Skip to content

SCIM#

System for Cross-domain Identity Management (SCIM 2.0) is a protocol that syncs users and groups from an Identity Provider (IdP) into the BSR. With SCIM enabled, your IdP becomes the source of truth for who has a BSR account and which BSR organizations they belong to.

What SCIM does on the BSR#

  • Provisions a BSR user when one is added to the IdP.
  • Deactivates the BSR user when they’re removed from the IdP.
  • Updates BSR organization membership when the user is added to or removed from an IdP group, in concert with automated organization membership provisioning.

For finer-grained per-organization or per-repository access driven by IdP groups, see Manage access via IdP groups.

Supported identity providers#

The BSR supports SCIM with the following IdPs:

The supported configurations pair SCIM with SAML SSO; both setup guides assume SAML sign-in is configured first. For other IdPs, contact Support or your Buf representative.

What the BSR stores per user#

SCIM 2.0 defines a core user schema that all SCIM implementations must support. For the IdPs above, the BSR stores these attributes per user:

  • External ID
  • Username
  • Given name
  • Family name
  • Email (the SCIM schema allows multiple emails; the BSR stores a single email of SCIM email type work)

Before you start#

To push IdP groups to the BSR, automated organization membership provisioning must be enabled. Without it, group memberships won’t persist across sign-ins.

Create a SCIM token#

Issue the following request as a BSR administrator, replacing your-bsr-instance.example.com with your BSR domain. Omit expire_time to create a token that never expires.

$ curl \
    -H "Authorization: Bearer ${BUF_TOKEN}" \
    -H "Content-Type: application/json" \
    -d '{ "expire_time": "2026-12-31T00:00:00+00:00" }' \
    "https://your-bsr-instance.example.com/buf.alpha.registry.v1alpha1.SCIMTokenService/CreateSCIMToken"

The response includes the token’s value in the token field. Save it somewhere safe; the IdP needs it to authenticate to the BSR’s SCIM endpoint.

Check readiness#

The BSR exposes an optional readiness check that surfaces configuration issues to address before enabling SCIM in your IdP. Send the following request using the SCIM token you just created:

$ curl \
    -H "Authorization: Bearer ${SCIM_TOKEN}" \
    -H "Content-Type: application/json" \
    "https://your-bsr-instance.example.com/scim/v2/readiness"

The response body lists any warnings the BSR found. Resolve them before turning on provisioning in the IdP.

Next steps#