User provisioning with AWS Identity Center enables you to provision and deprovision users in AWS Identity Center from Zoho Directory Admin Panel, enabling you to use Zoho Directory as a single source of truth.
Prerequisites
- An Application admin role in AWS Identity Center account.
- AWS account root user permissions.
- SSO setup for AWS Identity Center
In Amazon AWS Identity Center: Enable SCIM and generate token
1. Sign in to your AWS Identity Center account.
2. Click on the IAM Identity Center console, then click Settings in the left navigation pane.
3. Locate the Automatic Provisioning information box, then click Enable.
4. Copy the SCIM endpoint from Inbound automatic provisioning dialogue box.
5. Click Show token, then copy the Access token. They will be used in Zoho Directory to set up provisioning.
Note: The Access token will be shown only once and should not be written anywhere else as anyone with access to it can add/edit/remove users in AWS Identity Center.
In Zoho Directory: Set up provisioning
2. Ensure that you have set up SSO for AWS Identity Center.
3. Go to Application, then click on AWS Identity Center.
4. Go to Provisioning, then click Configure.
5. Enter the SCIM endpoint and Access Token you copied from Amazon AWS Identity Center in the Sync endpoint and SCIM Token fields.
6. Click Authorize.
7. Select the fields that have to be synced with AWS Identity Center, and map a relevant Zoho Directory field with them. If you'd like to have a constant value to be set in AWS Identity Center for any fields, click Edit next to the field, enter the value in the Hardcoded value field, then click OK.
Note: By default, all AWS Identity Center fields will be mapped to a relevant Zoho Directory field. To change this mapping, you should have the Standard or Professional plans in Zoho Directory.
8. Click Save and Next.
9. Choose which of the changes made in Zoho Directory have to be synced with AWS Identity Center:
- Create users: Assigning a user to AWS Identity Center in Zoho Directory automatically creates a new user account in AWS Identity Center.
- Update User profile: If a user account already exists in AWS Identity Center for a user, any changes made to the mapped fields in user's profile in ZD will be synced with AWS Identity Center.
- Delete users: Deleting a user in Zoho Directory will delete the user's account in AWS Identity Center.
- Activate and deactivate users: If a user account already exists in AWS Identity Center for a user, assigning them to AWS Identity Center in ZD or unassigning them will activate or deactivate the user in AWS Identity Center. Additionally, activating or deactivating a user in ZD will also activate and deactivate them in AWS Identity Center.
10. Click Save.
11. If you'd like to have the users currently in AWS Identity Center to be imported to ZD, click Import. It is advisable to import users to ZD during initial setup or when activating the app after a while. A list of users that can be imported will be displayed.
12. The following filters can be used to select users to import:
- All Users: All the users that can be imported from AWS Identity Center to ZD.
- New Users: Users that are present in AWS Identity Center, but not in ZD. These users will be created in ZD, and AWS Identity Center will be assigned to them.
- Update Users: Users already present in ZD. Any changes in the user profile for these users will not be synced, and the field values from AWS Identity Center will be used to overwrite the values in ZD.
- Users to Activate: Users in ZD, but not assigned to AWS Identity Center in ZD. These users will be assigned to AWS Identity Center.
- Users to Deactivate: Users that are either not present or present as inactive users in AWS Identity Center. These users will be unassigned from AWS Identity Center in ZD.
13. Click Confirm Assignment.
14. Click Done.