Pro

Cloud

SCIM Troubleshooting & FAQ

Common issues with SCIM user provisioning and frequently asked questions.

Connection Issues

SCIM Endpoint Not Accessible

Symptoms:

• Connection test fails in identity provider
• Timeout errors when testing SCIM configuration
• 404 or connection refused errors

Solutions:

1. Verify SCIM endpoint URL format: https://your-passbolt-instance.com/scim/v2/<settings_id>
2. Ensure HTTPS is properly configured
3. Check firewall settings allow port 443
4. Verify Passbolt server is running

Authentication Token Issues

Symptoms:

• "Unauthorized" or "401" errors
• "Invalid token" messages
• Connection test fails with authentication error
• Provisioning fails with "401" errors once the date shown in Secret Token expiry has passed, when the expiry is enforced

Solutions:

1. Verify token format: pb_[A-Za-z0-9_-]{43}
2. Ensure "Bearer " prefix is included in authentication header
3. Check the Secret Token expiry field: an expired token is rejected when the expiry is enforced, see Secret Token Expiry
4. Regenerate token in passbolt if needed:
   • Go to Administration > User Provisioning > SCIM
   • Click the regenerate button of the Secret token field
   • Click Save Settings
   • Update identity provider configuration

Provisioning Issues

Users Not Being Created

Symptoms:

• Users assigned in identity provider but not appearing in Passbolt
• Provisioning logs show "skipped" or "error" status

Solutions:

1. Check required attribute mapping:
   • userName (must be unique email)
   • name.givenName
   • name.familyName
   • emails[type eq "work"].value
2. Ensure source users have valid email addresses
3. Review identity provider provisioning logs for specific errors

Email must be typed "work"

Passbolt reads the account email only from the emails entry whose type is work. If you map the email by array position (emails[0].value) and the first entry is not typed work, the request is rejected with 400 Bad Request ("No email with type work was found") and the user is not created. Map the email to emails[type eq "work"].value.

Users Created but Not Activated

Symptoms:

• Users appear in Passbolt but remain in "invitation pending" status
• Users cannot log in despite being provisioned

Solutions:

1. Check Passbolt email configuration
2. Verify email delivery (check spam folders)
3. Send welcome email manually from Passbolt if needed

Users Not Being Updated

Symptoms:

• Changes in identity provider not reflected in Passbolt
• User information remains outdated

Solutions:

1. Verify "Update User Attributes" is enabled in identity provider
2. Check attribute mapping for update operations
3. Review provisioning logs for update attempts

Identity Provider Specific Issues

Microsoft Entra ID

Provisioning Delays:

• Azure runs provisioning cycles every 40 minutes
• Use "Provision on demand" for immediate testing

Connection Issues:

• Verify SCIM endpoint URL includes settings_id
• Check authentication token format

Okta

API Connection Issues:

• Verify Base URL format includes settings_id
• Check Bearer token format

Provisioning Not Starting:

• Verify application is activated
• Check that users are assigned to the application

Frequently Asked Questions

General Questions

Which identity providers are supported?

• Microsoft Entra ID (Azure AD)
• Okta

What version of Passbolt do I need?

Passbolt Pro Edition version 5.5 or later.

How is SCIM different from LDAP directory sync?

Feature	LDAP Directory Sync	SCIM User Provisioning
Target Systems	On-premises directories (AD, OpenLDAP)	Cloud identity providers (Azure AD, Okta)
Protocol	LDAP	HTTP/HTTPS REST API
Real-time Updates	Scheduled synchronisation	Near real-time provisioning
User Management	Full user sync	User provisioning only
Setup	More complex configuration	Simpler setup process

Configuration Questions

What information do I need from Passbolt?

• SCIM Endpoint URL: https://your-passbolt-instance.com/scim/v2/<settings_id>
• Authentication Token: Generated by Passbolt (format: pb_[A-Za-z0-9_-]{43})

How do I find the SCIM endpoint URL?

1. Go to Administration > User Provisioning > SCIM
2. Enable SCIM if not already enabled
3. The endpoint URL is displayed in the configuration

What if I lose my authentication token?

1. Go to Administration > User Provisioning > SCIM
2. Click the regenerate button of the Secret Token field
3. Click Save Settings
4. Update your identity provider configuration with the new token

User Management Questions

What user information is synchronised?

• Username (must be unique email address)
• First Name
• Last Name
• Email Address
• Active Status (enabled/disabled)

Can I change a user's email address through SCIM?

No. Passbolt uses email as part of the user's cryptographic identity. Email update requests are rejected.

What happens when I delete a user in my identity provider?

SCIM follows a two-phase process:

1. Phase 1 - Disable: User is disabled in Passbolt (soft delete)
2. Phase 2 - Delete: After 30 days, user is permanently deleted

If the user cannot be deleted (sole owner of shared resources), the user remains disabled and an administrator must resolve it manually.

Can I manually create users when using SCIM?

Yes, but this may cause conflicts if the same user is later provisioned via SCIM.

Why can't I sync groups through SCIM?

Group synchronisation is not supported in the initial SCIM release.

How often does user synchronisation occur?

• Microsoft Entra ID: Every 40 minutes by default
• Okta: Near real-time updates
• On-demand sync: Available in both providers for immediate testing

Troubleshooting Questions

Why is my connection test failing?

Common causes:

• Incorrect SCIM endpoint URL (must include settings_id)
• Wrong authentication token format
• Expired authentication token, when the expiry is enforced
• HTTPS not properly configured
• Firewall blocking access
• Passbolt server not running

What happens when the secret token expires?

By default, passbolt keeps accepting the requests, writes a warning to the application log and emails the administrators. When the expiry is enforced, the requests are rejected with a 401 error and provisioning stops until you regenerate the token and update your identity provider. See Secret Token Expiry.

Users are not being created - what should I check?

1. Verify users are assigned to the application in your identity provider
2. Check that required attributes (first name, last name, email) are populated
3. Ensure attribute mapping is correct
4. Review provisioning logs for specific error messages

Why are users created but not activated?

This is normal behaviour. Users created via SCIM:

1. Are created in "invitation pending" status
2. Receive a welcome email to complete account setup
3. Must complete the account setup process to activate their account

How do I troubleshoot provisioning delays?

• Microsoft Entra ID: Use "Provision on demand" for immediate testing
• Okta: Check system logs for any processing delays
• Both: Verify network connectivity and server performance

Getting Help

When contacting support, provide:

1. Passbolt version and edition
2. Identity provider and version
3. Error messages from logs
4. Steps to reproduce the issue
5. Configuration details (without sensitive information)