Guide · SCIM 2.0 · Open identity

Migrate SCIM to 0Trust

Leave paid directory brokers behind. 0Trust is an open control plane with bidirectional SCIM 2.0 for Users and Groups, plus a built-in application gallery comparable to Entra and Okta.

Why leave paid SCIM providers

Commercial IdPs sell you the same RFC 7643/7644 protocol wrapped in seat licenses, app catalog surcharges, and outbound connectors you cannot audit. 0Trust implements SCIM as open infrastructure on your plane:

Bidirectional by default

Inbound /scim/v2 for Users and Groups (Bearer) plus outbound push to each gallery/catalog app when access is assigned.

No per-app tax

Bind any SCIM 2.0 endpoint and token on a catalog app. Provisioning is part of the control plane, not a SKU.

Same plane as OIDC

Passkeys, OIDC clients, ZTNA, and directory live together — one operator surface at 0trust.cloud.

Self-host optional

Hosted issuer for most teams; container self-host via tunneltug.com/hub when you need the stack on your metal.

Typical outcome: HR or legacy IdP remains a temporary source of truth (inbound SCIM into 0Trust), while 0Trust becomes the identity provider for SSO and the provisioner for apps (outbound SCIM). After cutover, the paid broker is decommissioned.

How 0Trust SCIM works

Inbound (you are the SCIM server)

Upstream systems — Okta, Entra ID, Google, Auth0, Ping, OneLogin, JumpCloud, Workday connectors, or a temporary dual-run from another IdP — push Users and Groups to:

https://0trust.cloud/scim/v2
Content-Type: application/scim+json
Authorization: Bearer

Supported resources: User and Group (create, read, replace, patch, delete, filtered list, member ops). Auth scheme: OAuth Bearer token generated and rotated in the SCIM console.

Outbound (you are the SCIM client)

When an operator assigns a user to a catalog app (or queues a manual provision), 0Trust POSTs a SCIM User to that app's endpoint:

POST {scim_endpoint}/Users
Authorization: Bearer {app scim_token}
Content-Type: application/scim+json

{
  \"schemas\": [\"urn:ietf:params:scim:schemas:core:2.0:User\"],
  \"userName\": \"\",
  \"active\": true,
  \"name\": { \"givenName\": \"...\", \"familyName\": \"...\" }
}

Configure per app in SCIM Console → Outbound Integration (scim_endpoint + scim_token).

Roles in a migration

Role	Paid provider today	After 0Trust
SSO / OIDC issuer	Okta / Entra / Auth0	0trust.cloud
Inbound directory	HR → paid IdP	HR or paid IdP → 0Trust /scim/v2
Outbound app SCIM	Paid IdP connectors	0Trust catalog apps
Access policy	IdP groups / rules	IAM assignments + RBAC/ABAC

Attribute map

Keep mappings simple so dual-run stays deterministic. Required outbound identity attribute: email (maps to userName).

SCIM (RFC)	0Trust identity	Notes
`userName`	Username / email	Required; uniqueness enforced inbound
`emails[primary].value`	Email	Primary email preferred
`name.givenName`	given_name	Outbound optional
`name.familyName`	family_name	Outbound optional
`displayName`	Display name	Inbound; falls back to given+family
`active`	Enabled / status	false deprovisions access path
`externalId`	SCIM external link	Preserve during import for idempotent re-sync

Groups: SCIM Groups are supported inbound (CRUD + member patch) and outbound (queue group provision). Bulk remains limited. Use the application gallery for Entra/Okta/Google/Auth0/Ping tiles.

Migration paths by provider

Patterns below assume you want 0Trust as the long-term IdP. Adjust if you only need 0Trust as a SCIM spoke.

Okta

Phase 1 — parallel: Enable inbound on 0Trust. In Okta, add a SCIM 2.0 app (or Workflow) that provisions Users to https://0trust.cloud/scim/v2 with the Bearer token.
Phase 2 — apps: For each SaaS app currently provisioned by Okta, create/register a catalog app in 0Trust IAM, set the same SCIM base URL + token the vendor already issued, and stop Okta push only after a successful test assign.
Phase 3 — SSO: Move OIDC/SAML relying parties to the 0trust.cloud issuer; enroll users with passkeys; retire Okta as auth for those apps.
Phase 4 — retire: Disable Okta provisioning jobs, revoke Okta API tokens, keep export of group→role mapping for policy.

Microsoft Entra ID (Azure AD)

Use Entra Provisioning to a custom SCIM 2.0 application pointing at /scim/v2 (tenant URL + secret token).
Map userPrincipalName or mail → userName; map given/surname; set active from accountEnabled.
For Microsoft 365–centric orgs, keep Entra as HR sync source longer and cut SSO for non-Microsoft apps first.
Outbound from 0Trust replaces Enterprise Application provisioning targets you previously maintained only for third-party SaaS.

OneLogin / JumpCloud / Ping

Same dual-run: paid IdP SCIM client → 0Trust inbound; 0Trust outbound → SaaS.
Export user CSV as a safety net; use externalId if the source can send a stable employee id.
JumpCloud directory-as-a-service customers often reverse the model later: HR → 0Trust only, drop JumpCloud after device MDM is elsewhere.

Auth0 / other OIDC-only brokers

If the paid stack was mainly OIDC without real SCIM, treat this as an import + re-provision migration: create company on /start, invite/enroll users, then configure outbound SCIM to each SaaS that supports it.
Where Auth0 Actions called vendor APIs, replace with catalog app SCIM endpoints + assign-on-join.

HR-first (Workday, BambooHR, etc.)

If HR already SCIM-provisions the paid IdP, retarget the SCIM client to 0Trust inbound (or add 0Trust as a second target during dual-run).
0Trust then owns app provisioning — HR never needs a connector per SaaS tool.

Application gallery

Comparable to the Microsoft Entra gallery and Okta Integration Network: prebuilt SCIM tiles with setup steps, attribute maps, and Users/Groups flags.

Browse and install from the operator console at /scim or via GET /api/v1/scim/catalog.

Category	Examples
Identity sources	Entra ID, Okta, Google Workspace, Auth0, Ping, OneLogin, JumpCloud
HR / IGA	SailPoint, Workday (via bridge)
Target apps	Slack, GitHub, Salesforce, Atlassian, Zoom, Box, Dropbox, ServiceNow, AWS IAM Identity Center, Datadog
Generic	Custom SCIM 2.0 app tile

Install creates/updates an IAM catalog app with catalog_id, scim_supports_groups, and endpoint template — then set a concrete Bearer token for outbound targets.

Stand up 0Trust SCIM

Register and enroll

Submit a company registration at /start. After approval, complete passkey enrollment and sign in to the operator plane.

Enable inbound

Open /scim → Inbound Server. Enable inbound, generate a Bearer token (shown once), and store it in your secret manager. Base path: /scim/v2.

Smoke-test inbound

curl -sS -H \"Authorization: Bearer $TOKEN\" -H \"Content-Type: application/scim+json\" \\
  https://0trust.cloud/scim/v2/ServiceProviderConfig

curl -sS -X POST -H \"Authorization: Bearer $TOKEN\" -H \"Content-Type: application/scim+json\" \\
  https://0trust.cloud/scim/v2/Users \\
  -d '{\"schemas\":[\"urn:ietf:params:scim:schemas:core:2.0:User\"],\"userName\":\"pilot@example.com\",\"name\":{\"givenName\":\"Pilot\",\"familyName\":\"User\"},\"emails\":[{\"value\":\"pilot@example.com\",\"primary\":true}],\"active\":true}'

Register apps and outbound SCIM

In IAM, ensure each SaaS app exists in the catalog. In SCIM Console → Outbound Integration, set scim_endpoint (vendor SCIM base, no trailing /Users) and scim_token. Assign a pilot user and confirm the vendor received the User.

Point SSO at 0Trust

Create OIDC clients (or use existing app faces) with issuer https://0trust.cloud. Update redirect URIs on the SaaS side. Prefer passkeys for operators; keep enrollment invites for end users.

Dual-run and cutover

Do not flip every app on day one. Run paid provider and 0Trust in parallel until reconciliation is boring.

Inventory: List every SCIM target and whether it is SSO-only, SCIM-only, or both.
Import: Push a pilot OU/group from the paid IdP into 0Trust inbound; fix mapping errors before full org.
Shadow provision: For one non-critical app, disable paid outbound and enable 0Trust outbound; compare user counts.
SSO cutover: Move relying parties to 0trust.cloud issuer in batches; keep paid IdP login as break-glass if needed.
Full directory: Expand inbound filter to entire workforce; freeze paid IdP user creates that are not mirrored.
Decommission: Revoke paid SCIM tokens, remove app assignments there, export final audit, cancel seats.

Reconciliation tip: Use the SCIM audit trail on /scim and compare userName/externalId sets against the paid provider export. Prefer soft-deactivate (active: false) before hard DELETE until you trust reverse sync.

Cutover checklist

Done	Item
☐	Company approved; admin passkey enrolled
☐	Inbound SCIM enabled; token stored offline; rotate plan documented
☐	ServiceProviderConfig / Users smoke tests green
☐	Attribute map reviewed with HR/IT (email uniqueness)
☐	Pilot cohort synced inbound; no unexpected duplicates
☐	Each critical SaaS app has catalog entry + outbound SCIM
☐	Pilot assign → vendor user created; deprovision path tested
☐	OIDC issuer switched for pilot apps; JWKS validated
☐	Group/role → policy grants mapped (manual or workflow)
☐	Break-glass admin path independent of paid IdP
☐	Paid provider provisioning jobs disabled
☐	Tokens revoked; licenses cancelled; runbook updated

Scope and limits

Users: Full inbound CRUD + filter/list; outbound create on assign/manual provision.
Groups / bulk: Groups are supported (inbound + outbound queue). Bulk multi-op is not supported — use per-resource calls.
Password / changePassword: Not used; 0Trust prefers passkeys and enrollment, not SCIM password write.
Auth: Inbound Bearer only (admin-generated). Outbound Bearer per app.
Self-host: Same SCIM surface when running the platform container; substitute your public base URL for https://0trust.cloud.

API quick reference

Inbound (Bearer)

GET    /scim/v2/ServiceProviderConfig
GET    /scim/v2/ResourceTypes
GET    /scim/v2/Schemas
GET    /scim/v2/Users
POST   /scim/v2/Users
GET    /scim/v2/Users/{id}
PUT    /scim/v2/Users/{id}
PATCH  /scim/v2/Users/{id}
DELETE /scim/v2/Users/{id}
GET/POST /scim/v2/Groups
GET/PUT/PATCH/DELETE /scim/v2/Groups/{id}
GET /api/v1/scim/catalog
POST /api/v1/scim/catalog/{id}/install

Operator (session / admin)

GET  /api/v1/scim/status
GET  /api/v1/scim/config
GET  /api/v1/scim/inbound
PUT  /api/v1/scim/inbound
GET  /api/v1/scim/integrations
PUT  /api/v1/scim/integrations/{app_id}
POST /api/v1/scim/provision
GET  /api/v1/scim/audit

Operators manage tokens and integrations in the SCIM Console. Developers integrating OIDC stay on 0trust.codes docs.

Next steps

Start company registration Open SCIM console Back to marketing home Self-host container

Migrate SCIM to 0Trust

On this page

Why leave paid SCIM providers

Bidirectional by default

No per-app tax

Same plane as OIDC

Self-host optional

How 0Trust SCIM works

Inbound (you are the SCIM server)

Outbound (you are the SCIM client)

Roles in a migration

Attribute map

Migration paths by provider

Okta

Microsoft Entra ID (Azure AD)

OneLogin / JumpCloud / Ping

Auth0 / other OIDC-only brokers

HR-first (Workday, BambooHR, etc.)

Application gallery

Stand up 0Trust SCIM

Register and enroll

Enable inbound

Smoke-test inbound

Register apps and outbound SCIM

Point SSO at 0Trust

Dual-run and cutover

Cutover checklist

Scope and limits

API quick reference

Inbound (Bearer)

Operator (session / admin)

Next steps