User and group attributes in IAM Identity Center
Attributes are pieces of information that help you define and identify individual user
or group objects, such as name, email, or
members.
Supported user and group attributes in IAM Identity Center
IAM Identity Center supports most commonly used attributes regardless if they are entered manually during user creation or when automatically provisioned using a synchronization engine such as defined in the System for Cross-Domain Identity Management (SCIM) specification.
-
For more information about the System for Cross-Domain Identity Management (SCIM) specification, see https://tools.ietf.org/html/rfc7642
. -
For more information about manual and automatic provisioning, see Provisioning when users come from an external IdP.
-
For more information about attribute mapping, see Attribute mappings between IAM Identity Center and External Identity Providers directory.
Because IAM Identity Center supports SCIM for automatic provisioning use cases, the Identity Center directory supports all of the same user and group attributes that are listed in the SCIM specification, with a few exceptions. The following sections describe which attributes aren't supported by IAM Identity Center.
User objects
All attributes from the SCIM user schema (https://tools.ietf.org/html/rfc7643#section-8.3
-
password -
ims -
photos -
entitlements -
x509Certificates
All sub-attributes for users are supported, except for the following:
-
'display'sub-attribute of any multi-valued attribute (For example,emailsorphoneNumbers) -
'version'sub-attribute of'meta'attribute
Group objects
All attributes from the SCIM group schema (https://tools.ietf.org/html/rfc7643#section-8.4
All sub-attributes for groups are supported, except for the following:
-
'display'sub-attribute of any multi-valued attribute (For example, members).
