About SCIM

What is SCIM

SCIM (System for Cross‑domain Identity Management) is a standard protocol that enables automated exchange of identity information between systems. With SCIM integration, user and group creation, updates, and deactivation in an Identity Provider (for instance, in Microsoft Entra ID) are automatically synchronized/provisioned to Dispatcher Paragon Cloud.
SCIM is not authentication nor SSO — SCIM handles only provisioning, meaning user account lifecycle management.

How SCIM works

  • Dispatcher Paragon Cloud provides an SCIM endpoint (URL).

  • Identity Provider regularly synchronizes user and group changes via that SCIM endpoint.

  • Dispatcher Paragon Cloud applies the changes (creates, updates, or deletes the users and groups).

High-level architecture

SCIM is one‑way: changes flow from Identity Provider to Dispatcher Paragon Cloud (SCIM Push mode).

image-20260807-111853.png
High-level architecture

Supported User and Group attributes

SCIM schema defines many user and group attributes that can be synchronized via the SCIM protocol (see RCF 7643, Section 4 for a complete overview).
Dispatcher Paragon Cloud supports a subset of these attributes. Further, Dispatcher Paragon Cloud extends the SCIM schema with print-specific user attributes.

Dispatcher Paragon Cloud supports the following basic user SCIM attributes:

  • id

  • displayName

  • emails[type eq "work"].value

  • active

  • userName

Further, Dispatcher Paragon Cloud defines and supports the following print-specific user SCIM attributes:

  • urn:ietf:params:scim:schemas:extension:print:2.0:User:department

  • urn:ietf:params:scim:schemas:extension:print:2.0:User:nameAlias

  • urn:ietf:params:scim:schemas:extension:print:2.0:User:homeFolder

  • urn:ietf:params:scim:schemas:extension:print:2.0:User:pin

  • urn:ietf:params:scim:schemas:extension:print:2.0:User:cardNumbers

Dispatcher Paragon Cloud supports the following basic group SCIM attributes:

  • displayName

  • externalId

  • members

Fallback during outages

If Dispatcher Paragon Cloud is unavailable (e.g., maintenance, outage, deployment):

  • An Identity Provider logs an error, but provisioning does not stop.

  • After some time, it retries sending the changes.

  • Once Dispatcher Paragon Cloud becomes available again, provisioning continues where it left off.

Changes are not lost — only delayed.

Limitations

Authentication methods

In the authentication provider defined in the Dispatcher Paragon Cloud Web UI, several authentication methods are available.

SCIM is supported in combination with the OIDC authentication method; SCIM extends the OIDC authentication capabilities by allowing users to log in at the MFD terminal using their company cards and PINs stored in an Identity Provider.

SCIM is not supported in combination with the Service Account authentication method, SSO, or Client-based authentication.

Dispatcher Paragon Cloud Client login

There are several authentication types available in the Dispatcher Paragon Cloud Client:

image-20260818-103520.png

The deprecated type “Manual login to SAFEQ Cloud server“ is not supported for the OIDC authentication method, so it is not supported for the OIDC + SCIM authentication method.

The deprecated type “Manual login to SAFEQ Cloud server“ is supported only for the Service Account authentication method.

Possible data divergence

SCIM provisioning is one‑way and sends only changes originating in an Identity Provider.

This means:

  • Manual user edits in Dispatcher Paragon Cloud may cause inconsistencies.

If data becomes inconsistent, it is necessary

  • Either restart provisioning in the Identity Provider, which triggers a full synchronization of all users and groups

  • or execute provisioning on demand for that specific user/group in the Identity Provider

Divergence from the SCIM specifications

SCIM is defined in these specifications:

 

Dispatcher Paragon Cloud SCIM implementation diverges from the specification in these points:

  • SQC SCIM implementation does not support modifying resources via HTTP PUT (RCF 7644, Section 3.5.1). Users and groups can be modified only via HTTP PATCH.

  • SQC SCIM implementation does not support BULK updates (RCF 7644, Section 3.7)

  • SQC SCIM implementation ignores the query parameter attributes (RCF 7644, Section 3.4.2.5)