SCIM User Provisioning in Google Apps/ G-Suite with WordPress

WordPress (WP) SCIM plugin gives you the ability to automate user creation, update and delete process from existing IdP (Identity Provider) to your Wordpress (WP) site. SCIM is an open standard for securely syncing / synchronizing user information between multiple applications. Here we will go through a step-by-step guide to enable SCIM user sync between WordPress site and Google Apps/ G-Suite SCIM as Identity Provider.

Features

 The following provisioning features are supported:

• Push New Users : New users created through Google Apps/ G-Suite will also be created in the third party application.
• Push Profile Updates (Premium Feature): Updates made to the user's profile through Google Apps/ G-Suite will be pushed to the third party application
• Push User Deactivation (Premium Feature): Deactivating the user or disabling the user's access to the application through Google Apps/ G-Suite will deactivate/delete the user in the third party application.

Note: For this application, deactivating/delete a user will depend on the miniOrange SCIM user provisioning add-on.

• Reactivate Users (Premium Feature): User accounts can be reactivated in the application.

Note: For the Reactivating the user it is required to select the Deactivation mode in the SCIM user provisioning add-on.

 Future Enhancements in the Plugin:

• Enhanced group push
• Import Groups
• Sync password

Pre-requisites : Download And Installation

To configure Google Apps/ G-Suite as SAML IDP with WordPress, you will need to install the miniOrange SCIM user provisioning plugin:

SCIM user provisioning

By miniOrange

(1)

SCIM User Provisioning plugin, Create, Update, delete users from Azure AD, Okta, OneLogin, G-suite, Centrify, JumpCloud, Idaptive, Gluu, WS02 and all SCIM …

 Tested upto 6.2

Get this plugin

To get the premium plugin, please contact us at samlsupport@xecurify.com

Follow the steps below for configuring SCIM User Provisioning in Google Apps / G-Suite with WordPress(WP)

Step 1: Configure WP SCIM user provisioning plugin

• Install the premium plugin and login using your miniOrange credentials.
• You would require a license key to activate the plugin. (Note :- In case you already have the paid version of the miniOrange SAML 2.0 SSO plugin you won’t require a to login or license key).
• Select the Identity Provider as GoogleApps from the dropdown.
• You can find the SCIM Base URL and Bearer token in the SCIM configuration tab of the plugin.

Step 2: Configure Google Apps / G-Suite for SCIM provisioning

• Navigate to Google Admin Console and login to your admin account.
• In the Admin Console home page, navigate to Apps tab and select Web and mobile apps.

• Click on Add App and search for "keeper".

• Add the application and setup your SAML SSO Configuration.
• Navigate to the Autoprovisioning section of the application and click on it to enter the required endpoints.

• Now enter the required endpoints as given below

App authorization	Provide the SCIM Bearer Token from SCIM Configuration tab of the plugin
Endpoint URL	Provide the SCIM base URL from SCIM Configuration tab of the plugin


• In the Keeper app click on SAML attribute mapping to map the user attributes.

• Then click on Save.
• Now Turn On Autoprovisioning in the Settings of the app.

• In the SAML SSO app change the User Access status On for everyone.

You have successfully configured the miniOrange Wordpress SCIM User Provisioning plugin with Google Apps.

Step 3: De-provisioning of Users [This is a premium feature]

• You can select the deprovisioning mode in the SCIM configuration tab of the SCIM User Provisioning plugin.
• By default, De-provisioning will delete the users from the WordPress site.

Step 4: SCIM Audit [This is a premium feature]

• SCIM Audit allows you to keep the track of all the provisioning activity taking place. It shows you the detailed information about each user being provisioned. This information includes the User Action, Status, Created Date etc.
• In the miniOrange SCIM User Provisoner plugin, naviagate to the SCIM Audit tab.
• Here you can see all the User provision information.

• Click on the Show Advanced Search button, to search the provisoned user details by using the search filters like Wordpress Username, IP Address etc.

• On clicking the Clear Reports button, you can clear all the user provisioned details.

Schema Discovery

• miniOrange SCIM user provisioning plugin doesn’t support Schema Discovery.

Troubleshooting Tips

• Note: WordPress doesn't allow to change userName of a user. You can change the email but not the username.

Additional Resource

• What is SCIM User Provisioning?
• User Data Synchronization

Other Supported IDPs

Azure AD

Centrify

Google Apps

One Login

PingOne

Custom IDP

If you are looking for anything which you cannot find, please drop us an email on samlsupport@xecurify.com