How does G Suite detect SCIM support?

Question

I'm trying to setup user provisioning in G Suite for my SCIM-implementing application. According to the documentation, it should be a relatively straightforward task: make sure G Suite knows about /auth and /scim endpoints, and you're done.

But the point is, the very option of 'User Provisioning' in my application is not active (not visible, to be precise). Again, quoting the docs:

Select the user provisioning section. You will only see this choice if your application uses the System for Cross-domain Identity Management (SCIM) specification.

The question is, how exactly the system understands that without knowing the 'root' SCIM endpoint? Does the spec dictate some common endpoint for SCIM service discovery - for example, should the server always respond to '/ServiceProviderConfig' (and not '/scim/v2/ServiceProviderConfig', for example?)

Alfano

Any luck with this? I'm interested as well. This is how Keeper does it: docs.keeper.io/sso-connect-guide/identity-provider-setup/… – Osterhus

Answer 1

From talking with the GSuite support team a few times over the last 18 months I believe this is only possible with apps in their "catalog".

See the following at the header of the page "Configure automated user provisioning for your app"

After you set up SSO for an app in our SAML catalog, follow steps here to configure automated user provisioning for your app.

I was given this link as the place to go to begin the process of registering an app, but having never received a response I was informed the team has not been accepting new submissions since October 2019.

I'd be very glad to hear more positive news on this if anyone's got any!!

Satiated