Once Single Sign-on (SSO) is set up you can then configure System for Cross-domain Identity Management (SCIM) provisioning in OneLogin with Udemy Business. This will allow you to provision, deprovision, create groups, manage group membership and change user profile details like name and email address in OneLogin, which automatically updates Udemy Business.
This article outlines how you can configure SCIM provisioning with OneLogin.
Note: SCIM API tokens for Udemy Business last for approximately two years. Admins will be sent a notification informing them of:
- 30 days before the token expiry
- After the token expiry
How to enable SCIM Provisioning
To enable SCIM Provisioning for your Udemy Business account, first go to your Udemy Business account and access Manage > Settings > Provisioning (SCIM).
Click Start Setup and follow the instructions to enable SCIM and generate the Secret Token (Bearer token) which you then need to save in OneLogin.
Next, in your OneLogin admin portal, you will need to create a new application to support SCIM.
Additional information regarding how to provision users is also available in One Login's support center.
1. In the admin panel click on the applications tab:
2. Search for Udemy for Business and select the application with “ SAML 2.0, provisioning”
3. Name the application with an identifier to show it's a SCIM only application. For example, “Udemy Business - SCIM only”.
4. Click Save.
5. Navigate to the “Configuration” tab. Inside the “Configuration” tab, input your Udemy Subdomain. For example, if you logged in with https://demo.udemy.com, you would enter demo.
6. Enter your SCIM bearer token from your Udemy Business account that was generated above, and set to “Enabled”
7. Click Save
8. Next, navigate to the “Provisioning” tab, and check the “Enable provisioning” box:
Keep “Create user, Delete user, Update user” unchecked unless you want to approve each request individually.
9. Assign the relevant users to your new application.
- On the top tab, go to Users → Users.
- Search for the User and click on the user
- Go to the Applications tab on the left-hand side.
- Click on the + Icon on the right-hand side of the screen and select the application you just created.
- Click Continue and Save.
Creating a rule to sync a user’s group with Udemy Business
OneLogin uses the concept of “rules” in order to sync a user with a particular group in your Udemy Business account. There are many ways to create rules based on your different requirements for syncing groups. The following is one specific example of how to create a rule to sync a user with a group called “Engineers”.
1. Navigate to the “Rules” tab and select “Add Rule”:
2. Prerequisite: Before moving to the next step, please contact our Support Team and request that they enable the feature flag that will allow SCIM groups to be pulled from Udemy Business. With this feature enabled you can pull the existing groups from Udemy Business and access them in OneLogin.
3. Inside of the “Edit Mapping” screen is where you can configure the logic for your rule. In this example, we create a rule where the logic is “If the Group of the user is Engineering Group then the action is set the user’s group in Udemy Business to Engineers”: In order to pull groups “From Existing” in Udemy Business - you will need to refresh entitlements.
4. Navigate to the “Parameters” tab:
Supported attributes
Confirm that the required attributes below are added in the Parameters Tab Attributes as these fields are required for SCIM provisioning to function within Udemy.
SCIM Attribute |
Namespace |
Type |
Required |
Description |
|---|---|---|---|---|
|
|
Standard |
Yes |
The externalId of the user from IdP. Must be unique. |
|
|
Standard |
Yes |
Work email. Must be unique. |
|
|
Standard |
Yes |
Username from the IdP. Must be unique. |
|
|
Standard |
No |
First name. |
|
|
Standard |
No |
Last name. |
|
|
Standard |
No |
Full name object. |
|
|
Standard |
No |
Job title (e.g. "Senior Engineer"). |
|
|
Enterprise |
Yes |
Returns employeeNumber field from EnterpriseSchema and store it as external_id field |
|
|
Enterprise |
No |
The name of the organization the user belongs to. |
|
|
Enterprise |
No |
The SCIM id of the user’s manager |
|
|
Enterprise |
No |
The name of the division the user belongs to. |
|
|
Enterprise |
No |
The name of the department the user belongs to |
|
|
Enterprise |
No |
The name or code identifying the user's cost center. |
|
|
Custom |
No |
A comma-separated list of license types. Accepted values:
|
|
|
Custom |
No |
The license pool name. |
|
|
Custom |
No |
The lms User ID. |
Note: adding parameters might not take effect immediately as OneLogin does a parameter sync daily.
5. Click on the “Groups” field:
6. Check the “Include in User Provisioning” box and save:
7. Now, after adding a user in OneLogin and setting that user’s group to “Engineering Group”:
8. Once the user is added to the Udemy Business application and synced, based on the rule, this user will be added to the “Engineers” group in your Udemy Business account: