---
title: Ping Identity SCIM Integration
slug: turbine-user-guide/xsmf-ping-identity-scim-integration
docTags: 
createdAt: 2026-02-17T08:14:49.000Z
---

Swimlane Turbine supports SCIM 2.0 integration with **Ping Identity**. This integration enables administrators to automatically provision and de-provision users and groups from Ping to Swimlane Turbine using the SCIM standard.

SCIM helps customers manage onboarding and offboarding of users centrally in Ping without logging in to Swimlane Turbine for manual user management.

## Choose Your Path

| Goal                           | Go to                                                                                                                                    |
| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------- |
| Configure Ping SCIM connection | [How to Configure Ping Identity SCIM](https://docs.swimlane.com/xsmf-ping-identity-scim-integration#how-to-configure-ping-identity-scim) |
| Create a provisioning rule     | [Creating a Provisioning Rule](https://docs.swimlane.com/xsmf-ping-identity-scim-integration#creating-a-provisioning-rule)               |
| Attribute mapping              | [Field Mapping Requirements](https://docs.swimlane.com/xsmf-ping-identity-scim-integration#field-mapping-requirements)                   |
| Parent SCIM reference          | [Provisioning with SCIM Integration](docId\:uCYk5MLy9Erosd2-nvjpU)                                                                       |

# How to Configure Ping Identity SCIM

Use this section to configure a SCIM outbound provisioning connection and provisioning rules in Ping Identity.

1. Sign in to the **Ping Identity (PingOne) administrative console**.
2. In the left navigation menu, under **Integrations**, click **Provisioning**.
3. On the **Provisioning** page, click the **plus (+)** icon.
4. Click **New Connection**.
5. Under **Choose a connection type**, click **Select** next to **Identity Store**.
6. From the available options, select **Provisioning Identity Store - SCIM Outbound**.
7. Click **Next**.
8. Customize the connection details:
   - Name (required)
   - Description
   - Icon (optional)
9. Click **Next**.

![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/6ovkE_8tn8zE3Ep18M7oA-20260217-102226.png)

## Configure Authentication Settings

Under **Authentication Configuration**, enter the following values:

| **Field**             | **Value**                                                              |
| --------------------- | ---------------------------------------------------------------------- |
| SCIM Base URL         | `https://<your-swimlane-host>/tenant/api/account/<ACCOUNT_ID>/scim/v2` |
| Authentication Method | OAuth 2 Bearer Token                                                   |
| SCIM Version          | 2.0                                                                    |
| OAuth Access Token    | Swimlane Personal Access Token (PAT)                                   |

:::hint{type="info"}
Replace `<your-swimlane-host>` with your Swimlane Turbine hostname and `<ACCOUNT_ID>` with your Swimlane account UUID. Ping sends the PAT as a Bearer token; Swimlane maps it for SCIM authentication. Use a PAT for a user with Account Admin privileges. See [Provisioning with SCIM Integration](docId\:uCYk5MLy9Erosd2-nvjpU) for authentication, authorization, and REST endpoint details.
:::

To obtain the PAT:

- In Swimlane Turbine, go to **Edit Profile**.
- Click **Personal Access Token**.
- Copy the token value.

## Configure Preferences

Ensure the userName attribute is mapped to the email field in the attribute mapping before configuring preferences. The userName value must be in email format.

1. Under **Configure Preferences**, configure the following fields:

| **Field**                    | **Value**                                                         |
| ---------------------------- | ----------------------------------------------------------------- |
| User Filter Expression       | User email in format [user@example.com](mailto\:user@example.com) |
| User Identifier              | userName                                                          |
| Custom Attribute Schema URNs | urn\:ietf\:params\:scim\:api\:messages:2.0\:ListResponse          |
| Group Membership Handling    | Merge                                                             |

2. Under **User Actions**, enable the following options:
   - Enable user creation
   - Enable user updates
   - Enable user disable
   - Enable user deprovision
3. Under **Remove Action**, select **Delete**.
4. (Optional) Click **Test Connection** to validate the configuration.
5. Click **Save**.

![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/eIf0edAMUZkOc41gdyALH-20260217-102226.png)

The SCIM connection is now created.

For detailed configuration steps, refer to the [Ping Identity SCIM outbound provisioning documentation](https://docs.pingidentity.com/pingone/integrations/p1_create_scim_connection.html).

## Creating a Provisioning Rule

After you create the SCIM connection, create a provisioning rule to define how users and groups sync.

1. On the **Provisioning** page, click the **plus (+)** icon.
2. Click **New Rule**.
3. From the list of available connections, locate the SCIM connection you just created.
4. Click the **plus (+)** icon next to the connection.
5. Click **Continue**.
6. Enter the rule details:
   - Name (required)
7. Click **Next**.

## Configure Directory Settings

The Directory configuration includes **User Filter** and **Groups**.

### Configure User Filter

1. Under **User Filter**, click **Add Condition**.
2. Configure the filter as follows:
   - Attribute: **Population Name**
   - Operator: **Equals**
   - Value: **Default** (or a custom population you created)
3. Click **Save**.

:::hint{type="info"}
Population Name is a mandatory condition and determines which users are provisioned.
:::

![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/wD2Amhq7zoB9w066xyko2-20260217-102226.png)

### Configure Groups

1. Under **Groups**, click **Add Groups**.
2. Select the Ping Identity groups to include in provisioning.
3. Click **Next**.

![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/AY-jMjZnkMmaqSmWR0LhZ-20260217-102226.png)

# Field Mapping Requirements

Ping Identity requires the SCIM userName attribute as the primary identifier.

For Swimlane integration, map the Ping **Email** field to the SCIM **userName** attribute. Swimlane uses this value as the user's email and unique identifier.

Swimlane Turbine requires additional attributes, including display name, first name, and last name. If Ping sends empty or missing values, Swimlane automatically populates them to ensure successful provisioning.

Configure attribute mappings as shown in the following screenshot and table:

| **Ping SCIM Attribute** | **Swimlane Field** | **Notes**            |
| ----------------------- | ------------------ | -------------------- |
| userName                | Email              | Must be email format |
| name.givenName          | First Name         | Auto-populated       |
| name.familyName         | Last Name          | Auto-populated       |
| displayName             | Display Name       | Auto-populated       |

![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/ULzHc6EEm8iJLAtLh8vNU-20260217-102226.png)

Verify that required attributes are mapped correctly. The provisioning rule is now active.

## User Provisioning

Users are provisioned to Swimlane based on the **Population Name** defined in the provisioning rule in Ping Identity.

User provisioning in Ping Identity is controlled by **population-based rules**.

- Every user in Ping Identity is assigned to a **population**.
- A provisioning rule defines **which population(s)** are eligible for user provisioning.
- Only users that match the population criteria defined in the rule are synced to Swimlane Turbine.

### User Sync Behavior

- Users are provisioned to Swimlane **only if** they match the population rule.
- Users outside the defined population are not provisioned, even if they belong to a synced group.

Take the following steps to create a new user in Ping Identity:

1. In the left navigation menu, click **Directory**.
2. Click **Users**.
3. Click the **plus (+)** icon.
4. Click **Create New User**.
5. Enter the required user details:
   - Given Name
   - Family Name
   - Username
   - Email
   - Population (defaults to **Default**)
   - Authoritative Identity Provider: **PingOne**
6. Click **Save**.

![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/IYFHeTuaZV7jcENuBG1GY-20260217-102226.png)

The user is provisioned to Swimlane Turbine based on the configured rule and group mappings.

## Group Provisioning

Group provisioning in Ping Identity is controlled through **provisioning rules** and is evaluated independently from user population rules.

### Group Sync Behavior

- Groups selected in the provisioning rule are synced to Swimlane Turbine.
- If a group already exists in Swimlane:
  - The group is updated to reflect new users.
  - Existing users, roles, and permissions remain unchanged.
- Group names are treated as case-insensitive.

### Interaction Between Groups and User Population Rules

Group synchronization and user synchronization are evaluated **independently**.

### Behavior

- If a group is included in the provisioning rule but **users do not match the population criteria**:
  - The group is synced to Swimlane.
  - Users within the group are **not** provisioned.
- If a user matches the population rule but the group is not included:
  - The user is provisioned.
  - No group association is created in Swimlane.

## Group Deprovisioning

### Removing Groups from a Provisioning Rule

When you remove a group from a provisioning rule in Ping Identity:

- The group is removed from Swimlane Turbine.
- All user–group associations for that group are removed.
- Users continue to be provisioned **as long as they still match the user population rule**.
- Users are **not deleted or disabled** as a result of removing a group from the rule.

# Notes

- SCIM cannot provision **SuperAdmin** or **Account Admin** users. Attempts are rejected and logged as high-severity security events.
- SCIM does not support role creation. Required roles must already exist in Swimlane and be associated with groups.
- SCIM sync is **one-way**: **Ping Identity → Swimlane Turbine**. Changes in Swimlane are not pushed back.

## See Also

- [Provisioning with SCIM Integration](docId\:uCYk5MLy9Erosd2-nvjpU) — Prerequisites, PAT authentication, REST endpoints, and field mapping reference