Skip to main content

OneLogin SCIM Integration

This guide covers the practical OneLogin setup for provisioning identities into AxonFlow Enterprise.

Before You Configure OneLogin​

You need:

  • OneLogin admin access
  • a SCIM token created from the AxonFlow customer portal
  • the correct enterprise hostname for the target environment

Use this base URL pattern:

https://YOUR_PORTAL_OR_ENTERPRISE_DOMAIN/scim/v2

Step 1: Add the OneLogin SCIM Application​

  1. open the OneLogin admin portal
  2. add the SCIM Provisioner application appropriate for your environment
  3. name it clearly for the tenant or environment it manages

Avoid ambiguous names if your organization uses more than one AxonFlow environment.

Step 2: Configure the SCIM Connection​

In the OneLogin app configuration:

FieldValue
SCIM Base URLhttps://YOUR_PORTAL_OR_ENTERPRISE_DOMAIN/scim/v2
SCIM Bearer Tokenyour AxonFlow SCIM token

OneLogin commonly handles the bearer scheme for you, so start with the raw token value unless your OneLogin template expects the full header value.

Step 3: Validate the Connection​

Enable or test the API connection in OneLogin before assigning broad scope.

If the connection fails:

  • confirm the hostname and path are correct
  • confirm the token is current
  • confirm the environment is reachable from OneLogin

Step 4: Enable Provisioning Actions​

Enable the lifecycle actions you want OneLogin to control:

  • create users
  • update users
  • suspend or deactivate users

The right configuration depends on your organization's identity lifecycle model, but the important thing is to validate the end-to-end behavior with a pilot user before expanding.

Step 5: Review Attribute Mapping​

The core mapping goals remain the same:

OneLogin sourceAxonFlow SCIM target
email or login attributeuserName
emailemails
first namename.givenName
last namename.familyName
unique OneLogin identifierexternalId

Do not assume the default mapping is right for your tenant. Validate it with a real pilot user.

Step 6: Assign a Pilot User or Role​

Start with a small assignment set:

  • one user, or
  • one role/group if your rollout depends on group-based provisioning

Then verify:

  • the user lands in the expected tenant
  • the profile shape is correct
  • lifecycle changes are reflected correctly

Step 7: Add Group Sync Deliberately​

If you want group-based access alignment in AxonFlow:

  1. get user provisioning stable first
  2. enable group-related provisioning behavior in OneLogin
  3. test one pilot group
  4. review the access outcome before broad rollout

Common OneLogin Issues​

API connection will not enable​

Check:

  • the base URL is correct
  • the token is current
  • OneLogin is using the token format expected by the template

Users are assigned but do not appear​

Check:

  • provisioning is enabled
  • the user really has the app assignment
  • the mapping produces valid userName and email values

Group or role behavior is unclear​

Treat this as a rollout-design issue, not just a technical issue. Validate user sync first, then add group-based access carefully.

  1. configure the connection
  2. validate it with a pilot user
  3. verify updates and deactivation
  4. add one pilot group if needed
  5. expand only after the lifecycle path is predictable
Last updated on