Issues Unlinking SCIM user from Atlassian account

[Vontez Heard]

Issues Unlinking SCIM user from Atlassian account

I have tried performing the curl command mentioned on https://developer.atlassian.com/cloud/admin/user-provisioning/rest/api-group-admin-apis/#api-admin-user-provisioning-v1-org-orgid-scimdirectoryid-scimdirectoryid-scimuserid-scimuserid-unlink-patch 

but have not been getting any success. I've tried copying and pasting the curl command exactly how it is listed on the article, updating with our details - org ID, SCIM directory ID and API bearer token from our owner account (sysadmin@featurespace.co.uk) and it is failing.

I first got this error:

"curl: (35) schannel: next InitializeSecurityContext failed: CRYPT_E_NO_REVOCATION_CHECK (0x80092012) - The revocation function was unable to check revocation for the certificate."

Then I changed the curl command around a bit to this:

curl https://api.atlassian.com/admin/user-provisioning/v1/org/5accXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/get-scim-links-for-email/"Authorization: Bearer XXXXXXXXXXXXXXXXXXX"/"Accept: application/json"/"Content-Type: application/json"/"{"email": "graham.newland@featurespace.co.uk"}"

and got this error:

"curl: (3) URL rejected: Malformed input to a URL function"

So then I figured my company may be blocking the request.

So I then tried on a different machine and received the error:

"401 unauthorized"

I am not sure what I am doing wrong. Can I please get some assistance with this?

My colleague opened a ticket regarding the issues with provisioning Graham's (graham.newland@featurespace.co.uk) account, which led us to the knowledge article above. That ticket number is PCS-420637.

This is causing delays in Graham accessing Jira tickets and Confluence wiki articles so we would like some quick assistance on this please.

[Tomislav Tobijas]

Hi @Vontez Heard ,

We do use Delete user in SCIM DB instead of unlinking (actually, my colleague does this and I could check with him why one over the other > update: seems like PATCH is a newer call so that's why we used DEL).

In any case, I've managed to find this info in our internal KB 👇:

• The API request requires an Admin API token.

• The API token is generated through the Admin Hub under Settings tab → option API Keys.

You can access your Admin Hub at: https://admin.atlassian.com/o/{orgId}/admin-api

We basically just make a REST API call via Postman to delete a user in the SCIM DB, which then 'unlinks' them from IdP.

So, this:

Item	Description
URL	https://api.atlassian.com/admin/user-provisioning/v1/org/{orgId}/user/{AAID}/onlyDeleteUserInDB
Authorization	Bearer <access_token>

Access token created by following the steps above doesn't need to be encrypted.

As for required parameters, use this:

Parameter	Description
orgId	Unique ID of your organization. You can retrieve this ID from the Admin hub URL. https://admin.atlassian.com/o/{orgId}/overview
AAID	Unique ID of the user's Atlassian account. You can find this ID in the user management URL. You can locate the AAID by navigating to the Users or Managed Users tab in Admin Hub. The AAID appears in the URL: https://admin.atlassian.com/o/{orgId}/users/{aaId} https://admin.atlassian.com/o/{orgId}/members/{aaId} https://admin.atlassian.com/s/{siteId}/users/{aaId}

Hope this helps.

Cheers,
Tobi