Identity Sync

As an application developer, your core need is: when an enterprise employee's organization or user information changes, synchronize this data to your application system in a timely and accurate manner.

BambooCloud IDaaS provides two identity synchronization mechanisms covering data synchronization needs in different scenarios. This document helps you quickly understand "what to sync", "when to sync", and "how to sync", and choose the most suitable access method for your application.

Quick Selection

Your Situation	Recommended Method
Self-developed business system that needs real-time awareness of employee changes	Event Callback
Application already supports SCIM 2.0 standard	SCIM Protocol
Application is already in the IDaaS pre-integrated application list	Use Application Connector, no development needed

What to Sync

Identity synchronization covers three core data types:

Data Type	Description	Typical Scenarios
Organization Information	Organizational structures such as departments, teams, and branches	Employee transfer, department merger, new department creation
User Information	Name, employee ID, phone number, email, job level, etc.	New employee onboarding, employee offboarding, personal information changes
Permission Information	Application account, role	Authorize application access

When to Sync

Identity synchronization is triggered by various events in the employee lifecycle:

Event Type	Description
Create	New employee onboarding, creating users and organization nodes
Update	Job transfer, personal information change
Delete	Employee offboarding, disabling or deleting users

When the above events occur in the IDaaS platform, your application system needs to perceive and synchronize data immediately to ensure users can access normally and permissions take effect accurately.

How to Sync

BambooCloud IDaaS provides two synchronization methods to meet the needs of application systems with different technical architectures:

Method 1: Event Callback (Recommended)

Event Callback is IDaaS actively pushing change events to your application system.

• Mechanism: After detecting identity data changes, IDaaS immediately pushes event data to your pre-configured callback address via HTTPS request.
• Real-time: Near real-time push, arriving within seconds after the change occurs.
• Applicable Scenarios: Self-developed business systems, applications that need instant awareness of identity changes.
• Development Cost: Low; only need to develop a receiving interface and perform signature verification and decryption.

View Event Callback Integration Guide

Method 2: SCIM Protocol

SCIM (System for Cross-domain Identity Management) is an industry-standard identity synchronization protocol.

• Mechanism: Your application system proactively queries or receives identity data in IDaaS through standard SCIM API.
• Real-time: Depends on polling frequency or triggering queries with event callbacks.
• Applicable Scenarios: Commercial applications supporting SCIM standard, multi-tenant SaaS products.
• Development Cost: Medium; need to implement SCIM standard interfaces.

View SCIM Protocol Description

Quick Start

Event Callback (3 Steps)

1. Configure Callback Address — Ensure your server can normally receive pushes.
2. Implement Receiving Interface — Process events, verify signatures, and decrypt according to protocol specifications.
3. Joint Debugging Test — Verify the full process of create, update, and delete.

SCIM Protocol (3 Steps)

1. Understand SCIM Protocol — Master core concepts and endpoint specifications.
2. Implement SCIM Server — Implement CRUD interfaces for Users / Groups resources according to the standard.
3. Joint Verification — Test the correctness of data synchronization.

Error Handling

Regardless of which synchronization method is chosen, attention must be paid to abnormal scenario handling:

• Event Callback Error Codes — Push failure, signature verification failure, data format errors, etc.
• Network Timeout Retry — Retry strategy when callback address is unreachable.
• Data Conflict Handling — Merge strategy when a downstream system already has a user with the same name.

---

Recommendation: For first-time integration, prioritize event callback, which is simple to implement and highly real-time. When your application scales or needs to integrate with multi-tenant environments, consider introducing SCIM protocol as a supplement.