Begin of the insertion# User Problem

## User

* Administrators managing user synchronization betweenEnd of the insertion Begin of the deletion **As** an administrator
**I want**End of the deletion OpenProject Begin of the insertionand their identity provider (IdP).


## Problem

* Administrators needEnd of the insertion to Begin of the insertionkeep OpenProject user data in sync with their IdP. Currently, they lackEnd of the insertion Begin of the deletion be able to act asEnd of the deletion a Begin of the insertionstandardized, automated way to handle user provisioningEnd of the insertion Begin of the deletion SCIM server,
**so that** my centrally managed usersEnd of the deletion and Begin of the insertionde-provisioning.


## Pain

* Manual user management processesEnd of the insertion Begin of the deletion groupsEnd of the deletion are Begin of the insertiontime-consuming and error-prone.

* Lack of automation increases the risk of outdated or incorrect user data.

* No current support for SCIM-standard synchronization leadsEnd of the insertion Begin of the deletion also provisionedEnd of the deletion to Begin of the insertionadditional integration complexities.


# Business CaseEnd of the insertion Begin of the deletion OpenProject.End of the deletion

Begin of the insertion## Reach

* Medium: Affects enterprise customers using corporate IdPs needing automated user synchronization


## Impact

* High: Streamlines user management, reduces manual workload, and ensures accurate user data.


## Confidence

* Medium: Technical risks include ensuring API security and correctEnd of the insertion Begin of the deletion We want OpenProject to support theEnd of the deletion SCIM protocol Begin of the insertionimplementation. Using an existing Ruby gem can mitigate some risks.


## Urgency and Priority

* Medium: The feature is plannedEnd of the insertion for Begin of the insertionEnterprise Corporate plansEnd of the insertion Begin of the deletion management of usersEnd of the deletion and Begin of the insertionpart of a larger goalEnd of the insertion Begin of the deletion groups,End of the deletion to Begin of the insertionachieve a seamless cross application experienceEnd of the insertion Begin of the deletion allowEnd of the deletion for Begin of the insertionusers.


## Solution

* CRUD API endpoints implemented according to SCIM specification

* Actions executed via a designated system-level user (SCIM system user) or clarified alternative

* Only available for Enterprise (Corporate) plan customers

* Administrators can create, manage,End of the insertion Begin of the deletion central provisoning of usersEnd of the deletion and Begin of the insertiondelete "system-level" Bearer tokens specifically for authenticating SCIM API requests

* System-level tokens restricted by scope, initially limitedEnd of the insertion Begin of the deletion groups. In contrastEnd of the deletion to Begin of the deletion synchronizing users through LDAP, where OpenProject has to pull information periodically,End of the deletion SCIM Begin of the insertionAPI access

* Token creation accessible via Admin Authentication settings


## Out of Scope forEnd of the insertion Begin of the deletion invertsEnd of the deletion the Begin of the insertionMVC

* Additional token scopes beyond SCIM API

* Custom attribute synchronization from IdP to OpenProject (to be clarified)

* Expiring tokens (to be clarified)


##

# Launch and Growth

## Measures

* Number of Enterprise customers adopting the SCIM API.

* Feedback on API ease of use and integration.


## Messaging

<figure class="table op-uc-figure_align-center op-uc-figure"><table class="op-uc-table"><tbody><tr class="op-uc-table--row"><th class="op-uc-table--cell op-uc-table--cell_head"><p class="op-uc-p">Headline</p></th><td class="op-uc-table--cell"><p class="op-uc-p">Simplify User Management with SCIM API IntegrationEnd of the insertion Begin of the deletion control flow, allowingEnd of the deletion for Begin of the insertionOpenProject</p></td></tr><tr class="op-uc-table--row"><th class="op-uc-table--cell op-uc-table--cell_head"><p class="op-uc-p">First Paragraph</p></th><td class="op-uc-table--cell"><p class="op-uc-p">OpenProject now supports automatedEnd of the insertion Begin of the deletion a push-basedEnd of the deletion user Begin of the insertionsynchronization via SCIM API, enabling seamless integration with your identity provider. Simplify and secure userEnd of the insertion provisioning and Begin of the insertionde-provisioning while ensuring accurate user data across systems.</p></td></tr><tr class="op-uc-table--row"><th class="op-uc-table--cell op-uc-table--cell_head"><p class="op-uc-p">Customer Quote</p></th><td class="op-uc-table--cell"><p class="op-uc-p"><br></p></td></tr></tbody></table></figure>

## Go to market

* Inform partners and clients directly

* Promote the feature in newsletter and blog post in product update blogs and webinars.

* Highlight in the Enterprise plan feature list.

<br>


<br>

_**Open Questions:**_
_Should it be possible to deactivate the SCIM API?_
_Should a dedicated &quot;SCIM User&quot; be used?_
_What scopes will we have for the system-level baerer token?_
_Do system-level bearer tokens also need Enterprise Corporate plan activated?_
Do we need token expiration management?
De we want custom attribute synchronization from IdP to OpenProject?End of the insertion Begin of the deletion thus should make newly created users immediately available.End of the deletion