Question: Replacing LDAP User/Group Sync with Entra ID

Forum - Software
1

Hi,

we are currently using LDAP to import/sync selected user groups into eramba and SAML with Microsoft Entra ID for SSO.

We are planning to retire our local Active Directory and move completely to Microsoft Entra ID. As a result, our current LDAP-based user synchronisation will no longer be available.

I saw that SCIM Provisioning was added with Release 3.31.0, allowing the identity provider to create, update, deactivate and delete eramba users/groups automatically. I also found the documentation here: Feature - SCIM Connector.

Is SCIM now the recommended and only supported replacement for LDAP-based user/group synchronisation in an Entra ID-only environment?

We would like to continue using SAML for SSO and replace only the LDAP-based provisioning/synchronisation part.

Thanks!

2

hello,

yes, correct. for user and group provisioning eramba supports two options, ldap sync and scim. in an entra id only environment scim is the recommended replacement since there is no ldap to sync from anymore.

your plan is exactly the supported setup. saml keeps handling sso and scim takes over the provisioning part (create, update, deactivate users and groups).