Installation and Upgrade > Installing ThingWorx > Security Configuration > Provisioning > Using SCIM with ThingWorx > SCIM Setup when PingFederate is the CAS > Configure SCIM in the PingFederate Administrative Console and in the ThingWorx Configuration Files > Define an SP Connection for SCIM
Define an SP Connection for SCIM
In this step, you will define a new SP connection to manage outbound provisioning.
* 
For more information, see the Ping Identity Knowledge Center: SP connection management.
1. Select Identity Provider > SP Connections > Create New.
2. Under Connection Type, select Outbound Provisioning. For Type, select SCIM 1.1 Service Provider and then click Next.
3. Under General Info, enter the following:
PARTNER’S ENTITY ID (CONNECTION ID)
Your partner's unique connection identifier.
Connection Name
Unique name to identify the connection.
Base URL
Enter the fully qualified ThingWorx server URL. For example:
https://example.com:8443/ThingWorx/SCIMProvider
4. Under Outbound Provisioning, click Configure Provisioning and enter the following information:
Users Resource URL
Enter the fully qualified URL to the ThingWorx server users. For example:
https://example.com:8443/ThingWorx/SCIMProvider/SCIM/Users
Groups Resource URL
Enter the fully qualified URL to the ThingWorx server groups. For example:
https://example.com:8443/ThingWorx/SCIMProvider/SCIM/Groups
Authentication Method
OAUTH 2.0 BEARER TOKEN
User
Password
Enter the ThingWorx username and password that you provided when creating the Password Credential Validator instance.
Client Id
Client Secret
Use the Client ID and Client Secret values specified in Create an OAuth Client for SCIM.
Token Endpoint URL
Enter the fully qualified URL to the ThingWorx OAuth token. For example:
https://<PingFederate server>:9031/as/token.oauth2
* 
This was created as part of the SSO setup.
You can verify the endpoint from the PingFederate Administrative Console. Select OAuth Server > Authorization Server Info > OAuth Endpoints.
SCIM SP Supports Patch Updates
Deselect this checkbox.
Provision Groups With Distinguished Name
Deselect this checkbox.
Deprovision Method
Select one of the following:
• DELETE USER—When the user is deleted from the LDAP, they are also deleted from ThingWorx.
• DISABLE USER—When disabled from the LDAP, the user will continue to exist in ThingWorx but not be able to log in.
5. Under Custom SCIM Attributes, enter the following:
Extension Namespace
Keep the default value:
urn:scim:schemas:extension:custom:1.0
Custom Attributes
Use this field to define any custom SCIM attributes. For more information, see the Ping Identity Knowledge Center: Specifying custom SCIM attributes.
6. Click Next to Manage Channels. From here, you will create a new channel to your data store: Create a Channel to the Directory Server
Was this helpful?