Connect Ping Identity (SCIM)

To generate an API token, open your Tonkean board, select your profile icon in the upper right, and navigate to Board Settings > Identity Provider. Select Create New Provider. The Create New Provider window displays.

Locate the SCIM API url and select Copy. Paste this URL into a separate document for later use.

Select the Provider Type dropdown and choose Ping Identity. Then, enter a Display Name for the provider. When finished, select Generate Token. The Access Token displays.

Select Copy to copy the access token. Paste the token in a separate file.

This is the last time you'll be able to view the decrypted token, so make sure you save it somewhere safe in case you need to reference it later.

Navigate to the Ping Identity console and log in as an administrator.

In the navigation bar, select Directory > User Attributes. The Attributes screen displays.

Select the plus button beside the screen header to add a new attribute. The Add Attribute panel displays.

Select the Declared option. The attribute configuration fields display.

Assign the attribute Name: tonkeanRoles.

In the bottom dropdown field (default No Validation), select Enumerated Values. Additional value fields display.

Add the following values, selecting + Add Value to enter more beyond the first:

When finished, select Save. Your attributes have been added.

In the Ping Identity console navigation bar, navigate to Integrations > Provisioning. The Provisioning screen displays.

Select the plus button near the heading to add a new connection. The Create a New Connection panel displays.

Select the Identity Store option. Connection options display.

Locate and select the SCIM Outbound tile, then select Next.

Enter a Name for the SCIM connection, then select Next.

In the SCIM BASE URL field, enter the SCIM API url provided in Tonkean on the Identity Provider screen.

The SCIM API url is in the format https://{env}.tonkean.com/scim/v2

Set Authentication Method to OAuth 2 Bearer Token, then set Oauth Access Token to the token value you generated in Tonkean on the Identity Provider screen. When finished, select Next.

Set Custom Attribute Schema URNs to urn:ietf:params:scim:schemas:extension:enterprise,urn:scim:tonkean, then select Save.

Return to the Provisioning screen, select the plus button near the heading, and select New Rule. The Create a New Rule panel displays.

Enter a Name for the rule, then select Create Rule. The {Rule} Configuration tab displays.

Select Target and then select the plus button for the SCIM connection you created in steps #1-8 in this section. When finished, select Save.

In the User Filter section, configure the identities to provision in the sync. No special configuration is required specifically for Tonkean in this step.

When finished specifying which identities to provision, select Attribute Mapping on the {Rule} panel. The Attribute Mapping section displays.

Select the Attribute Mapping edit button to enter edit mode.

Select the + Add button to add a new attribute. A pair of empty attribute fields display.

In the left field, select the tonkeanRoles attribute you created previously; in the right field, select custom:Tonkean.

When finished, select Save.