| Notify on Successful Recovery | -When checked, the user will be notified via email after a successful password recovery. | -
| Recovery Link Expiry Time | -Time in minutes until the password recovery link expires. | -
| Parameter | -Description | -
|---|---|
Number of Consecutive Failed Login Attempts |
- The count of consecutive incorrect login attempts before locking the account. | -
Account Lock Duration |
- The time in minutes an account stays locked after reaching the failed attempt limit. | -
Account Lock Duration Increment Factor |
- The rate at which the lock duration increases after successive lockouts. | -
| Parameter | -Description | -
|---|---|
Password Expiration |
- Defines the number of days after which a password must be changed. | -
Password History Count |
- Specifies the number of unique new passwords a user must use before an old password can be reused. | -
Password Input Validation |
- Sets requirements for password complexity, including length and character types. | -
| Parameter | -Description | -
|---|---|
Idle Session Timeout |
- Time in minutes before an inactive user session is automatically ended. | -
Remember Me Period |
- Duration in minutes that the system will remember a user's session. | -
| Parameter | -Description | -
|---|---|
Enable user email verification |
- Triggers a verification notification during user creation if enabled. | -
Enable account lock on creation |
- Locks the user account during creation to prevent unauthorized access. | -
Send account activation email |
- Sends an email to users for account activation if enabled. | -
Email verification code expiry time |
- The duration in minutes for which the email verification code remains valid. | -
Password Setup Invitation Code Expiration Time |
- Defines the validity period in minutes for the password setup code sent to users. For infinite validity period, set -1. | -
| Parameter | -Description | -
|---|---|
Account Verification |
- When enabled, requires users to verify their accounts as part of registration. | -
Account verification link expiry time |
- Time in minutes until the account verification link expires. | -
Activate account immediately |
- If selected, the new account is activated immediately after registration without waiting for account confirmation. | -
Enable auto login |
- If selected, the user will be automatically logged in after registration. | -
Send sign up confirmation email |
- A confirmation email is sent upon successful self-registration if this option is enabled. | -
| Parameter | +Required/Optional | +Description | +
|---|---|---|
failOnErrors |
+ Optional | +The number of errors that will be accepted by WSO2 IS before returning the response. + Possible values: An integer. + | +
schemas |
+ Required | +This is the schema that is required for sending bulk requests:
+ urn:ietf:params:scim:api:messages:2.0:BulkRequest.
+ |
+
operations |
+ Required | +Array of operations. To add multiple new users, add an array of POST operations. You can include any number of operations in one bulk request. + The parameters that can be used for the operation are explained below. + | +
| Parameter | +Required/Optional | +Description | +
|---|---|---|
method |
+ Required | +
+ The method that should be used in the operation.
+ Possible value:POST.
+ |
+
path |
+ Required | +
+ Add this path to specify that a new user is being added.
+ Possible value:/Users.
+ |
+
bulkid |
+ Required | ++ A unique identifier for the bulk operation. The bulkid is required for POST operations. + Possible value: An integer value. + | +
data |
+ Required | ++ Specify the details of the new user that should be added. The parameters that can be used for this “data” object are explained below. + | +
| Parameter | +Required/Optional | +Description | +
|---|---|---|
schemas |
+ Required | +
+ Specify the list of SCIM2 user schemas to which the new user should be linked.
+ Possible values:
+
|
+
{attribute_name} |
+ Required | ++ The name of the attribute that will be updated. + Possible values: User attributes as per the SCIM protocol. + | +
| Parameter | +Required/Optional | +Description | +
|---|---|---|
failOnErrors |
+ Optional | +The number of errors that will be accepted by WSO2 IS before returning the response. + Possible values: An integer. + | +
schemas |
+ Required | +This is the schema that is required for sending bulk requests:
+ urn:ietf:params:scim:api:messages:2.0:BulkRequest.
+ |
+
operations |
+ Required | +Array of operations. To update multiple users, add an array of PATCH operations. You can include any number of operations in one bulk request. + The parameters that can be used for the operation are explained below. + | +
| Parameter | +Required/Optional | +Description | +
|---|---|---|
method |
+ Required | +
+ The method that should be used in the operation.
+ Possible Value:PATCH.
+ |
+
path |
+ Required if op is remove.
+ Optional if op is add or replace.
+ |
+
+ Add this path to specify the new user that is being updated.
+ Possible Value:/Users/{user_id}.
+ |
+
bulkid |
+ Optional | ++ A unique identifier for the bulk operation. The bulkid is required for POST operations. + Possible Value: An integer value. + | +
data |
+ Required | ++ Specify the details of the new user that should be updated. The parameters that can be used for this “data” object are explained below. + | +
| Parameter | +Required/Optional | +Description | +
|---|---|---|
op |
+ Required | +
+ The operation that should be applied to the existing user’s data.
+ Possible Values:
+
|
+
path |
+ Required if op is remove.
+ Optional if op is add or replace
+ |
+ + The path to the resource (user attribute) that should be updated. + For example, if the name of the user is to be updated, the path should be “name”. + | +
value |
+ Required if op is remove.
+ Optional if op is add or replace.
+ |
+
+ The value of the parameter specified by the path.
+ For example, if the path is “name”, the value should be the actual name. + See SCIM2 Patch Operations for details on how to define values for the patch operations. + |
+
| Parameter | +Required/Optional | +Description | +
|---|---|---|
failOnErrors |
+ Optional | +The number of errors that will be accepted by WSO2 IS before returning the response. + Possible values: An integer. + | +
schemas |
+ Required | +This is the schema that is required for sending bulk requests:
+ urn:ietf:params:scim:api:messages:2.0:BulkRequest.
+ |
+
operations |
+ Required | +Array of operations. To replace multiple users, add an array of PUT operations. You can include any number of operations in one bulk request. + The parameters that can be used for the operation are explained below. + | +
| Parameter | +Required/Optional | +Description | +
|---|---|---|
method |
+ Required | +
+ The method that should be used in the operation.
+ Possible value:PUT.
+ |
+
path |
+ Required | +
+ Add this path to specify the existing user that should be replaced by the new user information that is added.
+ Possible value:/Users/{user_id}.
+ |
+
bulkid |
+ Optional | ++ A unique identifier for the bulk operation. The bulkid is required for POST operations. + Possible value: An integer value. + | +
data |
+ Required | ++ Specify the new user details that should be used to replace the existing user specified in the path. The parameters that can be used for this “data" object are explained below. + | +
| Parameter | +Required/Optional | +Description | +
|---|---|---|
schemas |
+ Required | +
+ Specify the list of SCIM2 user schemas where the new user details should replace the existing user specified by the path.
+ Possible values:
+
|
+
{attribute_name} |
+ Required | ++ The name of the attribute that will be replaced. + Possible values: User attributes as per the SCIM protocol. + | +
| Parameter | +Required/Optional | +Description | +
|---|---|---|
failOnErrors |
+ Optional | +The number of errors that will be accepted by WSO2 IS before returning the response. + Possible values: An integer. + | +
schemas |
+ Required | +This is the schema that is required for sending bulk requests:
+ urn:ietf:params:scim:api:messages:2.0:BulkRequest.
+ |
+
operations |
+ Required | +Array of operations. To delete multiple users, add an array of DELETE operations. You can include any number of operations in one bulk request. + The parameters that can be used for the operation are explained below. + | +
| Parameter | +Required/Optional | +Description | +
|---|---|---|
method |
+ Required | +
+ The method that should be used in the operation.
+ Possible value:DELETE.
+ |
+
path |
+ Required | +
+ Add this path to specify the existing user that should be deleted.
+ Possible value:/Users/{user_id}.
+ |
+
| Parameter | +Required/Optional | +Description | +
|---|---|---|
failOnErrors |
+ Optional | +The number of errors that will be accepted by WSO2 IS before returning the response. + Possible values: An integer. + | +
schemas |
+ Required | +This is the schema that is required for sending bulk requests:
+ urn:ietf:params:scim:api:messages:2.0:BulkRequest.
+ |
+
operations |
+ Required | +Array of operations. To add multiple new user groups, add an array of POST operations. You can include any number of operations in one bulk request. + The parameters that can be used for the operation are explained below. + | +
| Parameter | +Required/Optional | +Description | +
|---|---|---|
method |
+ Required | +
+ The method that should be used in the operation.
+ Possible Value:POST.
+ |
+
path |
+ Required | +
+ Add this path to specify that a new user group that should be added.
+ Possible Value:/Group.
+ |
+
bulkid |
+ Optional | ++ A unique identifier for the bulk operation. The bulkid is required for POST operations. + Possible Value: An integer value. + | +
data |
+ Required | ++ Specify the details of the new user group that should be added. The parameters that can be used for this “data” object are explained below. + | +
| Parameter | +Required/Optional | +Description | +
|---|---|---|
displayName |
+ Required | ++ The display name of the user group. + | +
members |
+ Optional | ++ An array of member users. + | +
display |
+ Required if members is used. |
+ + The display name of a user assigned to the group. + Possible values: The username. + | +
value |
+ Required if members is used. |
+ + The ID of the user. + Possible values: The user ID. + | +
| Parameter | +Required/Optional | +Description | +
|---|---|---|
failOnErrors |
+ Optional | +The number of errors that will be accepted by WSO2 IS before returning the response. + Possible values: An integer. + | +
schemas |
+ Required | +This is the schema that is required for sending bulk requests:
+ urn:ietf:params:scim:api:messages:2.0:BulkRequest.
+ |
+
operations |
+ Required | +Array of operations. To update multiple user groups, add an array of PATCH operations. You can include any number of operations in one bulk request. + The parameters that can be used for the operation are explained below. + | +
| Parameter | +Required/Optional | +Description | +
|---|---|---|
method |
+ Required | +
+ The method that should be used in the operation.
+ Possible Value:PATCH.
+ |
+
path |
+ Required | +
+ Add this path to specify the user group that should be updated.
+ Possible Value:/Group/{group_id}.
+ |
+
bulkid |
+ Optional | ++ A unique identifier for the bulk operation. The bulkid is required for POST operations. + Possible Value: An integer value. + | +
data |
+ Required | ++ Specify the details that should be updated for the user group specified in the path. The parameters that can be used for this “data” object are explained below. + | +
| Parameter | +Required/Optional | +Description | +
|---|---|---|
op |
+ Required | +
+ The operation that should be applied to the existing user group.
+ Possible values:
+
|
+
path |
+ Required if op is remove.
+ Optional if op is add or replace.
+ |
+
+ Specify “members” as the path.
+ Possible values: members
+ |
+
value |
+ Required if op is add or replace. |
+ + An array of users that belong to the group. + | +
display |
+ Required if path is set to |
+ + The display name of the user, who is a member. + Possible values: The username. + | +
value |
+ Required if path is set to |
+ + The user ID of the member user. + Possible values: The user ID. + | +
| Parameter | +Required/Optional | +Description | +
|---|---|---|
failOnErrors |
+ Optional | +The number of errors that will be accepted by WSO2 IS before returning the response. + Possible values: An integer. + | +
schemas |
+ Required | +This is the schema that is required for sending bulk requests:
+ urn:ietf:params:scim:api:messages:2.0:BulkRequest.
+ |
+
operations |
+ Required | +Array of operations. To replace multiple user groups, add an array of PUT operations. You can include any number of operations in one bulk request. + The parameters that can be used for the operation are explained below. + | +
| Parameter | +Required/Optional | +Description | +
|---|---|---|
method |
+ Required | +
+ The method that should be used in the operation.
+ Possible value:PUT.
+ |
+
path |
+ Required | +
+ Add this path to specify the existing user group that should be replaced by the new information that is added.
+ Possible value:/Groups/{group_id}.
+ |
+
bulkid |
+ Optional | ++ A unique identifier for the bulk operation. The bulkid is required for POST operations. + Possible value: An integer value. + | +
data |
+ Required | ++ Specify the new group details that should be used to replace the existing user group specified in the path. The parameters that can be used for this “data" object are explained below. + | +
| Parameter | +Required/Optional | +Description | +
|---|---|---|
displayName |
+ Required | ++ The display name of the user group. + | +
members |
+ Required | ++ Array of member users. + | +
display |
+ Required | ++ The display name of a user assigned to the group. + Possible values: The username. + | +
value |
+ Required | ++ The ID of the user. + Possible values: The user ID. + | +
| Parameter | +Required/Optional | +Description | +
|---|---|---|
failOnErrors |
+ Optional | +The number of errors that will be accepted by WSO2 IS before returning the response. + Possible values: An integer. + | +
schemas |
+ Required | +This is the schema that is required for sending bulk requests:
+ urn:ietf:params:scim:api:messages:2.0:BulkRequest.
+ |
+
operations |
+ Required | +Array of operations. To delete multiple user groups, add an array of PUT operations. You can include any number of operations in one bulk request. + The parameters that can be used for the operation are explained below. + | +
| Parameter | +Required/Optional | +Description | +
|---|---|---|
method |
+ Required | +
+ The method that should be used in the operation.
+ Possible value:DELETE.
+ |
+
path |
+ Required | +
+ Add this path to specify the existing user group that should be deleted.
+ Possible value:/Groups/{group_id}.
+ |
+
| Singular attribute | +A resource attribute that contains a single value. For example, the displayName attribute can only have one unique value.
+ |
+
|---|---|
| Multi-valued attribute | +A resource attribute that contains multiple values. For example, the emails attribute may have multiple email addresses as values.
+ |
+
| Complex attribute | +A singular or multi-valued attribute, which has a value that is a composition of one or more simple attributes. For example, the addresses attribute has the sub-attributes streetAddress, locality, postalCode, and country.
+ |
+
| Simple attribute | +A singular or multi-valued attribute, which has a value that is a primitive. A simple attribute must not contain sub-attributes. + | +
| add | +Add a new value for the attribute. | +
|---|---|
| replace | +Replace the existing value of an attribute. | +
| remove | +Delete the existing value of an attribute. | +
| Parameter | +Required/Optional | +Description | +
|---|---|---|
schemas |
+ Required | +Specify the following schema when sending patch requests:
+ urn:ietf:params:scim:api:messages:2.0:PatchOp.
+ |
+
operations |
+ Required | +Specify the array of add, remove, replace operations that should be used to update the information. You can include any number of operations in one request. |
+
| Parameter | +Required/Optional | +Description | +
|---|---|---|
op |
+ Required | +The method that should be used in the operation.
+ Possible values:
+
|
+
path |
+ Required if op is remove.
+ Optional if op is add or replace.
+ |
+ Add the path to specify the attribute/sub-attribute that should be updated.
+ Since path is an optional parameter for add and replace operations, there are two ways to define the operation in a payload: with or without the path parameter.
+ |
+
value |
+ Required if op is add or replace. |
+ The value that should be updated. | +
| Parameter | -Description | -
|---|---|
Enable Password Reset via Recovery Email |
- When enabled, allows users to reset their password through a link sent to their email. | -
Email Link |
- - |
| Notify on successful recovery | -Specifies whether to notify the user via an email when password recovery is successful. | -
| Recovery link expiry time | -Specifies password recovery link expiry time in minutes. If you enter 60 min, the password recovery email notification will expire after 60 min. | -
SMS OTP |
- - |
| Password recovery OTP expiry time | -Specifies the duration (in minutes) after which the OTP code sent through SMS will expire. | -
| Password recovery OTP expiry time | -Specifies the duration (in minutes) after which the OTP code sent through SMS will expire. | -
| Parameter | -Description | -
|---|---|
Number of Consecutive Failed Login Attempts |
- The count of consecutive incorrect login attempts before locking the account. | -
Account Lock Duration |
- The time in minutes an account stays locked after reaching the failed attempt limit. | -
Account Lock Duration Increment Factor |
- The rate at which the lock duration increases after successive lockouts. | -
| Parameter | -Description | -
|---|---|
Idle Session Timeout |
- Time in minutes before an inactive user session is automatically ended. | -
Remember Me Period |
- Duration in minutes that the system will remember a user's session. | -
| Parameter | -Description | -
|---|---|
Enable user email verification |
- Triggers a verification notification during user creation if enabled. | -
Enable account lock on creation |
- Locks the user account during creation to prevent unauthorized access. | -
Send account activation email |
- Sends an email to users for account activation if enabled. | -
Email verification code expiry time |
- The duration in minutes for which the email verification code remains valid. | -
Password Setup Invitation Code Expiration Time |
- Defines the validity period in minutes for the password setup code sent to users. For infinite validity period, set -1. | -
| Parameter | -Description | -
|---|---|
Account Verification |
- When enabled, requires users to verify their accounts as part of registration. | -
Account verification link expiry time |
- Time in minutes until the account verification link expires. | -
Activate account immediately |
- If selected, the new account is activated immediately after registration without waiting for account confirmation. | -
Enable auto login |
- If selected, the user will be automatically logged in after registration. | -
Send sign up confirmation email |
- A confirmation email is sent upon successful self-registration if this option is enabled. | -
| Notify on Successful Recovery | +When checked, the user will be notified via email after a successful password recovery. | +
| Recovery Link Expiry Time | +Time in minutes until the password recovery link expires. | +
Email Link |
+ + |
| Notify on successful recovery | +Specifies whether to notify the user via an email when password recovery is successful. | +
| Recovery link expiry time | +Specifies the duration (in minutes) after which the email link will expire. | +
SMS OTP |
+ + |
| Password recovery OTP expiry time | +Specifies the duration (in minutes) after which the OTP code sent through SMS will expire. | +
| Include upper case letters | +If nothing else is selected, the code will have only upper case letters or else a combination of upper case letters and any other selected character types. | +
| Include lower case letters | +If nothing else is selected, the code will have only lower case letters or else a combination of lower case letters and any other selected character types. | +
| Include numeric characters | +If nothing else is selected, the code will have only digits or else a combination of digits and any other selected character types. | +
| Password recovery OTP code length | +Specify the length of the code | +
| Max failed attempts count | +Specifies the maximum number of incorrect entries allowed for a password recovery method. | +
| Max resend attempts count | +Specifies the maximum number of times a user can request to resend the OTP or recovery link. | +
| Number of consecutive failed login attempts | +Specifies the number of consecutive failed login attempts allowed before the account is locked. + If you enter 5 as the value, the user's account is locked when five login attempts fail consecutively. |
+
| Account lock duration | +Specifies the initial duration that the account will be locked for. The account is automatically unlocked after this time period. + If you enter 5 minutes as the value, the user's account is locked for 5 minutes starting from the last login attempt. The user can log in again after 5 minutes. |
+
| Account lock duration increment factor | +Specifies the factor by which the account lock duration should be incremented on further failed login attempts after the account is locked. | +
| Notify user when lock time is increased | +Send an email notification to the user when the lock time increases due to continuous failed login attempts. | +
| Parameter | +Description | +
|---|---|
| Attribute | +User attribute against which you are enforcing password expiry. Select either Groups or Roles. |
+
| Values | +Select the specific group/role. You may also select multiple values thus making the rule act as an AND operator, and is enforced only on users belonging to all selected groups/roles. | +
| Operator | +
+
|
+
| Expiration (days) | +Passwords of users meeting the criteria expire after this number of days. | +
| Parameter | +Description | +
|---|---|
| Password History Count | +[Optional] The number of unique passwords that must be set before reusing an old password. Example: If set to 3, the user cannot reuse the last three passwords they have set. |
+
| Parameter | +Description | +
|---|---|
| Number of characters | +You can add the minimum and maximum length of the password users should use. | +
| Mandatory characters | +By default, a user password should contain at least one of the following characters.
+
|
+
| Number of unique characters | +[Optional] This field identifies the number of unique (non-repeated) characters the password should contain. |
+
| Number of repeated characters | +[Optional]This field identifies the number of characters that can be repeated consecutively in a user password. Example: If you assign 1 as the number of repeated characters, the password cannot contain any repeated characters consecutively. The password aa1@Znlq is incorrect as it has the character a appearing consecutively. |
+
| Parameter | +Description | +
|---|---|
Idle Session Timeout |
+ Time in minutes before an inactive user session is automatically ended. | +
Remember Me Period |
+ Duration in minutes that the system will remember a user's session. | +
| Parameter | +Description | +
|---|---|
Enable user email verification |
+ Triggers a verification notification during user creation if enabled. | +
Enable account lock on creation |
+ Locks the user account during creation to prevent unauthorized access. | +
Send account activation email |
+ Sends an email to users for account activation if enabled. | +
Email verification code expiry time |
+ The duration in minutes for which the email verification code remains valid. | +
Password Setup Invitation Code Expiration Time |
+ Defines the validity period in minutes for the password setup code sent to users. For infinite validity period, set -1. | +
| Account verification | +
+ If enabled, an email will be sent to the user's specified email address requesting account confirmation. + If this option is enabled along with the Activate account immediately option, users will be signed into the application without waiting for verification. However, you may leverage the account verification status to control the user experience and the level of access granted for the user. + [Learn how to get verification status](#get-the-verification-status-of-user-accounts). + |
+
| Account verification link expiry time | +Specifies the duration (in minutes) after which the confirmation link expires. | +
| Activate account immediately | +
+ Activates the account without waiting for account verification. + However, you may leverage the account verification status to control the user experience and the level of access granted for the user. + [Learn how to get verification status](#get-the-verification-status-of-user-accounts). + |
+
| Display message if username unavailable | ++ Display a message to the user from the registration page if the selected username is already taken. Enable this with caution, as it may lead to username enumeration. + | +
| Enable auto login | +
+ When a user self-registers:
+
|
+