docs/documentation/platform/scim/pingone.mdx
If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
then you should contact [email protected] to purchase a self-hosted license to use it.
Prerequisites:
<Steps> <Step title="Create a SCIM token in Infisical"> In Infisical, head to the **Single Sign-On (SSO)** page and select the **Provisioning** tab. Under SCIM Configuration, press the **Enable SCIM provisioning** toggle to allow PingOne to provision/deprovision users for your organization. 
Next, press **Manage SCIM Tokens** and then **Create** to generate a SCIM token for PingOne.
Next, copy the **SCIM URL** and **New SCIM Token** to use when configuring SCIM in PingOne.
</Step>
<Step title="Add Users and Groups in PingOne">
Inside your PingOne environment, navigate to Directory > Users. Add any users and/or groups to your application that you would like
to be provisioned over to Infisical.
</Step>
<Step title="Configure SCIM Connection in PingOne">
**1. Create a new connection**
In PingOne, head to Integrations > Provisioning, and inside provisioning, press the **Connections** tab. Here you'll see a plus icon to add a new connection.
Select the "Identity Store" option.
Search for the "SCIM Outbound" option to start the configuration process for SCIM. Finally, press the **Next** button. Give the connection a name and optionally add a description.
**2. Configure the connection**
Once you have selected the SCIM Outbound option, you'll be prompted to enter the authentication details that PingOne will use to authenticate with Infisical SCIM. This is the **SCIM URL** and **New SCIM Token** from the previous step.
Set the following fields:
- `SCIM BASE URL`: Input the **SCIM URL** from the previous step.
- `Users Resource`: Leave as default, `/Users`.
- `Groups Resource`: Leave as default, `/Groups`.
- `SCIM Version`: Leave as default, `2.0`.
- `Authentication Method`: Select `OAuth 2 Bearer Token`.
- `Oauth Access Token`: Input the **New SCIM Token** from step 1.
- `Auth Type Header`: Select `Bearer`.
Once this is done, you can press the **Test Connection** button to check that SCIM is configured properly. You should see a success message saying "Connection Successful".
If the connection is successful, press the "Next" button.
In the final step, you'll be prompted to configure the mappings for the connection.
Set the following fields:
- `User Filter Expression`: `email.value Eq "%s"`.
- `User Identifier`: `workEmail`.
- `Deprovision on Rule Deletion:` Enabled.
Once this is configured, press the "Save" button.
**3. Enable the connection**
Finally, remember to enable the connection by pressing the enable toggle.
</Step>
<Step title="Configure SCIM Provisioning in PingOne">
**1. Create a new rule**
After creating a connection, you can now access the "Rules" tab under the Provisioning section. Here you can configure the rules for the connection.
Select the "New Rule" button and choose a name for the rule, then press the "Create Rule" button.
**2. Configure the rule connection**
Once you have created a rule, you now need to configure the connection to use for the rule.
Select the connection you created in the previous step and press the "Save" button.
**3. Configure the rule user filter**
Select the Edit pencil icon to open the user filter configuration. This step dictates which users will be provisioned to Infisical.
In this case, we are provisioning all users that are enabled in PingOne. Configure your user filter to match your desired users, and then press the "Save" button.
**4. Configure Groups**
This step is optional and only relevant if you want to provision PingOne groups to Infisical.
Open the "Group Provisioning" tab and press the "Add Groups" button to select which groups will be provisioned to Infisical.
Select the groups you want to provision to Infisical and press the "Save" button.
**5. Enable the rule**
Once you have configured the rule, you can enable it by pressing the "Enable" toggle.
</Step>
FAQ
<AccordionGroup> <Accordion title="Why do SCIM-provisioned users have to finish setting up their account?"> Infisical's SCIM implementation accounts for retaining the end-to-end encrypted architecture of Infisical because we decouple the **authentication** and **decryption** steps in the platform.For this reason, SCIM-provisioned users are initialized but must finish setting up their account when logging in the first time by creating a master encryption/decryption key. With this implementation, IdPs and SCIM providers cannot and will not have access to the decryption key needed to decrypt your secrets.