Skim Provisioning
You set up skim provisioning by linking your identity tool to target apps over HTTP. This standard, spelled SCIM, creates, updates, and deletes user accounts without manual work. Most teams map central identity groups to broad app roles during setup. When those roles are too wide, users gain standing rights to sensitive data. How skim provisioning works in your stack People often say skim provisioning out loud when they mean the SCIM standard. SCIM stands for System for Cross-domain Identity
User Provisioning (SCIM): the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up skim provisioning by linking your identity tool to target apps over HTTP. This standard, spelled SCIM, creates, updates, and deletes user accounts without manual work. Most teams map central identity groups to broad app roles during setup. When those roles are too wide, users gain standing rights to sensitive data.
How skim provisioning works in your stack
People often say skim provisioning out loud when they mean the SCIM standard. SCIM stands for System for Cross-domain Identity Management. It uses a central directory as the single source of truth for user accounts. When HR hires a person, the identity tool sends a web request out. The receiving app reads that payload and makes a new local user account.
Role assignment happens through group sync rules in the identity tool. Admins place an engineer into a specific team group in the main directory. The directory then pushes that group link to every connected downstream system. Each target system maps the incoming group name to a local permission role. When the worker changes teams, the directory updates the group link right away. When the worker leaves the company, the directory sends a disable call. The downstream app then blocks the account and drops active login tokens.
How to set up user and group sync
You start the setup inside your central identity provider and your target app. First, you generate a secret token inside the target app settings. You also copy the base web address that the target app gives you. Next, you paste that address and token into the identity provider setup screen. This step lets the identity tool talk to the app over the network.
After you link the two tools, you map user fields between them. You match fields like work email, first name, last name, and department. Then you pick which groups should sync over to the target app. It is best to create narrow groups for specific job duties first. Test the sync with one test user before you push a whole team. Check the sync log to make sure the app creates the user right.
User Provisioning (SCIM): architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What directory sync solves and what it misses
Automated account sync solves a huge problem for busy IT and security teams. You no longer need to create accounts by hand across dozens of tools. Most important, it stops former staff from keeping active logins after they leave. It also keeps user names and emails matching across your whole software stack.
Still, account sync only controls who has an account and a base role. It does not watch or control what an active user does after login. A synced group often maps to a shared admin role in a database. Once logged in, that engineer can run any command or read whole tables. Sync rules cannot check individual queries or block a bad drop table command. They also cannot rewrite sensitive fields like emails or card numbers in results. To control live actions, you need checks at the command level during execution.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
Why do people spell SCIM as skim provisioning?
SCIM is pronounced just like the word skim when spoken out loud. Many engineers type the phonetic spelling when they search for setup guides online. Both terms point to the exact same System for Cross-domain Identity Management protocol.
Does SCIM handle user login as well as account creation?
No, this protocol only manages account creation, updates, group links, and removal. You still need a separate login standard like SAML or OIDC for sign-in. Teams run both standards together to handle the full user lifecycle from start to finish.
Can SCIM remove standing database rights after a task finishes?
Group sync works best for long-term role links based on job titles. It does not check live sessions or approve single queries on the fly. If a group grants database rights, the user keeps them until removed from the group.