Let me provide a comprehensive overview of our SCIM-based automated provisioning implementation for Manhattan Associates logistics management.
Architecture Overview
We built a custom SCIM 2.0 gateway service rather than using an off-the-shelf broker because we needed tight control over the attribute mapping logic and Manhattan API integration. The architecture has three main components:
- SCIM Gateway Service: Node.js application that implements SCIM 2.0 server endpoints
- Attribute Mapping Engine: Configuration-driven mapper between HRIS attributes and Manhattan user profiles
- Manhattan API Client: Handles authentication and API calls to Manhattan’s user management endpoints
SCIM Endpoint Configuration
Our SCIM gateway implements these core endpoints:
User Operations:
- POST /scim/v2/Users - Create new user in Manhattan
- GET /scim/v2/Users/{id} - Retrieve user details
- PUT /scim/v2/Users/{id} - Update user attributes
- PATCH /scim/v2/Users/{id} - Partial user updates
- DELETE /scim/v2/Users/{id} - Deactivate user (soft delete)
Query Operations:
- GET /scim/v2/Users?filter=… - Search users
- GET /scim/v2/Users?startIndex=1&count=100 - Paginated retrieval
Workday Configuration:
In Workday, we configured Manhattan as a provisioning target with these settings:
- SCIM endpoint URL: https://scim-gateway.company.com/scim/v2
- Authentication: OAuth2 client credentials
- Provisioning events: Hire, Termination, Job Change, Department Transfer
- Sync schedule: Real-time for critical events, hourly batch for updates
HRIS Attribute Mapping
We map Workday attributes to Manhattan user fields through a configuration table:
Identity Attributes:
- Workday Employee ID → Manhattan User ID
- Email Address → Manhattan Email (used for notifications)
- First Name + Last Name → Manhattan Display Name
- Department Code → Manhattan Facility Assignment
- Job Title → Manhattan Role Profile (via mapping table)
Role Mapping Logic:
We created a role mapping configuration that translates job codes to Manhattan roles:
Logistics Management Roles:
- Job Code ‘LOG-COORD’ → Role: Logistics Coordinator
- Permissions: View shipments, update tracking, assign carriers
- Job Code ‘LOG-MGR’ → Role: Logistics Manager
- Permissions: All coordinator permissions + approve shipments, manage routes
- Job Code ‘DISPATCH’ → Role: Dispatcher
- Permissions: Assign loads, update driver status, manage schedules
Warehouse Roles (for cross-functional users):
- Job Code ‘WH-SUPER’ → Role: Warehouse Supervisor
- Permissions: View inventory, manage picks, approve adjustments
Multi-Role Assignment:
Users with department code ‘LOG-WH-CROSS’ get both logistics and warehouse roles automatically.
Automated Provisioning Workflow
New Hire Scenario:
- HR Event: New employee created in Workday
- SCIM Request: Workday sends POST /scim/v2/Users with employee attributes
- Gateway Processing:
- Validates SCIM payload
- Looks up role mapping based on job code
- Determines facility assignment from department code
- Generates unique Manhattan username (firstname.lastname format)
- Manhattan API Calls:
- Create user account with mapped attributes
- Assign role profiles based on job code
- Set facility access permissions
- Enable account (active status)
- Response: SCIM gateway returns user ID and provisioning status
- Notification: Automated email sent to new hire with login credentials
Typical processing time: 45-90 seconds from Workday event to active Manhattan account
Termination Scenario:
- HR Event: Employee terminated in Workday
- SCIM Request: DELETE /scim/v2/Users/{id}
- Gateway Processing:
- Validates termination is authorized
- Checks for active sessions in Manhattan
- Logs termination event for audit
- Manhattan API Calls:
- Disable user account (soft delete, preserves audit history)
- Revoke active sessions
- Remove from active user groups
- Maintain historical data for compliance
- Response: Confirmation of deactivation
- Notification: Alert sent to IT security team
Processing time: Under 5 minutes (typically 2-3 minutes)
Job Change/Transfer Scenario:
- HR Event: Employee job title or department changes in Workday
- SCIM Request: PATCH /scim/v2/Users/{id} with updated attributes
- Gateway Processing:
- Compares new job code to existing role assignments
- Determines if role change is needed
- Identifies new facility access requirements
- Manhattan API Calls:
- Update user profile attributes
- Add new role profiles (if job code changed)
- Remove old role profiles (if no longer applicable)
- Update facility assignments
- Response: Confirmation of updates
- Notification: Email to user and manager about access changes
Exception Handling and Edge Cases
Contractors and Temporary Workers:
- Workday employment type ‘Contractor’ → Manhattan role suffix ‘-Contractor’
- Limited permissions profile (read-only for most operations)
- Automatic expiration date set based on contract end date
- Email reminders sent 30 days before expiration
Manual Access Overrides:
- Self-service portal for managers to request exceptions
- Approval workflow (manager → IT security → auto-approval for standard requests)
- Exceptions stored in separate database table
- SCIM updates check exception table and preserve manual grants
- Quarterly review process for all active exceptions
Cross-Functional Roles:
- Department code determines base role profile
- Additional roles granted based on ‘Secondary Department’ attribute in Workday
- Maximum of 3 role profiles per user (prevents permission creep)
- Annual access certification for multi-role users
Handling SCIM Filtering and Pagination
Pagination Strategy:
Manhattan API has rate limit of 100 requests/minute, so we implemented:
- Page size: 50 users per request
- Throttling: 500ms delay between requests
- Batch processing during off-peak hours (2-4 AM)
- Incremental sync: Only users modified since last sync
Filtering Implementation:
Support for common SCIM filters:
filter=userName eq "john.doe" - Exact match lookupsfilter=department eq "Logistics" - Department-based queriesfilter=active eq true - Active user listsfilter=meta.lastModified gt "2025-06-01T00:00:00Z" - Incremental sync
Technical Implementation Details
SCIM Gateway Stack:
- Runtime: Node.js 18 with Express framework
- SCIM Library: Custom implementation (SCIM 2.0 spec compliant)
- Database: PostgreSQL for mapping tables and audit logs
- Cache: Redis for session management and rate limiting
- Monitoring: Prometheus metrics + Grafana dashboards
Security Measures:
- OAuth2 client credentials for Workday authentication
- Mutual TLS for Manhattan API communication
- Encrypted attribute storage (PII data)
- Audit logging of all provisioning events
- Anomaly detection for unusual provisioning patterns
Key Performance Metrics (After 6 Months)
Efficiency Gains:
- Onboarding time: 3-4 days → 2 hours (95% reduction)
- Manual provisioning errors: 12-15/month → 0
- Deprovisioning lag: 2-5 days → Same day (100% automated)
- IT admin time saved: 40 hours/month
Security Improvements:
- Orphaned accounts eliminated (previously 15-20 per quarter)
- Access certification accuracy: 98% (up from 75%)
- Audit compliance score: 100% (SOC 2 requirement)
- Average time to revoke access on termination: 2.5 minutes
User Satisfaction:
- New hire access readiness: 98% (access ready on day 1)
- Role assignment accuracy: 96% (minimal manual corrections)
- Manager satisfaction with provisioning speed: 9.2/10
Lessons Learned and Recommendations
What Worked Well:
- Configuration-driven role mapping (easy to update without code changes)
- Separate exception handling for edge cases
- Real-time provisioning for critical events (hire/termination)
- Comprehensive audit logging for compliance
Challenges Overcome:
- Manhattan API rate limits required throttling and batch processing
- Complex role mapping logic needed extensive testing
- Exception handling added significant complexity
- Initial data migration from manual accounts took 3 weeks
Future Enhancements:
- Implement SCIM group provisioning for team-based access
- Add self-service access request portal for end users
- Integrate with identity governance platform for periodic access reviews
- Expand to other Manhattan modules (warehouse, transportation)
Implementation Timeline
For organizations considering similar automation:
- Weeks 1-2: Requirements gathering and role mapping design
- Weeks 3-6: SCIM gateway development and testing
- Weeks 7-8: Manhattan API integration and error handling
- Weeks 9-10: Workday configuration and testing
- Weeks 11-12: User acceptance testing and exception handling
- Week 13: Production rollout (pilot group)
- Week 14: Full production deployment
Total project duration: 14 weeks with 2 developers and 1 architect.
This implementation has been transformational for our logistics operations, eliminating manual provisioning bottlenecks and significantly improving our security posture through automated deprovisioning. The investment in building a robust SCIM gateway has paid off through time savings, error reduction, and compliance improvements.