All Products
Search

This Product

    Identity as a Service:Sync accounts to Alibaba Cloud RAM by using SCIM in Alibaba Cloud IDaaS

    Document Center

    Identity as a Service:Sync accounts to Alibaba Cloud RAM by using SCIM in Alibaba Cloud IDaaS

    Last Updated:Oct 31, 2026

    Use the System for Cross-domain Identity Management (SCIM) protocol to synchronize Alibaba Cloud IDaaS accounts to Resource Access Management (RAM) and automate identity management.

    Prerequisites

    1. Your Alibaba Cloud account or RAM user has the permissions to create OAuth applications.

    2. Your Alibaba Cloud account or RAM user has the permissions to grant authorization to a ServerApp, and you can grant authorization only to a ServerApp that belongs to your account.

    Step 1: Create an OAuth application and grant authorization in the RAM console

    1. Use your Alibaba Cloud account to log on to the RAM console.

    2. In the left-side navigation pane, choose OAuth Applications Preview > Enterprise > Create Application.

    3. Enter the Application Name and Display Name. For the application type, select Server Application, and then click Create Application. The application is created.

      Access Token Validity Period defaults to 3600 seconds. Valid values: 900 to 10800 seconds.

    4. Click the name of the application that you created. On the OAuth Scope tab, click Add OAuth Scopes. In the Add OAuth Scopes dialog box that appears, select /acs/scim, and then click OK.

      Set Access Token Validity Period to 3600 seconds (valid values: 900 to 10800 seconds).

    5. Grant authorization to the OAuth application. On the Application OAuth Scopes tab, click Authorize. On the application authorization page that appears, select Alibaba Cloud Cross-Domain Identity Management, and then click Authorize.

    6. On the App Secrets tab, click Create Secret. The system automatically generates an application key pair that includes an AppSecretId and an AppSecretValue.

    7. After the key is generated, click Download Secret to save the key file to a secure location. After you confirm that the file is saved, click close to exit the current window.

      Important

      The secret is displayed only when it is created. After you close the window, you cannot retrieve it.

    Step 2: Configure SCIM synchronization in IDaaS

    1. In the IDaaS instance console, on the Applications page, click Add Application to open the Marketplace, select the Alibaba Cloud User SSO application template, and then add it.

    2. Click the Account Sync tab. Set the synchronization scope, and then click Save.

    3. Turn on Synchronize IDaaS Account on Application.

    4. Configure the basic settings.

      1. Enter client_id and client_secret.

        1. Log on to the RAM console. In the left-side navigation pane, choose Integrations > OAuth Applications Preview.

        2. Find the application that you want to use for SCIM synchronization and click its name to open the details page.

        3. In the Basic Information section of the application details page, you can get the Application ID (that is, the client_id).

        4. In the secret generation step in Step 1, use AppSecretValue as the Client Secret.

      2. Operation invocation: You can subscribe to specific change events, such as user creation, updates, and deletions. When a related change occurs in IDaaS, the system automatically triggers synchronization and pushes the changes to the target application in real time.

      3. Full push scope: If you select this option, a one-click push sends the data within the scope to the application.

    5. Field mapping: You can customize the SCIM field mappings and adjust the attribute matching rules based on your business requirements. After you make the adjustments, click Save to ensure accurate data synchronization.

      Important

      When you use the SCIM protocol to synchronize IDaaS accounts to RAM, the mobile phone number and email attributes of users cannot be mapped.

    6. After you complete the configuration, click Save. (Recommended) Use the Test Connectivity feature to check whether the configuration is correct.

      If needed, you can use the one-click push feature to push all accounts within the synchronization scope to RAM at once.

    Step 3: Synchronize accounts in IDaaS

    After you click Push Now, the accounts within the synchronization scope are synchronized to RAM.

    When you click Push Now, a green notification appears in the upper-right corner of the page: "The import task is created. To view the task progress, go to Logs - Sync Logs - Task In Progress." You can click View to go to the synchronization log page.

    References