--- title: Defining permissions for SCIM 2.0 requests description: Successfully executing a System for Cross-domain Identity Management (SCIM) request on a server depends on both the configured access control instruction (ACI) in the server and the scopes present in the OAuth bearer token used to authenticate the request. component: pingdirectory version: 11.1 page_id: pingdirectory:managing_scim:pd_proxy_define_perms_scim_2_requests canonical_url: https://docs.pingidentity.com/pingdirectory/11.1/managing_scim/pd_proxy_define_perms_scim_2_requests.html llms_txt: https://docs.pingidentity.com/pingdirectory/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: 2026-08-17T00:00:00Z page_aliases: ["managing_scim_11_and_20_servlet_extensions:pd_proxy_define_perms_scim_2_requests.adoc"] --- # Defining permissions for SCIM 2.0 requests Successfully executing a System for Cross-domain Identity Management (SCIM) *(tooltip: \
\

An application-level, HTTP-based protocol for provisioning and managing user identity information. SCIM supplies a common schema for representing users and groups and provides a REST API.\

\
)* request on a server depends on both the configured access control instruction (ACI) *(tooltip: \
\

An instruction or rule that can be used to grant or deny access to users to perform operations on a server.\

\
)* in the server and the scopes present in the OAuth *(tooltip: \
\

A standard framework that enables an application (OAuth client) to obtain access tokens from an OAuth authorization server for the purpose of retrieving protected resources on a resource server.\

\
)* bearer token used to authenticate the request. | | | | - | -------------------------------------------------------------------------------------------------------------- | | | You must define ACIs on the backend PingDirectory servers. Don't define ACIs on the PingDirectoryProxy server. | The server can authorize SCIM 2.0 requests in one of the following ways: * Internally, the server processes all SCIM 2.0 requests using the `cn=SCIM2 Servlet,cn=Root DNs,cn=config` service account. Allowing a requested operation depends on the relevant ACIs, which can include both the rights granted to that service account and any rights granted to scopes contained in the OAuth bearer token. The `oauthscope` bind rule is useful because it allows the administrator to use the supplied OAuth scopes in ACI logic. * If user mapping is enabled, the subject of the OAuth bearer token is mapped to an account in the server. In this case, whether a requested operation is allowed depends on the ACIs that apply to the mapped user for the requested operation. You can also use the `oauthscope` bind rule to grant rights based on scopes in the presented token. Because of implementation details, access to the `objectclass` operational LDAP attribute is necessary for SCIM requests to properly execute. Don't give the service account access to `objectclass` on a global level. Instead, add the ACI granting `objectclass` access to the LDAP subtree to expose to clients. Learn more in [Configuring permissions for SCIM 2.0 operations](pd_proxy_config_perms_scim_2_ops_proxy.html). | | | | - | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | ACIs that don't use the `oauthscope` bind rule can still apply to requested operations. For example, an ACI that grants unconditional read access to any authenticated LDAP user also grants unconditional read access to SCIM requests regardless of the provided OAuth scopes. This is because the requests are processed through the service account. |