Update SCIM docs with Groups support (#19969)
* Update SCIM docs with Groups support * Apply suggestions from code review --------- Co-authored-by: Ilya Mashchenko <ilya@netdata.cloud>
Juan Cañete committed
Mar 26, 2025 at 13:13 UTC
7297d776fa4c17a463711edf6a7aeb7f4d41343d
1 file changed
+28
integrations/cloud-authentication/metadata.yaml
+28
@@ -129,9 +129,13 @@
129
This integration adheres to SCIM v2 specifications. Supported features include:
130
131
- User Resource Management (urn:ietf:params:scim:schemas:core:2.0:User)
132
+ - Group Resource Management (urn:ietf:params:scim:schemas:core:2.0:Group)
133
- Create users
134
- Update user attributes
135
- Deactivate users
136
+ - Create groups
137
+ - Associate users to groups
138
+ - Nested groups supported
139
- Patch operations: Supported
140
- Bulk operations: Not supported
141
- Filtering: Supported (max results: 200)
@@ -161,6 +165,30 @@
165
4. Enter the Token (obtained in the *Netdata Configuration Steps* section) into the **API Token** field, then click **Test API Credentials** to ensure the connection is successful.
166
5. If the test is successful, click **Save** to apply the configuration.
167
168
+ ## Setting Up Membership Rules
169
+
170
+ 1. Click on the Space settings cog (located above your profile icon).
171
+ 2. Navigate to the **User Management** section and select the **Groups** tab.
172
+ 3. Once your SCIM client has provisioned groups to Netdata, you'll see a **Create a new rule** button.
173
+ 4. Click this button to open the membership rule configuration panel.
174
+ 5. For each rule, configure the following three components:
175
+ - **SCIM Group**: Select the SCIM group that should be mapped
176
+ - **Netdata Role**: Choose the role that members of this group should have in the space
177
+ - **Space Rooms**: (Optional) Select specific rooms that these users should be members of
178
+ 6. Click **Save** to activate the configuration.
179
+ 7. Repeat steps 4-6 to create additional rules as needed.
180
+
181
+ ### How Membership Rules Work
182
+
183
+ - When a user in your identity provider is assigned to a SCIM group, they will automatically be added to your Netdata Space with the role and room access defined in your rules.
184
+ - If a user is removed from a SCIM group, their access will be adjusted according to your rules.
185
+ - When users match multiple rules, they are granted the highest permission level from all their matching rules.
186
+ - Changes to membership rules take effect immediately for new and existing users.
187
+
188
+ **Important Considerations**
189
+ - If you had previously manually invited users who are now being provisioned through SCIM, their existing roles and room access will be updated to match your rules.
190
+ - You must create at least one rule that assigns the **Admin** role to a SCIM group. If no admin role is defined in your rules, Netdata will not implement any user membership changes and will display a warning in the workspace.
191
+
192
## Troubleshoot
193
194
### Rotating the SCIM Token