this list will be ignored.
SCIMSERVER_IGNORE_GROUP_LIST	List of groups to ignore from sync results.

SCIM Server Attributes¶

Property	Description	Example
SCIMSERVER_ATTRIBUTE_USERNAME	Attribute of a user's name.	userName
SCIMSERVER_ATTRIBUTE_FIRSTNAME	Attribute of a user's first name.	name.givenName
SCIMSERVER_ATTRIBUTE_LASTNAME	Attribute of a user's last/family name.	name.familyName
SCIMSERVER_ATTRIBUTE_EMAIL	Attribute of a user’s email.	emails[primary-true].value
SCIMSERVER_ATTRIBUTE_GROUPS	Attribute of a user’s group list.	groups
SCIMSERVER_ATTRIBUTE_GROUPNAME	Attribute of a group's name.	displayName
SCIMSERVER_ATTRIBUTE_GROUP_MEMBER	Attribute from group entry that is the list of members.	members

SCIM Server Username Attribute Modifications¶

Property	Description	Example
SCIMSERVER_ATTRIBUTE_USERNAME_VALUE_EXTRACTFROMEMAIL	Extract the user’s username from an email address. (e.g. username@domain.com -> username) The default is false.	false
SCIMSERVER_ATTRIBUTE_USERNAME_VALUE_PREFIX	Prefix to prepend to username. The default is blank.
SCIMSERVER_ATTRIBUTE_USERNAME_VALUE_POSTFIX	Postfix to append to the username. The default is blank.
SCIMSERVER_ATTRIBUTE_USERNAME_VALUE_TOLOWER	Convert the user’s username to lowercase. The default is false.	false
SCIMSERVER_ATTRIBUTE_USERNAME_VALUE_TOUPPER	Convert the user’s username to uppercase. The default is false.	false
SCIMSERVER_ATTRIBUTE_USERNAME_VALUE_REGEX	Attribute to replace username to matching regex. The default is blank.

User Attribute Configuration**¶

Property	Description	Example
SCIM_SERVER_ATTRIBUTE_LIST	List of attribute keys to get from synced users.
SCIM_SERVER_ATTRIBUTE_VALUE_PREFIX	Append prefix to values of custom user attributes.
SCIM_SERVER_ATTRIBUTE_KEY_PREFIX	Append prefix to key of custom user attributes.

SCIM Server Group Name Attribute Modifications¶

Property	Description	Example
SCIMSERVER_ATTRIBUTE_GROUPNAME_VALUE_EXTRACTFROMEMAIL	Extract the group’s name from an email address. (e.g. groupname@domain.com -> groupname). The default is false.	false
SCIMSERVER_ATTRIBUTE_GROUPNAME_VALUE_PREFIX	Prefix to prepend to the group's name. The default is blank.
SCIMSERVER_ATTRIBUTE_GROUPNAME_VALUE_POSTFIX	Postfix to append to the group's name. The default is blank.
SCIMSERVER_ATTRIBUTE_GROUPNAME_VALUE_TOLOWER	Convert group's name to lowercase. The default is false.	false
SCIMSERVER_ATTRIBUTE_GROUPNAME_VALUE_TOUPPER	Convert the group's name to uppercase. The default is false.	false
SCIMSERVER_ATTRIBUTE_GROUPNAME_VALUE_REGEX	Attribute to replace group's name to matching regex. The default is blank.

Group Attribute Configuration**¶

Property	Description	Example
SCIM_SERVER_GROUP_ATTRIBUTE_LIST	List of attribute keys to get from synced groups.
SCIM_SERVER_GROUP_ATTRIBUTE_VALUE_PREFIX	Append prefix to values of custom group attributes.
SCIM_SERVER_GROUP_ATTRIBUTE_KEY_PREFIX	Append prefix to key of custom group attributes.

UserSync system properties on Privacera Self-Managed and Data Plane¶

UserSync property	Description	Property	Default
PRIVACERA_USERSYNC_RANGER_URL	Address of Ranger instance.	ranger.url	http://ranger:6080
PRIVACERA_USERSYNC_RANGER_USERNAME	Username of Ranger user.	ranger.username	admin
PRIVACERA_USERSYNC_RANGER_PASSWORD	Password of Ranger user.	ranger.password	admin
PRIVACERA_USERSYNC_CONTEXT_CLASS	Implementation class used for USContext. Storage of synced Users and Groups.	usersync.context.class	com.privacera.usersync.context.USContextRocksDBOptions: com.privacera.usersync.context.USContextRocksDB com.privacera.usersync.context.USContextMemory
PRIVACERA_USERSYNC_CONTEXT_DATASOURCE_PRIORITY_LIST	Priority list of configured datasources. Sources nearest the beginning of the list will be used over sources later in the list.	usersync.context.datasource.priority.list
PRIVACERA_USERSYNC_DETECT_CACHE_DIFFERENCES_ENABLED	To enable the cache synchronization. While UserSync reads data from an IdP, for performance, the incoming user data is kept in cache and periodically compared to user data already synced to the Privacera portal. From cache, UserSync pushes user data from the IdP that has been reconciled with the Privacera portal to the connected applications.	usersync.detect.DifferencesBetweenCacheAndRangerForUserAndGroup.enabled	true
PRIVACERA_USERSYNC_DETECT_CACHE_INTERVAL_SECONDS	Frequency of cache synchronization in seconds.	usersync.detect.DifferencesBetweenCacheAndRangerForUserAndGroup.intervalInSeconds	43200
PRIVACERA_USERSYNC_LOADER_BULK_ENABLED	Load users to Portal in batches.	usersync.user.loader.bulk.enabled	true
PRIVACERA_USERSYNC_LOADER_BULK_BATCHSIZE	Size of batches to load Users into Portal.	usersync.user.loader.bulk.batchsize	100
PRIVACERA_USERSYNC_UPDATE_GROUP_MEMBERSHIPS_BATCH_ENABLE	Load group memberships to Portal in batches.	usersync.user.loader.update.group.memberships.batch.enable	false
PRIVACERA_USERSYNC_UPDATE_GROUP_MEMBERSHIPS_BATCHSIZE	Size of batches to load Group memberships into Portal.	usersync.user.loader.update.group.memberships.batchsize	1000
PRIVACERA_USERSYNC_STARTUP_PERFORM_OPERATIONS_ENABLED	Scan for and perform any pending operations in cache (User/Group objects) at service start-up.	usersync.startup.performoperations.enabled	true
PRIVACERA_USERSYNC_LOADER_PROCESS_THREAD_MIN	Minimum threads for processing user/group updates (<=0 will use a cached thread pool).	usersync.user.loader.process.thread.min	1
PRIVACERA_USERSYNC_LOADER_PROCESS_THREAD_MAX	Maximum threads for processing user/group updates (if min is <= 0, this has no effect).	usersync.user.loader.process.thread.max	1
PRIVACERA_USERSYNC_LOADER_PROCESS_THREAD_KEEPALIVE_SECONDS	Keep alive time for threads processing user/group updates.	usersync.user.loader.process.thread.keepalive.seconds	30
PRIVACERA_USERSYNC_SECRETS_FILE	JCEKS KeyStore File Paths	privacera.usersync.keystore.files
PRIVACERA_USERSYNC_SECRETS_KEYSTORE_PASSWORDS	JCEKS KeyStore Files Passwords	privacera.usersync.keystore.passwords
PRIVACERA_USERSYNC_SECRETS_KEYPREFIX	Secure keys alias prefix	privacera.usersync.secure.key.prefix	jceks
PRIVACERA_USERSYNC_AUTH_SSL_TRUSTSTORE_FILE	SSL Truststore path	ssl.truststore
PRIVACERA_USERSYNC_AUTH_SSL_TRUSTSTORE_PASSWORD	SSL Truststore password	ssl.truststore.password
PRIVACERA_USERSYNC_RANGER_INIT_RETRY_INTERVAL_IN_MILLIS	Delay in milliseconds between retry attempts for initializing Ranger user loader.	usersync.user.loader.ranger.init.retryinterval.ms	30000
PRIVACERA_USERSYNC_RANGER_INIT_RETRY_LIMIT	Maximum retry attempts for initializing Ranger user loader. (<0 indicates unlimited retries)	usersync.user.loader.ranger.init.retrylimit	-1
PRIVACERA_USERSYNC_RANGER_REQUEST_RETRY_INTERVAL_IN_MILLIS	Delay in milliseconds between retry attempts for requests to Ranger	ranger.request.retryinterval.ms	10000
PRIVACERA_USERSYNC_RANGER_REQUEST_RETRY_LIMIT	Maximum retry attempts for requests to Ranger	ranger.request.retrylimit	3
PRIVACERA_USERSYNC_UPDATE_GROUP_MEMBERSHIPS_BULK_ENABLED	Enable bulk update of group memberships to Ranger	usersync.user.loader.update.group.memberships.bulk.enabled	true
PRIVACERA_USERSYNC_CONTEXT_OPEN_MAX_RETRY	Maximum retry attempts to open RocksDB cache	usersync.context.rocksdb.open.max.retry	5
PRIVACERA_USERSYNC_CONTEXT_OPEN_DESTROY_ON_FAIL	Enable automatic destroy of RocksDB cache if unable to open (corrupted). Cache will be rebuilt.	usersync.context.rocksdb.open.destroyonfail	true
PRIVACERA_USERSYNC_API_SECURITY_USER_NAME	If configured, Usersync REST APIs are available with basic auth.	usersync.api.security.user.name
PRIVACERA_USERSYNC_API_SECURITY_USER_PASSWORD	If configured, Usersync REST APIs are available with basic auth.	usersync.api.security.user.password
PRIVACERA_USERSYNC_LOADER_ASSIGN_ROLE_PRIORITY_LIST	Priority list of roles if a user has multiple roles mapped. Highest priority role will be applied to the user.	usersync.user.loader.assign.role.priority.list	ROLE_SYS_ADMIN,ROLE_ADMIN_AUDITOR
PRIVACERA_USERSYNC_LOADER_ASSIGN_SYS_ADMIN_ROLE_GROUP_LIST	Provide a list of group names, whose members will be assigned the admin role.	usersync.user.loader.assign.role.ROLE_SYS_ADMIN.group.list
PRIVACERA_USERSYNC_LOADER_ASSIGN_SYS_ADMIN_ROLE_USER_LIST	Provide a list of user names, who will be assigned the admin role.	usersync.user.loader.assign.role.ROLE_SYS_ADMIN.user.list
PRIVACERA_USERSYNC_LOADER_ASSIGN_AUDITOR_ROLE_GROUP_LIST	Provide a list of group names, whose members will be assigned the auditor role.	usersync.user.loader.assign.role.ROLE_ADMIN_AUDITOR.group.list
PRIVACERA_USERSYNC_LOADER_ASSIGN_AUDITOR_ROLE_USER_LIST	Provide a list of user names, who will be assigned the auditor role.	usersync.user.loader.assign.role.ROLE_ADMIN_AUDITOR.user.list

SCIM Server fields for UserSync on PrivaceraCloud¶

These are descriptions of fields for configuring PrivaceraCloud UserSync for SCIM Server.

Add Connector¶

Field name	Description
Enable Connector	Enable or disable this connector.
Service Type	SCIM Server
Name	Identifying name of this connector.

Configure Connector¶

Field name	Description	Tab in application set-up
Endpoint URL	SCIM endpoint URL. Base URL for SCIM endpoints (readOnly)	Basic
Authentication Type	Type of authentication to use. Basic or Bearer	Basic
Username	If authentication type is Basic, provide the username	Basic
Password	If authentication type is Basic, provide the password	Basic
Bearer Token	If authentication type is Bearer, provide the bearer token or generate a token	Basic
Attribute Only	Sync only the attributes of users already synced from other services. Allowable values: true or false	Advanced
Sync Interval	Interval in minutes to generate audit record. Default value is 60.	Advanced
Add Custom Properties	Custom properties to pass to the connector.	Advanced

Configure Filters¶

Field name	Description	Tab in application set-up
Include Users	List of users to include from sync results. If this list is defined, all users not on this list are ignored.	Basic
Include Groups	List of groups to include from sync results. If this list is defined, all groups not on this list are ignored.	Basic
Exclude Users	List of users to ignore from sync results.	Basic
Exclude Groups	List of groups to exclude from sync results.	Basic

Base Attributes¶

Field name	Description	Tab in application set-up
Username	Attribute of a user’s username. Default: userName.	Basic
First Name	Attribute of a user’s first name. Default: name.givenName.	Basic
Last Name	Attribute of a user’s last name. Default: name.familyName.	Basic
Email	Attribute of a user’s email. Default: emails[primary-true].value.	Basic
Groups	Attribute of a user’s groups. Default: groups.	Basic
Group Name	Attribute of a group’s name. Default: displayName.	Basic
Group Members	Attribute listing a group’s members. Default: members.	Basic
Extract From Email	Extract the attribute from an email address. Example: username@domain.com extracts username. Default: false.	Advanced
Prefix	Prefix to prepend to the attribute value. No default.	Advanced
Postfix	Postfix to append to the attribute value. No default.	Advanced
To Lowercase	Convert the attribute value to lowercase. Default: false.	Advanced
To Uppercase	Convert the attribute value to uppercase. Default: false.	Advanced
Regex	Apply regex to attribute value. No default.	Advanced

Custom User Attributes¶

Field name	Description	Tab in application set-up
Attribute Name	Attribute key to sync with user.	Basic

Custom Group Attributes¶

Field name	Description	Tab in application set-up
Attribute Name	Attribute key to sync with group.	Basic