Create, disable, enable, delete, and rotate SCIM credentials-CloudSSO(CloudSSO)-阿里云帮助中心

SCIM synchronization requires an SCIM credential. This topic describes how to create, disable, enable, delete, and rotate SCIM credentials.

Limitations

An SCIM credential is displayed only upon creation and cannot be retrieved later. Save it in a secure location immediately.
You can create a maximum of two SCIM credentials per Cloud SSO directory.

New SCIM credentials are enabled by default.

Log in to the Cloud SSO console.
In the left navigation pane, click Settings.
On the User Setting tab, in the SCIM user provisioning section, click Generate New SCIM Credential.

Make sure that the SCIM synchronization switch is on.
In the SCIM Credential Generated dialog box, copy the SCIM credential and click OK.

Warning

After disabling an SCIM credential, synchronization tasks that use this credential will fail.

In the left navigation pane, click Settings.
On the User Setting tab, in the SCIM user provisioning section, find the SCIM credential to disable and click Disable.
In the Determine Whether to Disable SCIM Credential dialog box, click OK.

You can re-enable a disabled SCIM credential.

In the left navigation pane, click Settings.
On the User Setting tab, in the SCIM user provisioning section, find the SCIM credential to enable and click Enable.
In the Enable SCIM Credential dialog box, click OK.

You can delete SCIM credentials you no longer need.

Warning

After deleting a SCIM credential, synchronization tasks that use this credential will fail.

In the left navigation pane, click Settings.
On the User Setting tab, in the SCIM user provisioning section, find the SCIM credential to delete and click Delete.
In the Delete SCIM Credential dialog box, click OK.

Create a new SCIM credential.

For more information, see Create SCIM credential.
Configure the new SCIM credential in your enterprise IdP.
Disable the old SCIM credential.
Verify that SCIM synchronization tasks run as expected with the new SCIM credential.
- If the tasks run successfully, proceed to the next step to delete the old SCIM credential.
- If the tasks fail, temporarily re-enable the old SCIM credential and repeat the preceding steps until the new credential works correctly.
Delete the old SCIM credential.

Before deleting the credential, use ActionTrail to query recent ListUsers API calls from Cloud SSO. Check the event details to confirm that the old SCIMCredentialId is no longer in use. Only then, delete the old credential.