How to link OIDC users with SCIM

Question

What is the recommended way to map externalId in SCIM to OIDC login claims?

Is it the solution described here? https://stackoverflow.com/a/75008278

The problem is that the sub claim for OIDC is a per-application opaque identifier, which is not accessible to be used as externalId in a SCIM user attribute mapping. The suggested solution is to use the "oid" claim if present instead, and use "objectId" as the source attribute for "externalId".

Answer 1

Thanks for posting your question in the Microsoft Q&A forum.

To link OIDC users with SCIM, the best practice is to use a persistent, unique identifier that’s consistent in both OIDC tokens and SCIM provisioning data. For Azure AD, this is the ObjectId of the user, which appears in the OIDC oid claim.

Recommended approach:

• Map the SCIM externalId to the Azure AD ObjectId.
• In your OIDC tokens, identify users by oid, not sub.
• For other identity providers, pick a tenant-wide, persistent identifier that works for both SCIM and OIDC

The sub claim is not reliable because it’s unique per application and should not be used for SCIM mappings

---

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful