README

Google Workspace SCIM provisioning for Magento 2 admin users.

Status: experimental. Works only when Google shows an Auto-provisioning section for your app (catalog apps). No such section? Use admin-sso-google instead (JIT create/update at login).

Staff who join or leave your Google Workspace no longer need their Magento admin accounts created and removed by hand. Google creates, updates and deactivates Magento admin users automatically (users only, no groups). Install this plugin and the SCIM server comes with it.

Install

composer require dmlab/module-admin-scim-google
bin/magento module:enable DmLab_AdminScimGoogle
bin/magento setup:upgrade

The single require pulls dmlab/module-admin-scim — the whole provisioning chain installs at once.

Set up Google Workspace auto-provisioning

Precondition: in the Google Admin console, Apps → Web and mobile apps → your app must show an Auto-provisioning section with Endpoint URL and Access token fields. Google documents this for catalog apps. If the fields are absent, Google cannot push SCIM to Magento — use admin-sso-google (JIT create/update at login) instead.

In Magento, open Stores → Configuration → DMLab → Admin SCIM, enable Admin SCIM, and set a Bearer Token.
Read the endpoint from Stores → Configuration → DMLab → Admin SCIM → Google Workspace Setup. It is this store's SCIM base URL, e.g. https://your-host/admin-scim/v2.
In the app's Auto-provisioning section, enter:

Setting Value

Endpoint URL the URL from step 2

Access token the Bearer Token from step 1 (sent as Authorization: Bearer <token>)
Enable auto-provisioning and assign users (groups are not pushed).

Setting	Value
Endpoint URL	the URL from step 2
Access token	the Bearer Token from step 1 (sent as `Authorization: Bearer <token>`)

Supported provisioning actions

Status: per Google's documentation; not yet verified against a live tenant.

Create — a newly assigned user → admin_user created.
Update — profile changes → admin_user updated.
Suspend / delete — a suspended or deleted Google user → admin_user deactivated or removed.
Changes sync every few hours.
No group push. The Group → Role Map does not apply: provisioned admins get the Admin SCIM Default Role Id — set it. If it is empty they get no role, and a role assigned manually is reset on the next sync.
Provider selector (Admin SCIM → Provider): leave at "— None —". If exactly one other SCIM provider plugin is installed, its normalizer still runs under "— None —".

Requirements

Magento 2.4.7+ · PHP 8.2–8.5 · dmlab/module-admin-scim ^0.2.0 (installed automatically)

Pairs with admin-scim (the SCIM 2.0 server) and admin-sso-google (Google login for the same admins).

Architecture

A thin Google Workspace (Cloud Identity) provider plugin for the admin-scim SCIM 2.0 server. Google pushes SCIM 2.0 requests straight to the admin-scim endpoint, which does all provisioning. This plugin adds only the setup panel; it registers no request normalizer.

dmlab / module-admin-scim-google

Package info

Security

Statistics