feat: improve SCIM documentation (#20451)
Co-authored-by: Ilya Mashchenko <ilya@netdata.cloud>
Juan Cañete committed
Jun 9, 2025 at 19:52 UTC
aa2a996843073f6811f063937f503fe749362c08
1 file changed
+17
-7
integrations/cloud-authentication/metadata.yaml
+17
-7
@@ -212,19 +212,29 @@
212
The externalID in SCIM must correspond to the subfield in OIDC. Any deviation from this mapping may result
213
in incorrect user identification and authentication failures.
214
215
- ## FAQ
215
+ ## Supported SCIM User properties
216
217
- ### Why aren’t users automatically added to Netdata spaces when they’re created through SCIM?
217
+ Our SCIM server supports the following User attributes:
218
+
219
+ - userName (required)
220
+ - externalId (required)
221
+ - name.formatted
222
+ - name.familyName
223
+ - name.givenName
224
+ - active
225
+ - emails (we only store the primary email)
226
219
- Currently, our SCIM server supports only the User resource. We plan to add support for the Group resource in the future.
227
+ **Important Considerations**
228
+ - Configure supported attributes only: Your SCIM client must be configured to send only the attributes listed above. Requests containing unsupported attributes will fail with a `400 Bad Request` error.
229
+ - Okta users: No additional setup needed. The Netdata integration includes the correct attribute configuration automatically.
230
221
- In a Netdata space, users can belong to multiple rooms and have different roles (e.g., admin, manager). Additionally, the same organization may have multiple spaces.
231
+ ## FAQ
232
223
- As we don't yet support groups, when a user is created through SCIM, we don’t have a way to determine which spaces, rooms, and roles the user should be assigned to.
233
+ ### Why aren’t users automatically added to Netdata spaces when they’re created through SCIM?
234
225
- Once we implement support for the Group resource, admins will be able to map SCIM groups to Netdata memberships, so this assignment will be done automatically.
235
+ Users created through SCIM are not automatically assigned to spaces. You need to configure Membership Rules to control space assignments.
236
227
- Until then, SCIM can only be used to grant or block access to Netdata for users in your organization. After a user is created, it is up to the Netdata administrator to manually invite them to spaces, rooms and assign roles.
237
+ See Setting Up Membership Rules section above for setup instructions.
238
239
### Reference
240
[SCIM Specification](https://scim.org)