Installation and Upgrade > Installing ThingWorx > Security Configuration > Provisioning > Using SCIM with ThingWorx > SCIM Setup when PingFederate is the CAS > Configure SCIM in the PingFederate Administrative Console and in the ThingWorx Configuration Files > Configure SCIM in Platform Settings and in SSO Settings for ThingWorx – PingFederate
Configure SCIM in Platform Settings and in SSO Settings for ThingWorx – PingFederate
Set additional SCIM configuration options in the following files:
platform-settings.json (all users)
sso-settings.json (only users who have configured SSO)
For more information, see Platform Settings and Configure sso-settings.json File.
platform-settings.json
These settings interact with the SCIM subsystem.
"PlatformSettingsConfig": {
"SCIMSettings": {
"enableSCIM": "true",
"autoStart": "false",
"ignorePFTestConnections": "true"
}
}
autoStart
• true—The SCIM subsystem starts automatically after a ThingWorx reboot.
• false—You must manually start the SCIM subsystem after a reboot.
enableSCIM
• true—The SCIM subsystem is enabled at run time within the ThingWorx web application.
• false—The SCIM subsystem is disabled at run time within the ThingWorx web application.
ignorePFTestConnections
• true—The SCIM subsystem handles PingFederate testing connections.
• false—The SCIM subsystem does not handle PingFederate testing connections. You will see wso2 exceptions in the Tomcat console or security log.
sso-settings.json
The values below are only examples. Your values will be different depending on your setup.
"SCIMAccessTokenServicesSettings": {
"authScimOAuthClientId": "SCIMClient"
"clientId": "SCIMClient",
"clientSecret": "ABC123_xyz",
"authScimOAuthClientIdAttrName": "client_id",
"checkTokenEndpointUrl": "https://<PingFederate server>/as/introspect.oauth2"
}
authScimOAuthClientId
Mandatory.
The OAuth client ID configured for SCIM.
(Use the value you provided in the CLIENT ID field in Create an OAuth Client for SCIM.)
clientId
Mandatory.
The OAuth client ID configured in the CAS used for token services.
(Use the value you provided in the CLIENT ID field in Create an OAuth Client for SCIM.)
clientSecret
Mandatory.
The value you provided in the CLIENT SECRET field in Create an OAuth Client for SCIM.
checkTokenEndpointUrl
Mandatory.
The fully qualified URL pointing to the OAuth token introspection endpoint.
* 
You can verify the endpoint from the PingFederate Administrative Console. Select OAuth Settings > Authorization Server > InfoOAuth Endpoints.
authScimOAuthClientIdAttrName
Optional.
This is a Client ID verification. The validation compares the authScimOAuthClientIdAttrName value claim with the value of authScimOAuthClientId property.
For PingFederate, the value will usually be client_id.
For EntraID, the value will usually be appid.
Was this helpful?