SCIM User Provisioning

Overview

This article describes troubleshooting and resolving issues related to SCIM User Provisioning in the LMS. It is intended for support staff and administrators who need to diagnose and resolve SCIM-related issues.

What is SCIM User Provisioning?

In SCIM User Provisioning, the identity provider transmits user data via a REST interface to the LMS. Among other things, the following tasks are performed:

• Create users

• Update users

• Deactivate users

• Reactivate users

• Transfer group or organisation assignments (if configured)

If a user is not created or updated correctly, the cause is usually due to incorrect attributes, wrong mappings, missing mandatory fields, authorisation issues, or an invalid SCIM request.

The configuration in the LMS is done in the Configuration function via the SCIM menu.

Swagger API Documentation

The available SCIM API calls can be viewed in the LMS's Swagger documentation:

🔗 Swagger SCIM API

The following SCIM endpoints, among others, are documented there:

Groups endpoints:

• GET /lms/scim/Groups

• POST /lms/scim/Groups

• PUT /lms/scim/Groups

• GET /lms/scim/Groups/{id}

• PATCH /lms/scim/Groups/{id}

Users endpoints:

• GET /lms/scim/Users

• POST /lms/scim/Users

• POST /lms/scim/Users/.search

• GET /lms/scim/Users/{id}

• PATCH /lms/scim/Users/{id}

• PUT /lms/scim/Users/{id}

• DELETE /lms/scim/Users/{id}

To verify the supported endpoints, request structures, and API parameters, refer to the Swagger documentation.

Important Attributes

The following attributes are central to SCIM communication and are common sources of errors.

EXT_ID_SCIM

The EXT_ID_SCIM is often used to establish a unique mapping between the identity provider and the LMS.

Example:

"EXT_ID_SCIM": "E00000238"

Important:

• Should be unique

• Should not change later on

• Should not be empty

• Should remain stable over the long term

userName

The userName is often used as a login name.

Example:

"userName": "E00000238"

Important:

• Must be unique

• Must not be empty

• Must not contain unauthorised special characters

• Must not conflict with existing users

emails.value

Email addresses are often used for notifications, logins, or user identification.

Example:

"emails": [
  {
    "value": "max.mustermann@example.com",
    "type": "work",
    "primary": true
  }
]

Important:

• Must be valid

• Must be unique if used as a login or unique field

• Must not be empty if configured as a mandatory field

active

The Field active normally determines whether a user is active or inactive.

Example active:

"active": true

Example inactive:

"active": false

Common Errors

1. User is not created

Possible causes

• Mandatory attributes are missing from the SCIM request

• userName or EXT_ID_SCIM is empty or not unique

• Email address is missing or invalid

• Attribute mapping in the identity provider is incorrect

• The user is not assigned to the provisioning app in the identity provider

• SCIM endpoint or token is incorrect

• A user with a different ID already exists in the LMS

Test

Search the log for the following terms:

SCIM
provisioning
User
EXT_ID_SCIM
userName
create
POST /Users

In addition, you should check the following:

PRS0126
LOGIN_REGISTRATION_LOGIN_FAILED_UNIQUENESS
duplicate
uniqueness
mandatory
required
validation

Typical Technical Cause

A common issue is that the login name already exists or is not unique. In that case, the user cannot be created.

Example:

LOGIN_REGISTRATION_LOGIN_FAILED_UNIQUENESS

Solution

• Check whether userName is unique

• Check whether EXT_ID_SCIM is set correctly

• Check whether the user already exists in the LMS

• Check Attribute Mapping in the identity provider

• Newly provisioning a single user on a trial basis

• If necessary, resolve any existing duplicates or incorrect user assignments

2. User is not updated

Possible causes

• EXT_ID_SCIM does not match the existing user.

• The identity provider sends a different user ID than the one used during the initial import.

• The field used for unique identification was changed retrospectively.

• The update request contains invalid or empty mandatory values.

• The user is locked in the LMS or has a status that prevents updates.

• This attribute is not intended for SCIM mapping in the LMS.

Test

Search the log for the following terms:

PUT /Users
PATCH /Users
EXT_ID_SCIM
userName
SCIM update

In particular, verify that the user is correctly identified using EXT_ID_SCIM, userName, or another configured unique ID.

Solution

• Check which identifier is used for user mapping.

• Make sure that EXT_ID_SCIM has not been changed retrospectively.

• Compare the mapping in the identity provider with the configuration of Scheer IMC.

• Synchronize a single user again.

• Check whether the respective attribute can be overwritten in the LMS.

3. The user is deactivated even though they are supposed to remain active

Possible Causes

• The user has been deactivated in the identity provider.

• The user has been removed from the provisioning group.

• The scope of the provisioning app has been changed.

• The identity provider sends active = false.

• Group filters or assignments are configured wrong.

Test

Check the following in the SCIM payload:

{
  "active": false
}

Search the log for:

active
deactivate
disable
PATCH /Users

Solution

• Check in the identity provider to see if the user is active.

• Check whether the user is still assigned to the SCIM app.

• Check the group and scope filters.

• Check the provisioning logs in the identity provider.

• Provision the user again after making the correction.

4. The user will not be deactivated

Possible Causes

• The identity provider does not send a deactivation request.

• Deactivation is not enabled in the SCIM configuration.

• The user was deleted from the identity provider but not deactivated.

• The identity provider handles deletion and deactivation differently.

• The LMS does not interpret the request as a deactivation.

Test

Check to see if a request with the following content was sent:

{
  "active": false
}

Or whether a DELETE /Users request was used.

Search the log for:

DELETE /Users
active false
disable
deactivate

Solution

• Check what action the identity provider takes when a user is removed.

• Recommendation: Deactivate the user by setting active = false.

• Check the provisioning configuration in the identity provider.

• If necessary, adjust the mapping or the deactivation logic.

5. Errors due to missing mandatory fields

Possible Causes

• userName is missing.

• EXT_ID_SCIM is missing.

• Name, email, or other mandatory attributes are missing.

• Mandatory fields are empty in the identity provider.

• The attribute mapping refers to an empty field.

Example of an Invalid Payload

{
  "userName": "",
  "EXT_ID_SCIM": "E00000238",
  "name": {
    "familyName": "",
    "givenName": ""
  },
  "emails": [
    {
      "value": "",
      "type": "work",
      "primary": true
    }
  ]
}

Rating

This request is problematic because several important attributes are empty. The following are particularly critical:

• userName

• emails.value

• name.familyName

• name.givenName

Depending on the IMC configuration, these fields may be mandatory.

Solution

• Fill in the mandatory fields in the identity provider.

• Check the mapping for first name, last name, login name, and email.

• Make sure that no empty strings are transmitted.

• Provision a test user with complete attributes.

Analysis and Diagnosis

Relevant Log Terms

If you're having SCIM issues, you should search for the following terms:

SCIM
Users
POST /Users
PUT /Users
PATCH /Users
DELETE /Users
EXT_ID_SCIM
userName
active
provisioning
PersonStoreProcessor
ProfileValidator
PRS0126
LOGIN_REGISTRATION_LOGIN_FAILED_UNIQUENESS

Typical Error Categories

Typical Solutions

Correcting Incorrect Mapping

If attributes are transmitted empty or incorrectly:

• Check the mapping in the identity provider.

• Assign mandatory attributes correctly.

• Provision a test user again.

• Check that the corrected payload is complete.

Remove Duplicates

If users are not created due to a uniqueness violation:

• Search for the existing user with the same login.

• Search for the existing user with the same email address.

• Check whether the user already exists with another EXT_ID_SCIM.

• Resolve the duplicate or correct the mapping.

Check Token or Endpoint

If you experience authentication issues:

• Check the SCIM token.

• Refresh the token.

• Check the SCIM endpoint.

• Check the permissions.

• Perform a test connection in the identity provider.

Re-provisioning Users

After corrections:

• Re-provision individual users in the identity provider.

• Do not resynchronise all users straight away.

• Check the result in the provisioning log.

• Afterwards, check the IMC log against it.

Practical Examples

Example 1: Missing Mandatory Attributes

Request

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User",
    "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"
  ],
  "id": "E00000238",
  "EXT_ID_SCIM": "E00000238",
  "userName": "E00000238",
  "name": {
    "familyName": "",
    "givenName": ""
  },
  "displayName": "",
  "emails": [
    {
      "value": "",
      "type": "work",
      "primary": true
    }
  ]
}

Rating

Although the request contains EXT_ID_SCIM and userName, but important user attributes are empty:

• familyName

• givenName

• displayName

• emails.value

If these fields are marked as mandatory in the imc Learning Suite, the user cannot be created or updated correctly.

Solution

The identity provider must send complete values, for example:

{
  "EXT_ID_SCIM": "E00000238",
  "userName": "E00000238",
  "name": {
    "familyName": "Mustermann",
    "givenName": "Max"
  },
  "displayName": "Max Mustermann",
  "emails": [
    {
      "value": "max.mustermann@example.com",
      "type": "work",
      "primary": true
    }
  ],
  "active": true
}

Example 2: Unsupported Attribute

Request

{
  "schemas":
  ["urn:ietf:params:scim:schemas:core:2.0:User",
    "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"],
  "id": "EUSER0001",
  "externalId": "EUSER0001",
  "userName": "EUSER0001",
  "name": {
    "familyName": "Maxi",
    "givenName": "mum"
  },
  "displayName": "",
  "emails": [{
      "value": "",
      "type": "work",
      "primary": true
    }
  ],
  "addresses": [{
      "streetAddress": "",
      "locality": "",
      "region": "",
      "postalCode": "",
      "country": "",
      "type": "work",
      "primary": true
    }
  ],
  "ims": [{
      "value": "1",
      "type": "custom.sex"
    },
    {
      "value": "1",
      "type": "custom.auth_status"
    },
    {
      "value": "1030",
      "type": "custom.group_id"
    }
  ],
  "userType": "Employee",
  "jobCategory": "89",
  "title": "Dr.",
  "preferredLanguage": "",
  "timezone": "",
  "active": "1",
  "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User": {
    "employeeNumber": "EUSER0001",
    "costCenter": "899",
    "organization": "IMC AG",
    "manager": {
      "value": ""
    }
  }
}

Rating

Error in the log:

02-06-2026 08:43:53.142 ERROR [http-nio-8080-exec-7] scim.SCIMUserResource [SCIMUserResource.java:248]: SCIM Error reading user Attribute jobCategory is not supported
de.imc.clix.control.exceptions.ClixException: Attribute jobCategory is not supported

Although the request contains jobCategory, however, this is not a supported standard SCIM attribute.

Solution

Define the attribute jobCategory in the request and in the mapping as a custom attribute.

{
  "schemas":
  ["urn:ietf:params:scim:schemas:core:2.0:User",
    "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"],
  "id": "EUSER0001",
  "externalId": "EUSER0001",
  "userName": "EUSER0001",
  "name": {
    "familyName": "Maxi",
    "givenName": "mum"
  },
  "displayName": "",
  "emails": [{
      "value": "",
      "type": "work",
      "primary": true
    }
  ],
  "addresses": [{
      "streetAddress": "",
      "locality": "",
      "region": "",
      "postalCode": "",
      "country": "",
      "type": "work",
      "primary": true
    }
  ],
  "ims": [{
      "value": "1",
      "type": "custom.sex"
    },
    {
      "value": "1",
      "type": "custom.auth_status"
    },
    {
      "value": "1030",
      "type": "custom.group_id"
    },
    {
      "value": "89",
      "type": "custom.jobCategory"
    }
  ],
  "userType": "Employee",
  "title": "Dr.",
  "preferredLanguage": "",
  "timezone": "",
  "active": "1",
  "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User": {
    "employeeNumber": "EUSER0001",
    "costCenter": "899",
    "organization": "IMC AG",
    "manager": {
      "value": ""
    }
  }

Error Code Reference

The following table lists all relevant error codes and their meanings.

Relevant Error Codes and Their Meanings

Information Required for a Service Desk Ticket

Please provide the following information:

• Customer System / URL

• SCIM User

• Time of the error

• Affected user

• EXT_ID_SCIM

• userName

• Email address

• Action: Create / Update / Deactivate / Delete

• HTTP Status Code

• SCIM Request Payload

• SCIM Response Payload

• Provisioning log from the identity provider

• Relevant log excerpt

• Expected behavior

• Actual behavior

Related Articles

CSV User Import via User Import Planning

CSV User Import via Backend