Add SCIM integration docs (#18094)
Co-authored-by: Ilya Mashchenko <ilya@netdata.cloud>
Juan Cañete committed
Aug 19, 2024 at 18:16 UTC
ea10e1333fc31408fcd02272c1224a57784482d3
1 file changed
+70
-2
integrations/cloud-authentication/metadata.yaml
+70
-2
@@ -33,7 +33,7 @@
33
34
### Netdata Configuration Steps
35
1. Click on the Space settings cog (located above your profile icon)
36
- 2. Click on the **Authentication** tab
36
+ 2. Click on the **User Management** section and access **Authentication and Authorization** tab.
37
3. On the Okta SSO card, click on **Configure**
38
4. Fill in the [required credentials](https://developer.okta.com/docs/guides/find-your-app-credentials/main/), you get them from **Okta Admin Portal**:
39
- **Issuer URL** you can get it from your profile icon on top, e.g. `https://company-name.okta.com`
@@ -82,7 +82,7 @@
82
83
### Netdata Configuration Steps
84
1. Click on the Space settings cog (located above your profile icon)
85
- 2. Click on the **Authentication** tab
85
+ 2. Click on the **User Management** section and access **Authentication and Authorization** tab.
86
3. On the OIDC card, click on **Configure**
87
4. Fill in the required credentials:
88
- **Issuer URL** the Authorization Server Issuer URL, e.g. `https://my-auth-server.com/`
@@ -103,3 +103,71 @@
103
104
### Reference
105
https://openid.net/developers/how-connect-works/
106
+
107
+- id: 'scim'
108
+ meta:
109
+ name: 'SCIM'
110
+ link: 'https://netdata.cloud'
111
+ categories:
112
+ - auth
113
+ icon_filename: 'scim.svg'
114
+ keywords:
115
+ - scim
116
+ - identity-management
117
+ overview:
118
+ authentication_description: "The System for Cross-domain Identity Management (SCIM) specification is designed to simplify the management of user identities in cloud-based applications and services."
119
+ authentication_limitations: ''
120
+ setup:
121
+ description: |
122
+ ### Prerequisites
123
+ - A Netdata Cloud account
124
+ - Admin access to the Space
125
+ - The Space must be on a paid plan
126
+ - OIDC/SSO integration must already be enabled in one of your Spaces
127
+
128
+ ### Netdata Configuration Steps
129
+ 1. Click on the Space settings cog (located above your profile icon).
130
+ 2. Click on the **User Management** section and access **Authentication and Authorization** tab.
131
+ 3. In the SCIM card, click on **Activate**.
132
+ 4. Depending on your situation:
133
+ - If OIDC/SSO integration is already enabled in your Space, click **Activate**.
134
+ - If you already have a SCIM integration in another Space and want to create a linked integration here, enter the SCIM token from the original integration and click **Activate**.
135
+ 5. If the setup is successful, you will receive two parameters:
136
+ - **Base URL**: Use this URL as the base URL for your SCIM client.
137
+ - **Token**: Use this token for Bearer Authentication with your SCIM client.
138
+
139
+ ### Rotating the SCIM Token
140
+ You can rotate the token provided during SCIM integration setup if needed.
141
+
142
+ Steps to rotate the token:
143
+ 1. Click on the Space settings cog (located above your profile icon).
144
+ 2. Click on the **User Management** section and access **Authentication and Authorization** tab.
145
+ 3. In the already configured SCIM card, click **Configure**.
146
+ 4. Click **Regenerate Token**.
147
+ 5. If successful, you will receive a new token for Bearer Authentication with your SCIM client.
148
+
149
+ ### Supported Features
150
+ This integration adheres to SCIM v2 specifications. Supported features include:
151
+
152
+ - User Resource Management (urn:ietf:params:scim:schemas:core:2.0:User)
153
+ - Patch operations: Supported
154
+ - Bulk operations: Not supported
155
+ - Filtering: Supported (max results: 200)
156
+ - Password synchronization: Not supported, as we rely on SSO/OIDC authentication
157
+ - eTag: Not supported
158
+ - Authentication schemes: OAuth Bearer Token
159
+
160
+ ### User Keying Between SCIM and OIDC
161
+ Our SCIM (System for Cross-domain Identity Management) integration utilizes OIDC (OpenID Connect) to authenticate users.
162
+ To ensure users are correctly identified and authenticated between SCIM and OIDC, we use the following mapping:
163
+
164
+ - SCIM externalID ↔ OIDC sub
165
+
166
+ This mapping ensures that the identity of users remains consistent and secure across both systems.
167
+
168
+ **Important**: Ensure that your OIDC and SCIM systems follow this mapping strictly.
169
+ The externalID in SCIM must correspond to the subfield in OIDC. Any deviation from this mapping may result
170
+ in incorrect user identification and authentication failures.
171
+
172
+ ### Reference
173
+ [SCIM Specification](https://scim.org)