Deprovision people with directory sync (SCIM)

Connect your identity provider's SCIM client so that deactivating a person there revokes their single sign-on link, single sign-on sessions and API tokens in this Proofline organization.

Directory sync removes access only. Creating or reactivating a person in the identity provider grants nothing: GitHub membership still decides who can enter. Until single sign-on is enforced, a deactivated member can still sign in with GitHub alone.

Before you start#

• You need to be an owner of the GitHub organization, in an ordinary console session. Proofline accepts an owner membership confirmed with GitHub in the last 24 hours. It re-checks an older one with GitHub first, and refuses if GitHub cannot confirm it.
• The organization needs an OIDC connection. An organization administrator creates it under Organization → Admin → Single sign-on with the identity provider's issuer URL, client ID and client secret, and chooses the subject claim. Then add the callback URL shown there to the identity provider. People are matched through their OIDC link.
• Your identity provider must send, as externalId, the claim the OIDC connection matches on. That is the OIDC subject (sub), unless the connection matches on the Entra object ID (oid). Proofline never matches on userName or email. Microsoft Entra ID cannot send the sub it issues to Proofline, so with a sub connection Entra deactivations find no one.

Connect the identity provider#

1. Open Organization → Admin → Single sign-on.
2. Under Directory sync (SCIM), copy the SCIM base URL.
3. Under Tokens, select Create token.
4. Copy the token when it is shown, then select I saved the token. Proofline shows it once.
5. In the identity provider's SCIM settings, enter the base URL and the token as a bearer token. Provision Users only; Groups are not supported.

If the console says it did not confirm a new token, a token may still exist. Check the token list and revoke any token you did not receive.

Rotate a token#

An organization can have two active tokens at once.

1. Select Create token and save the new token.
2. Switch the identity provider to the new token.
3. When the old token's last use stops changing, select Revoke on it and confirm.

Revocation stops requests with that token at once. With no active token, the identity provider cannot deprovision anyone.

Check a person#

Under Matching people, enter an externalId and select Look up. The result shows the directory record the identity provider sent and the OIDC links for that subject in this organization. A deactivation revokes only a live link.

Recent changes lists the latest 50 writes to Users that Proofline accepted, with what each one did. Refused requests and reads do not appear.