Google Apps SCIM – Automated User Provisioning in WordPress

SCIM User Provisioning in Google Apps/ G-Suite with WordPress

SCIM plugin for WordPress gives you the ability to automate user creation, update and delete process from existing IdP (Identity Provider) to your Wordpress site. SCIM is an open standard for securely syncing / synchronizing user information between multiple applications. Here we will go through a step-by-step guide to enable SCIM user sync between WordPress site and Google Apps/ G-Suite SCIM as Identity Provider.

Features

 The following provisioning features are supported:

• Push New Users : New users created through Google Apps/ G-Suite will also be created in the third party application.
• Push Profile Updates (Premium Feature): Updates made to the user's profile through Google Apps/ G-Suite will be pushed to the third party application
• Push User Deactivation (Premium Feature): Deactivating the user or disabling the user's access to the application through Google Apps/ G-Suite will deactivate/delete the user in the third party application.

Note: For this application, deactivating/delete a user will depend on the miniOrange SCIM user provisioning add-on.

• Reactivate Users (Premium Feature): User accounts can be reactivated in the application.

Note: For the Reactivating the user it is required to select the Deactivation mode in the SCIM user provisioning add-on.

 Future Enhancements in the Plugin:

• Enhanced group push
• Import Groups
• Sync password

Pre-requisites : Download And Installation

To configure Google Apps/ G-Suite as SAML IDP with WordPress, you will need to install the miniOrange SCIM user provisioning plugin:

SCIM user provisioning

By miniOrange

(1)

SCIM User Provisioning plugin, Create, Update, delete users from Azure AD, Okta, OneLogin, G-suite, Centrify, JumpCloud, Idaptive, Gluu, WS02 and all SCIM …

 Tested upto 6.2

Get this plugin

To get the premium plugin, please contact us at samlsupport@xecurify.com

Follow the steps below for configuring SCIM User Provisioning in Google Apps / G-Suite with WordPress

Step 1: Configure SCIM user provisioning plugin for WordPress

• Install the premium plugin and login using your miniOrange credentials.
• You would require a license key to activate the plugin. (Note :- In case you already have the paid version of the miniOrange SAML 2.0 SSO plugin you won’t require a to login or license key).
• Select the Identity Provider as GoogleApps from the dropdown.
• You can find the SCIM Base URL and Bearer token in the SCIM configuration tab of the plugin.

Step 2: Configure Google Apps / G-Suite for SCIM provisioning

• Navigate to Google Admin Console and login to your admin account.
• In the Admin Console home page, navigate to Apps tab and select Web and mobile apps.

• Click on Add App and search for "keeper".

• Add the application and setup your SAML SSO Configuration.
• Navigate to the Autoprovisioning section of the application and click on it to enter the required endpoints.

• Now enter the required endpoints as given below

App authorization	Provide the SCIM Bearer Token from SCIM Configuration tab of the plugin
Endpoint URL	Provide the SCIM base URL from SCIM Configuration tab of the plugin


• In the Keeper app click on SAML attribute mapping to map the user attributes.

• Then click on Save.
• Now Turn On Autoprovisioning in the Settings of the app.

• In the SAML SSO app change the User Access status On for everyone.

You have successfully configured the miniOrange SCIM User Provisioning plugin for WordPress with Google Apps.

Step 3: De-provisioning of Users [Available in premium plan]

• You can select the deprovisioning mode in the SCIM configuration tab of the SCIM User Provisioning plugin.
• By default, De-provisioning will delete the users from the WordPress site.

Step 4: SCIM Audit [Available in premium plan]

• SCIM Audit allows you to keep the track of all the provisioning activity taking place. It shows you the detailed information about each user being provisioned. This information includes the User Action, Status, Created Date etc.
• In the miniOrange SCIM User Provisoner plugin, naviagate to the SCIM Audit tab.
• Here you can see all the User provision information.

• Click on the Show Advanced Search button, to search the provisoned user details by using the search filters like Wordpress Username, IP Address etc.

• On clicking the Clear Reports button, you can clear all the user provisioned details.

Step 5: Additional Feature Configurations [Available in premium plan]

  Set Default Role for New Users

When new users are created via SCIM provisioning, you can automatically assign roles:

• Go to Advanced Settings >> Default Role Provisioning
• Choose the role you want the new users to have (e.g. Manager)
• Turn on Update Existing User Role if you want already existing users’ roles to be updated during provisioning.


  User Activation Status

You can easily check whether users are active or inactive.

• When enabled, a new column appears in the Users List in the WordPress dashboard.
• It shows whether each users is:
  • Activated (active in your IdP)
  • Deactivated (inactive in your IdP)
• This status updates automatically whenever users are added or removed via SCIM provisioning and deprovisioning.


  Content Reassignment on User Deprovisioning

When a user is deleted via SCIM provisioning, you can decide what happens to their content.

• Choose a Default Content Owner to automatically take ownership of the content.
• Or select Do Not Reassign to permanently delete all the content.


  Select Subsites for SCIM User Provisioning

• Select the subsites where users should be assigned after SCIM provisioning.
• Users will only get access to the selected subsites in the network.
• This helps to control access, restrict user assignment to specific subsites only, and keep user permissions organized.

Schema Discovery

• miniOrange SCIM user provisioning plugin doesn’t support Schema Discovery.

Troubleshooting Tips

• Note: WordPress doesn't allow to change userName of a user. You can change the email but not the username.

Additional Resource

• What is SCIM User Provisioning?
• User Data Synchronization

Other Supported IDPs

Azure AD

Centrify

Google Apps

One Login

PingOne

Custom IDP

If you are looking for anything which you cannot find, please drop us an email on samlsupport@xecurify.com