@cryptotaxi247 / netdata-1 / commits / ea10e1333

Add SCIM integration docs (#18094)

Co-authored-by: Ilya Mashchenko <ilya@netdata.cloud>

Juan Cañete committed Aug 19, 2024 at 18:16 UTC ea10e1333fc31408fcd02272c1224a57784482d3
1 file changed +70 -2
integrations/cloud-authentication/metadata.yaml
+70 -2
@@ -33,7 +33,7 @@
33
34 ### Netdata Configuration Steps
35 1. Click on the Space settings cog (located above your profile icon)
36 - 2. Click on the **Authentication** tab
36 + 2. Click on the **User Management** section and access **Authentication and Authorization** tab.
37 3. On the Okta SSO card, click on **Configure**
38 4. Fill in the [required credentials](https://developer.okta.com/docs/guides/find-your-app-credentials/main/), you get them from **Okta Admin Portal**:
39 - **Issuer URL** you can get it from your profile icon on top, e.g. `https://company-name.okta.com`
@@ -82,7 +82,7 @@
82
83 ### Netdata Configuration Steps
84 1. Click on the Space settings cog (located above your profile icon)
85 - 2. Click on the **Authentication** tab
85 + 2. Click on the **User Management** section and access **Authentication and Authorization** tab.
86 3. On the OIDC card, click on **Configure**
87 4. Fill in the required credentials:
88 - **Issuer URL** the Authorization Server Issuer URL, e.g. `https://my-auth-server.com/`
@@ -103,3 +103,71 @@
103
104 ### Reference
105 https://openid.net/developers/how-connect-works/
106 +
107 +- id: 'scim'
108 + meta:
109 + name: 'SCIM'
110 + link: 'https://netdata.cloud'
111 + categories:
112 + - auth
113 + icon_filename: 'scim.svg'
114 + keywords:
115 + - scim
116 + - identity-management
117 + overview:
118 + authentication_description: "The System for Cross-domain Identity Management (SCIM) specification is designed to simplify the management of user identities in cloud-based applications and services."
119 + authentication_limitations: ''
120 + setup:
121 + description: |
122 + ### Prerequisites
123 + - A Netdata Cloud account
124 + - Admin access to the Space
125 + - The Space must be on a paid plan
126 + - OIDC/SSO integration must already be enabled in one of your Spaces
127 +
128 + ### Netdata Configuration Steps
129 + 1. Click on the Space settings cog (located above your profile icon).
130 + 2. Click on the **User Management** section and access **Authentication and Authorization** tab.
131 + 3. In the SCIM card, click on **Activate**.
132 + 4. Depending on your situation:
133 + - If OIDC/SSO integration is already enabled in your Space, click **Activate**.
134 + - If you already have a SCIM integration in another Space and want to create a linked integration here, enter the SCIM token from the original integration and click **Activate**.
135 + 5. If the setup is successful, you will receive two parameters:
136 + - **Base URL**: Use this URL as the base URL for your SCIM client.
137 + - **Token**: Use this token for Bearer Authentication with your SCIM client.
138 +
139 + ### Rotating the SCIM Token
140 + You can rotate the token provided during SCIM integration setup if needed.
141 +
142 + Steps to rotate the token:
143 + 1. Click on the Space settings cog (located above your profile icon).
144 + 2. Click on the **User Management** section and access **Authentication and Authorization** tab.
145 + 3. In the already configured SCIM card, click **Configure**.
146 + 4. Click **Regenerate Token**.
147 + 5. If successful, you will receive a new token for Bearer Authentication with your SCIM client.
148 +
149 + ### Supported Features
150 + This integration adheres to SCIM v2 specifications. Supported features include:
151 +
152 + - User Resource Management (urn:ietf:params:scim:schemas:core:2.0:User)
153 + - Patch operations: Supported
154 + - Bulk operations: Not supported
155 + - Filtering: Supported (max results: 200)
156 + - Password synchronization: Not supported, as we rely on SSO/OIDC authentication
157 + - eTag: Not supported
158 + - Authentication schemes: OAuth Bearer Token
159 +
160 + ### User Keying Between SCIM and OIDC
161 + Our SCIM (System for Cross-domain Identity Management) integration utilizes OIDC (OpenID Connect) to authenticate users.
162 + To ensure users are correctly identified and authenticated between SCIM and OIDC, we use the following mapping:
163 +
164 + - SCIM externalID ↔ OIDC sub
165 +
166 + This mapping ensures that the identity of users remains consistent and secure across both systems.
167 +
168 + **Important**: Ensure that your OIDC and SCIM systems follow this mapping strictly.
169 + The externalID in SCIM must correspond to the subfield in OIDC. Any deviation from this mapping may result
170 + in incorrect user identification and authentication failures.
171 +
172 + ### Reference
173 + [SCIM Specification](https://scim.org)