Technical Tip: User and group provisioning in AWS IAM Identity Center using FortiAuthenticator as SCIM Client

Description

This article describes how to configure and validate the SCIM configuration between FortiAuthenticator acting as a SCIM client and AWS IAM Identity Center as the SCIM server.

Scope

FortiAuthenticator.

Solution

FortiAuthenticator can synchronize and import users from multiple sources:

• Active Directory.

• LDAP.

• Local users.

• Other identity directories or sources.

FortiAuthenticator acts as a centralized source of truth by maintaining identities that come from multiple sources.

By using FortiAuthenticator as a SCIM client, it can provide identity lifecycle management and group synchronization by automatically pushing user/group updates to AWS Identity Center. This removes the need to manually update users and groups directly in IAM Identity Center. 

Benefits of the integration:

1. Automated onboarding/offboarding.

2. Multi-directory aggregation.

3. Group synchronization.

4. Centralized identity governance.

Figure 1. Logical Architecture Diagram with FortiAuthenticator acting as SCIM client.

Configuration requirements:

1. In AWS IAM Identity Center, configure FortiAuthenticator as the 'External Identity provider'. This will allow the administrator to enable the automatic provisioning feature.

Figure 2. Automatic provisioning is enabled in AWS Identity Center.

2. Users that are created or imported in FortiAuthenticator from other identity sources need to have the following attributes to be successfully pushed to IAM Identity Center:

• Username.

• Display name.

• First name.

• Last name.

This can be verified in FortiAuthenticator in Authentication -> User Management.

Select the user and validate the user fields in the 'User information' tab.

Figure 3. User attribute validation in FortiAuthenticator.

Detailed SCIM configuration steps are provided in FortiAuthenticator SCIM integration with AWS.

Validation:

To validate the configuration, go to Authentication -> SCIM -> Service provider.

Select the IAM Identity Center entry and select 'Sync'. This will trigger a user and group sync to the SCIM Server, where FortiAuthenticator, as a SCIM client, will send a REST API POST request containing the user and group information. WAD Debug logs in FortiAuthenticator will provide details of the POST request.

Enable in FortiAuthenticator shell:

diagnose system wad debug enable category rest_api

diagnose system wad debug enable category scim_client

For more debugging details, check the FortiAuthenticator Diagnostic debug CLI.

WAD debug logs will provide POST request details:

2026-06-09T18:24:19.582665+02:00 fortiauth1 wad_14-0[2613]: [scim_client] header: >>POST /XXXXXXXXXXX/scim/v2/Users HTTP/1.1

Host: scim.eu-central-1.amazonaws.com

Accept: application/scim+json

Content-Type: application/json;charset=utf-8

X-Requested-With: XMLHttpRequest

Accept-Language: en-us

User-Agent: curl/8.7.1

Authorization: Bearer XXXXXXXXXXXXX

Content-Length: 249

Connection: close

Cache-Control: no-cache

<<

2026-06-09T18:24:19.582686+02:00 fortiauth1 wad_14-0[2613]: [scim_client] content: >>{

"externalId": "local2",

"userName": "usera",

"active": true,

"displayName": "UserA",

"name": {

"givenName": "User",

"familyName": "A"

},

"meta": {

"resourceType": "User"

},

"schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"]

}<<

Logs view in FortiAuthenticator GUI will provide event details for successful user sync:

Figure 4. Event showing successful user synchronization to the IAM Identity Center instance.

In AWS IAM Identity Center, it is possible to validate the user or group creation and its source in IAM Identity Center -> Users.

Figure 5. User validation in AWS IAM Identity Center.