Security
SCIM provisioning
Let your identity provider manage Relic's single sign-on users and groups through SCIM 2.0.
Relic serves SCIM 2.0 at https://relic.example.com/scim/v2, so an identity provider (Okta,
Entra ID, OneLogin, JumpCloud) can manage the users who sign in through
single sign-on, and their groups.
Connect the identity provider
- Create an administrator's access token, for example for a service account, with the
CLI:
relic auth token create --scope admin --description scim --expires-days 365 - At the identity provider, set the SCIM base URL to
https://relic.example.com/scim/v2, with that token as bearer token (Entra ID: secret token). - Map the provider's user name (such as
userPrincipalName) touserName, the Relic username.
What Relic accepts
| Resource | Operations |
|---|---|
Users | create, read, list, filter userName eq "…", replace, patch (active, emails), delete |
Groups | create, read, list, filter displayName eq "…", replace, patch members (add, remove, replace), delete |
ServiceProviderConfig, ResourceTypes, Schemas | read |
- SCIM sees only single sign-on users. A create whose name a local or LDAP account has fails
with
409 uniqueness. active: falsedisables the user and their tokens until they are active again.- Names cannot change (
400 mutability); deprovision and provision again to rename. Names match in any case. - Relic keeps one email: the primary, else the work one. An email that is not a single
address, such as
alice@example.com, fails with400 invalidValue. - A group's SCIM ID is its name. SCIM groups are ordinary Relic groups. SCIM-managed members are kept apart from those an administrator adds; each side changes only its own.
- SCIM cannot change a group that grants administrator or viewer rights (
400 mutability), and deletes a group only while it manages all its members. Guard the token like an administrator's password. - Names, titles, external IDs and extension attributes are ignored. Bulk operations, sorting and ETags are not supported.
Every SCIM change is audited under the token's user.
A groups claim at sign-in replaces the same memberships SCIM manages: use one or the other for groups.