This article describes the configuration steps for integrating idGenius as a SCIM Managed Identity Source with RSA.

Configure RSA Cloud Access Service

Perform these steps in the RSA Cloud Administration Console to configure idGenius as a SCIM Managed Identity Source for Cloud Access Service (CAS).

Procedure

1. Sign in to the RSA Cloud Administration Console as a super admin.
   
   

   Figure 1. RSA Cloud Administration Console — tenant dashboard.
   
   

2. Click Users > Identity Sources.
   
   

   Figure 2. Identity Sources list — a SCIM Managed source with Managed = External and Status = Enabled appears once configured.
   
   

3. Click Add Identity Source.
   
   

   Figure 3. RSA Identity Source – SCIM Managed source configuration.
   
   

4. On the Identity Source Details page, configure the values as described in the following table and click Save.
   

   Field	Value/Description
   Identity Source Name	A descriptive name for the SCIM Managed identity source (for example, IDG_<environment>)
   Description	Optional free-text description
   Enable User Provisioning from a SCIM Identity Source	Enabled
   External SCIM ID Source Admin URL	https://<idgenius-tenant>.idgenius.io — link to the idGenius admin UI where the external SCIM identities are managed. Used by RSA admins as a deep-link for troubleshooting; it is not invoked by RSA at runtime.
   SCIM Service Provider Base URL	https://<rsa-tenant>.auth.securid.com/scim/v2/<scim-tenant-id> — auto-generated by RSA. Copy this value into the idGenius outbound provider configuration.
   Authentication type	API Key (Bearer Token) or OAUTH (See Authenticate Using OAuth)
   SCIM Service API Key	Generated by RSA at source creation; copy it into idGenius. Use View Key/Copy Key in the console, or Regenerate Key if another key is required.
   Network Zone	Default (unless a custom network zone has been defined)
   Password Type	RSA Unified Directory
   RSA Password is	Allowed
   Initial Password Creation Option	Generated by CAS, displayed on screen to the admin

        
   Important: The API Key is visible only at creation and after explicit View/Regenerate. Capture it before navigating away — once obscured, the only way to recover it is to regenerate (which invalidates the previous key and breaks the idGenius outbound connection until the new key is pasted on the idGenius side).

5. On the User Attributes page, verify the SCIM attribute schema exposed for policy and application use. RSA presents the supported user attributes for SCIM-managed sources. In the Policies column, select user attributes that are required for access-policy target population matching. In the Apps column, select attributes that may be required for SAML application or relying party assertions.
   
   

   Figure 4. RSA Identity Source – User Attributes tab. The full SCIM attribute schema is enumerated here; select the attributes required for Policies and Apps.
       

6. Click Save, and then click Publish Changes to make the new identity source active for runtime authentication and SCIM ingest.

Authenticate Using OAuth    

Prerequisites from RSA ID Plus

Create an RSA “SCIM API” OAuth client by following the steps mentioned below and collect the following values. Tenant-specific identifiers are shown as placeholders; substitute the values from your own RSA tenant.

     
Note: RSA stores only the public half of the signing key; the matching private key (JWK) is held by the SCIM client (idGenius). When RSA’s Generate Key Pair helper is used, download the private key and place it in a secret store — it is the only copy outside idGenius. If the private key is lost, regenerate the pair and re-register the public key on the RSA client.
   

Procedure

1. Go to Platform > API Access Management. Make a note of the Administration API REST URL and Authentication API REST URL displayed in the OAuth Clients pane.
2. Click Add API Client.
3. Basic Information: Enter a Name (for example, IdGenius-SCIM-OAuth) and an optional Description, then set Client Type = SCIM API.
4. Click Next Step.
5. Authentication: RSA pre-fills the Issuer URL and a generated Client ID; Grant Type is Client Credentials, and Client Authentication is fixed to Private Key JWT. Click Generate Key Pair, then Autofill to place the public key, then Download and Finish to save the private key locally. (Alternatively, paste a public key you generated yourself.) Leave Access Token Lifetime at 5 minutes.
6. Permissions: Expand SCIM Management and select the rsa.auth.scim.manage permission, then click Save and Finish.
7. Click Publish Changes so the new client takes effect; the status banner returns to Success.
8. Record the Client ID, Issuer URL, and scope for use in idGenius.
   
   

   Figure 5. RSA “SCIM API” OAuth client — Authentication step. Grant Type = Client Credentials, Client Authentication = Private Key JWT (the only option), with the generated public key and a 5-minute access-token lifetime.

      
   
   

   Figure 6. RSA API Access Management — the published SCIM API OAuth client listed under OAuth Clients, alongside the REST base URLs.
     

Note: A SCIM Managed source is read-only from the RSA Cloud Administration Console: users cannot be added or edited locally; all mutations must come from the SCIM client (idGenius).
RSA allows up to 30 identity sources per tenant; this integration consumes one.
The SCIM Service Provider Base URL embeds a tenant-specific identifier. Treat the URL as tenant-specific and do not share it across environments.

Configure idGenius

Perform these steps in idGenius to push HIDs into the RSA ID Plus Unified Directory.

Procedure

1. Sign in to idGenius as a tenant administrator at https://<idgenius-tenant>.idgenius.io.
2. In the left pane, go to Settings > Administration.
   The Administration page is displayed.
   
   

   Figure 7. idGenius Settings > Administration.
         

3. On the SCIM tab, click the Outbound sub-tab.
   The list of outbound SCIM providers is displayed.
   
   

   Figure 8. SCIM administration — Outbound providers list with status, last sync, sync counters and per-row action buttons.
         

4. Click Add Outbound Provider (or Edit on an existing provider) to open the configuration dialog.
   
   

   Figure 9. Edit Outbound Provider — RSA ID Plus configuration.
       

5. Populate the dialog with the values from RSA.
   

   Field	Value
   Name	A descriptive name for the outbound provider (for example, RSA ID Plus)
   Description	Optional internal note
   Provider Type	RSA SecurID
   SCIM Base URL	The SCIM Service Provider Base URL issued by RSA: https://<rsa-tenant>.auth.securid.com/scim/v2/<scim-tenant-id>
   Authentication Type	API Key (Bearer Token). OAuth 2.0 is a supported alternative — see Authenticate Using OAuth
   API Key	The value copied from the RSA Identity Source page. The field is write-only after save — to rotate, regenerate on the RSA side, and re-enter here
   Sync Users	Enabled — pushes HID create/update/deactivate
   Sync Groups	Disabled — pushes idGenius Group memberships as SCIM Groups. Not in scope for this integration, as RSA does not support SCIM Groups
   Sync Third Parties as Groups	Optional. When enabled, idGenius Third Parties are pushed as SCIM Groups (members = HIDs assigned to the Third Party). Not in scope for this integration, as RSA does not support SCIM Groups
   Sync Projects as Groups	Optional. When enabled, idGenius Projects are pushed as SCIM Groups (members = HIDs assigned to the Project). Not in scope for this integration as RSA  does not support SCIM Groups
   Identity Type Filter	All subtypes, or restrict to a specific HID subtype (Contractor, Intern, and so on)
   State Filter	Active only — Inactive HIDs are not pushed as new users, but transitions from Active > Inactive trigger a deactivate against RSA

          
6. Click Save Changes.
   The provider row appears with Status = Enabled.
7. Verify the connection. In the provider row, click Test Connection (which validates the bearer token against the RSA SCIM service root), then click Sync Now to perform an immediate full reconciliation. The Sync Status column reports the last cycle outcome.
8. Review the Attribute Mappings. Click Attribute Mappings in the provider row. The default per-connection rules translate idGenius HID fields into the SCIM 2.0 Core User schema consumed by RSA. The rules can be re-ordered, extended, or overridden. The default scope means the rule ships with idGenius; rules added by an administrator are scoped to this connection only.
   
   

   Figure 10. idGenius outbound attribute mappings for RSA ID Plus.

         
   

   #	idGenius source	SCIM target (RSA User schema)	Transform
   10	Resolved User Name (work email > external ID > ID)	userName	direct
   20	HID First Name	name.givenName	direct
   30	HID Last Name	name.familyName	direct
   40	HID Middle Name	name.middleName	direct
   50	Formatted Name (first middle last)	name.formatted	direct
   60	HID Display Name	displayName	direct
   70	Active (state == "active")	active	direct (boolean)
   80	Work Email	emails [primary=true, type=work]	direct
   90	Work Phone	phoneNumbers [primary=true, type=work]	direct
   100	HID Title attribute	title	direct
   110	HID Employee Number attribute	employeeNumber	direct
   120	HID Department attribute	department	direct
   130	HID Division attribute	division	direct
   140	HID Organization attribute	organization	direct
   150	HID Manager ID attribute	manager.value	direct

              
   Tip:  Per-connection rules override organization-wide rules on the same SCIM target. Use Org Mappings (Settings > Administration > SCIM > Outbound > Org Mappings) only when an attribute should be rolled out uniformly across every outbound provider in the tenant.
9. Monitor sync execution. Click View Logs on the provider row to inspect the provision history. Each row records the timestamp, operation (create/update/deactivate), object type, internal idGenius UUID, HTTP status code returned by RSA, and any error.
   
   

   Figure 11. Provision Logs — outbound SCIM activity. The log captures the full identity lifecycle: HTTP 201 on user provision, HTTP 200 on update and deactivate, with the operation, object type and internal UUID for each entry.

Authenticate Using OAuth

1. Sign in to idGenius (https://<idgenius-tenant>.idgenius.io/) and go to Settings > Administration > SCIM > Outbound.
2. Click Add Outbound Provider (or Edit an existing one).
3. Set a Name (for example, RSA ID Plus (OAuth)) and Provider Type = RSA SecurID.
4. SCIM Base URL: Enter the RSA SCIM endpoint (https://<rsa-tenant>.auth.securid.com/scim/v2/<scim-tenant-id>) — the same target URL the API-key method uses.
5. Authentication Type: select OAuth, then fill:
   1. OAuth Token URL = https://<rsa-tenant>.auth.securid.com/oauth/token
   2. OAuth Client ID = the Client ID generated by RSA in Part A
6. Client Authentication Method: select Private Key JWT (RSA ID Plus). Two fields appear:
   1. Private Signing Key (JWK JSON) = paste the RSA private JWK generated in Part A. It is encrypted at rest and never returned by the API; the badge changes to “Key configured” once saved.
   2. OAuth Scopes = rsa.auth.scim.manage (pre-filled when Private Key JWT is selected for an RSA provider).
7. Set the Sync toggles (Users) and the Identity Type/State filters as required, then click Save Changes/Create Provider.
8. Click Test Connection — for OAuth this forces a token exchange and then reads RSA over the authenticated channel (see Verification and Sync Results).

API Key vs. OAuth

Note: The SCIM scheduler runs on a recurring interval; click Sync Now to force an immediate reconciliation after a configuration change.

Verification and Sync Results

After the initial reconciliation, both ends should reflect the same identity inventory for the set of HIDs that satisfy the State/Identity Type filters.

    
idGenius end – HID inventory

The idGenius Identities > Humans page is the operational source of truth. Each HID has a state (Active, Inactive, Pending) and a type (Contractor, Intern, Support, and so on) that together determine whether it is pushed by the outbound SCIM provider.

      

RSA end – Identity Source state

On the RSA side, the SCIM Managed identity source reports Status = Enabled, Managed = External, with SCIM activity flowing in. The provider row in idGenius surfaces the sync counters per object type.

Note: A non-zero Failed/filtered counter typically corresponds to records that do not satisfy the outbound filter (for example, HIDs without a resolvable userName) or that have stale state from before the SCIM provider was enabled. Re-running Sync Now after remediating the source attributes moves them into Synced OK.  

Round-trip evidence from the provision logs

Create (HTTP 201) —onboarding writes a new User into RSA.
Update (HTTP 200) — periodic reconciliation pushes attribute deltas (title, department, manager, and so on).
Deactivate (HTTP 200) —offboarding sends a PATCH active=false; the user remains in the RSA Unified Directory in a Disabled / Inactive state with the audit history retained.
For OAuth providers, Test Connection first forces an OAuth token exchange (so invalid credentials fail here rather than silently at sync time) and then exercises an authenticated endpoint, GET /Users?count=1. A successful result returns a real SCIM ListResponse from RSA.

Figure 12. idGenius — Test Connection on an OAuth provider succeeds via a real Private Key JWT token exchange, followed by an authenticated read of RSA.
   

Note: Because Test Connection performs the OAuth token exchange and an authenticated GET /Users, a passing result confirms credentials, scope, and connectivity end-to-end — that is, provisioning over this channel will work. It reads count=1; no users are created or modified.