PHPackages magedevgroup/module-admin-scim - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Admin Panels](/categories/admin) 4. / 5. magedevgroup/module-admin-scim ActiveMagento2-module[Admin Panels](/categories/admin) magedevgroup/module-admin-scim ============================== SCIM 2.0 provisioning server for Magento 2 admin users — RFC 7643/7644 endpoints so an IdP (Okta, Entra) can create, update and deactivate admin\_user accounts and map groups to ACL roles, without anyone logging in. 0.0.3(1mo ago)0013OSL-3.0PHPPHP ~8.3.0||~8.4.0||~8.5.0 Since Jul 9Pushed 1mo agoCompare [ Source](https://github.com/MageDevGroup-com/module-admin-scim)[ Packagist](https://packagist.org/packages/magedevgroup/module-admin-scim)[ RSS](/packages/magedevgroup-module-admin-scim/feed)WikiDiscussions master Synced 1w ago READMEChangelogDependencies (4)Versions (4)Used By (3) MageDevGroup\_AdminScim ======================= [](#magedevgroup_adminscim) > SCIM 2.0 provisioning server for Magento 2 admin users. [![License](https://camo.githubusercontent.com/83286826e7422502369a480c1cbde06eae433c866ac3e9054835db7296a11c9c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4f534c2d2d332e302d677265656e)](https://camo.githubusercontent.com/83286826e7422502369a480c1cbde06eae433c866ac3e9054835db7296a11c9c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4f534c2d2d332e302d677265656e) [![Magento](https://camo.githubusercontent.com/74f990c6f6a950cfc7707cb6d3cfdc731382be6260dfab995f14da50230e9117/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4d6167656e746f2d322e342d6f72616e6765)](https://camo.githubusercontent.com/74f990c6f6a950cfc7707cb6d3cfdc731382be6260dfab995f14da50230e9117/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4d6167656e746f2d322e342d6f72616e6765) [![PHP](https://camo.githubusercontent.com/49c1441e4607accdb38fb505c51c881b13dabea9a2726b234d7ad218befce9fb/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d382e332d2d382e352d626c7565)](https://camo.githubusercontent.com/49c1441e4607accdb38fb505c51c881b13dabea9a2726b234d7ad218befce9fb/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d382e332d2d382e352d626c7565) [![Version](https://camo.githubusercontent.com/6a24c9197bfc07f07d3f136dc182a76b14d3cd2f8d473fbc3729540c9a4c5410/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f76657273696f6e2d302e302e312d6c6967687467726579)](https://camo.githubusercontent.com/6a24c9197bfc07f07d3f136dc182a76b14d3cd2f8d473fbc3729540c9a4c5410/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f76657273696f6e2d302e302e312d6c6967687467726579) `MageDevGroup_AdminScim` turns Magento into a SCIM 2.0 (RFC 7643/7644) provisioning server, so an identity provider such as Okta or Entra can create, update, and deactivate Magento admin users automatically — without anyone logging in. It complements SSO login: where JIT provisioning acts at login time, SCIM adds background provisioning and, crucially, **deprovisioning**. Scope is admin users only (Users plus Groups → ACL roles). B2C/B2B customer provisioning is out of scope. Endpoints --------- [](#endpoints) The IdP is the SCIM **client**; Magento is the **server**. All endpoints live under the `admin-scim/v2` route area, derived from the store base URL: ``` https:///admin-scim/v2 ``` MethodPathPurposeGET`/ServiceProviderConfig`Advertised capabilitiesGET`/ResourceTypes`User + Group resource typesGET`/Schemas`User + Group schema definitionsPOST`/Users`Create an admin userGET`/Users/{id}` · `/Users?filter=…`Read one · list with filter + paginationPUT`/Users/{id}`Replace the whole resourcePATCH`/Users/{id}`Add/replace/remove attrs; `active=false` deprovisionsPOST`/Groups`Create a groupGET`/Groups/{id}` · `/Groups?filter=…`Read one · list with filter + paginationPATCH`/Groups/{id}`Attribute + member add/replace/removeUnsupported verbs answer `501 Not Implemented`. Errors use the RFC 7644 error schema (`urn:ietf:params:scim:api:messages:2.0:Error`) with the correct status. Setup ----- [](#setup) 1. Install the module and run `bin/magento setup:upgrade`. 2. In the admin panel go to **Stores → Configuration → MageDevGroup → Admin SCIM**. 3. **Enable Admin SCIM** = *Yes*. The endpoint is disabled by default. 4. **Bearer Token** — set a long random value. It is stored encrypted and is the credential the IdP presents. Point your IdP's SCIM app at the base URL above and configure it to send `Authorization: Bearer `. 5. **Group → Role Map** — one `displayName=role_id` per line, mapping a SCIM group to a Magento admin role id (`#` lines ignored). A provisioned member gets the first matching role (admins hold a single role). 6. **Default Role Id** — role assigned when a member's groups match no rule. Leave empty to deny (no role) unmapped members. Supported features ------------------ [](#supported-features) Advertised honestly in `ServiceProviderConfig`: FeatureSupportedPATCH✅Filter (`userName eq`, `externalId eq`, `displayName eq`)✅ (max 200 results)Pagination (`startIndex`, `count`)✅Bulk❌Sort❌ETag❌Change password❌Auth schemeOAuth Bearer Token (RFC 6750)Provider quirks --------------- [](#provider-quirks) The core is strict-RFC. IdP SCIM clients deviate — Entra especially (flat complex attrs in PATCH, `value` in group-member remove, ADD/REPLACE inconsistency). Those quirks are **not** in the core; a per-IdP plugin (`admin-scim-okta`, `admin-scim-azure`) absorbs them via a normalization seam: - The plugin implements `MageDevGroup\AdminScim\Api\RequestNormalizerInterface` — a pure, total `normalize(resourceType, operation, payload)` that rewrites the decoded body toward RFC shape and returns unchanged payloads it does not own. - It `di`-merges the normalizer into `RequestNormalizerChain` (see `etc/di.xml`), which runs before every create/replace/patch. With no plugin installed the chain is empty and bodies pass through untouched. Running against a real IdP therefore needs the matching provider plugin. Security notes -------------- [](#security-notes) - The bearer token is a full admin-provisioning credential. It is stored encrypted (Magento `Encrypted` backend model) and compared in constant time (`hash_equals`). - Rotate the token by setting a new value; the old value stops working immediately. - The endpoint is **disabled by default** and every request must authenticate — there is no anonymous read path. - Auth failures return generic `401` messages that never reveal whether a token is configured. Unexpected errors are logged server-side and returned as a `500` with no internals leaked. - Serve over TLS only — the token travels in the `Authorization` header. - `active=false` deprovisions an admin account, so treat the token with the same care as an admin password. Requirements ------------ [](#requirements) - Magento **2.4.x** - PHP **8.3 – 8.5** License ------- [](#license) [OSL-3.0](LICENSE) © MageDevGroup. Commercial licensing and support: . ### Health Score 38 — LowBetter than 83% of packages Maintenance92 Actively maintained with recent releases Popularity1 Limited adoption so far Community12 Small or concentrated contributor base Maturity43 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~5 days Total 3 Last Release 38d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/6d5acdc656153eb172422ac03f4a59806116de32da5f861c4b00e4ac7bb9c544?d=identicon)[magedevgroup](/maintainers/magedevgroup) --- Top Contributors [![mageown](https://avatars.githubusercontent.com/u/2058487?v=4)](https://github.com/mageown "mageown (3 commits)") ### Code Quality TestsPHPUnit ### Embed Badge ![Health badge](/badges/magedevgroup-module-admin-scim/health.svg) ``` [![Health](https://phpackages.com/badges/magedevgroup-module-admin-scim/health.svg)](https://phpackages.com/packages/magedevgroup-module-admin-scim) ``` ### Alternatives [fastly/magento2 Fastly CDN Module for Magento 2.4.x 1564.5M1](/packages/fastly-magento2)[hyva-themes/module-magento2-admin This module aims to make creating grids and forms in the Magento 2 adminhtml area for developers joyful and fast 178395.6k15](/packages/hyva-themes-module-magento2-admin)[magepal/magento2-guest-to-customer Quickly and easily convert existing guest checkout customers to registered customers. 69181.9k](/packages/magepal-magento2-guest-to-customer)[markshust/magento2-module-ordergrid The Order Grid module adds more details to the order grid in the admin. 9292.3k](/packages/markshust-magento2-module-ordergrid)[myparcelnl/magento A Magento 2 module that creates MyParcel labels 1861.2k](/packages/myparcelnl-magento)[loki/magento2-admin-components Admin Panel grids and forms created via Loki Components 178.3k9](/packages/loki-magento2-admin-components) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)