### Problem statement GitLab.com supports [SCIM](https://docs.gitlab.com/ee/user/group/saml_sso/scim_setup.html#scim-provisioning-using-saml-sso-for-groups-silver-only) for provisioning and deprovisioning of users, but is only compatible with Azure AD. We should extend our implementation to make it configurable and focus on supporting Okta, one of the most popular IDaaS providers. We should support SCIM on Okta. ### Proposal Steps to take, as per @jamedjo: 1. Add name fall back to `displayName` and first/last name. This will also make azure configuration easier, as mentioned in https://gitlab.com/gitlab-org/gitlab-ee/issues/13016#note_196560680. Issue created at https://gitlab.com/gitlab-org/gitlab-ee/issues/13093 1. Allow `count`/`startIndex` filtering. Issue created at https://gitlab.com/gitlab-org/gitlab-ee/issues/13094 1. Investigate how we might link accounts created with Okta SCIM to SAML correctly. I briefly thought we might do so by storing the SCIM ID as `secondary_extern_uid`, but this is only available after the initial `CREATE`. Also we'll need a way to know not to use `externalId` as we are for other requests. 1. Run Okta's test cases from https://www.okta.com/integrate/documentation/scim/#testing-your-scim-server-with-runscope against our integration. 1. Sign up for an Okta Integrator account and publish a GitLab app to make setting things up easier for users.