django-scim2

django-scim2 implements the provider side of the SCIM 2.0 specification for Django applications, exposing the standard /Users and /Groups endpoints that identity providers (Okta, Azure AD, OneLogin, etc.) use to automatically create, update, and deactivate accounts. It plugs into INSTALLED_APPS and a URL namespace, and ships adapters that map SCIM resources onto Django’s User/Group models.

The package is deliberately extensible: filtering, authentication checks, and resource adapters are all designed to be subclassed or overridden via settings, since real-world SCIM deployments almost always need to adapt the spec to an app’s existing user model and permission scheme. It currently requires PostgreSQL for the filter-query implementation.

What You Get

• SCIM 2.0 /Users and /Groups endpoints wired in via django_scim.urls
• Adapters mapping SCIM resource schemas onto Django’s User/Group models, overridable per app
• Configurable authentication predicate and middleware for gating SCIM requests
• SCIM filter-query support backed by PostgreSQL
• Settings-driven SCIM_SERVICE_PROVIDER configuration for auth schemes and provider metadata

Common Use Cases

• Letting an enterprise identity provider (Okta, Azure AD, OneLogin) automatically create/update/deactivate user accounts in a Django app
• Implementing automated group membership sync from an external directory
• Replacing bespoke SSO-triggered user-provisioning scripts with a standards-compliant SCIM endpoint
• Building an admin-facing provisioning API that follows an established spec rather than a bespoke schema

Under The Hood

Architecture The package lives under src/django_scim/ and is structured around views.py (the SCIM resource endpoints for Users/Groups/ServiceProviderConfig/etc.), adapters.py (translates between Django’s User/Group models and SCIM’s resource schema, designed to be subclassed for custom user models), filters.py (parses SCIM filter-query syntax into Postgres-backed queryset filters), middleware.py and settings.py (the pluggable authentication check and SCIM_SERVICE_PROVIDER configuration), and schemas/ (the SCIM 2.0 schema JSON definitions served at the discovery endpoints).

Tech Stack Python 3.9-3.13, Django, managed with Poetry. It currently requires PostgreSQL specifically for its filter-query implementation, and ships a demo/ Django project for exercising the integration end to end.

Code Quality tests/ cover the views, adapters, and filter-parsing logic against the bundled demo project, run via tox/pytest with coverage tracked (per the README’s coverage badge). The project has been maintained continuously since 2014 (originally forked from an earlier SCIM implementation, per the LICENSE attribution to Atlassian/Erik van Zijst) and currently sees active development, though release cadence is not frequent given SCIM’s relatively fixed spec surface.

API Design Configuration follows Django conventions closely — add to INSTALLED_APPS, include the URLs under a mandatory scim namespace, and set SCIM_SERVICE_PROVIDER — while extensibility points (GET_IS_AUTHENTICATED_PREDICATE, subclassable adapters, AUTH_CHECK_MIDDLEWARE) are exposed precisely where real deployments are known to diverge from a stock SCIM implementation, rather than forcing every integration through one rigid code path.