SCIM schema discovery

Last modified 14 Sep 2026 07:59 UTC
Table of Contents

The SCIM 2.0 framework automatically discovers schemas from the server using the SCIM protocol’s schema endpoint.

This document is part of the SCIM 2.0 connector tutorial. See Introduction to SCIMREST framework for other topics.

Automatic schema discovery

When a SCIM connector is configured (SCIM is enabled when a scimBaseUrl and SCIM credentials are present — see Authentication & authorization), the framework:

  1. Fetches the schema definitions via the /Schemas endpoint

  2. Retrieves the resource types via the /ResourceTypes endpoint (each resource type is keyed by its name; the SCIM id is optional and not every server provides it)

  3. Maps each SCIM resource type to a ConnId object class

The discovered schema includes:

  • All SCIM resources (e.g., User, Group)

  • All attributes with their types, mutability, and returned status

  • Schema extensions declared on the resource types

In development mode the raw /ServiceProviderConfig document is additionally fetched and exposed for inspection.

SCIM to ConnId object class mapping

The object class name is based on the SCIM resource name; you can override it in a schema script.

Built-in attribute mappings (applied by the mapping rules, overridable in scripts):

  • UID ← SCIM id (always String)

  • NAME ← SCIM userName on the User schema, displayName on the Group schema

  • User.groups → multi-valued reference to the Group object class; Group.members → multi-valued reference to the User object class

  • SCIM mutability → write flags: IMMUTABLE → creatable (not updatable), READ_ONLY → readable only, READ_WRITE → creatable + updatable, WRITE_ONLY → creatable + updatable (not readable)

  • SCIM complex attributes → embedded object classes named ParentAttribute (e.g. Useremails) — see SCIM complex and binary attributes

  • SCIM binary attributes → byte[] (base64 on the wire) — see SCIM complex and binary attributes

No other ConnId built-in attributes (ENABLE, PASSWORD, …) are mapped automatically.

Schema customization

After discovery, you can customize the schema:

  • Rename object classes

  • Add or override ConnId attribute mappings (UID, NAME)

  • Define SCIM path mappings for attributes and complex attributes

  • Add schema extensions

See SCIM Schema customization for details.

Was this page helpful?
YES NO
Thanks for your feedback