awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Complete preliminary SCIM fns, add permissioning to SCIM, add docs for SCIM

Browse Source
This commit is contained in:
Tuan Dang
2024-02-18 18:50:23 -08:00
parent e15ed4cc58
commit 7a65f8c837
61 changed files with 1260 additions and 553 deletions
Download Patch File Download Diff File Expand all files Collapse all files

74
docs/documentation/platform/scim/azure.mdx Normal file
View File

@@ -0,0 +1,74 @@
---
title: "Azure SCIM"
description: "Configure SCIM provisioning with Azure for Infisical"
---
<Info>
Azure SCIM provisioning is a paid feature.
If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
then you should contact team@infisical.com to purchase an enterprise license to use it.
</Info>
Prerequisites:
- [Configure Azure SAML for Infisical](/documentation/platform/sso/azure)
<Steps>
<Step title="Create a SCIM token in Infisical">
In Infisical, head to your Organization Settings > Authentication > SCIM Configuration and
press the **Enable SCIM provisioning** toggle to allow Azure to provision/deprovision users for your organization.
![SCIM enable provisioning](/images/platform/scim/scim-enable-provisioning.png)
Next, press **Manage SCIM Tokens** and then **Create** to generate a SCIM token for Azure.
![SCIM create token](/images/platform/scim/scim-create-token.png)
Next, copy the **SCIM URL** and **New SCIM Token** to use when configuring SCIM in Azure.
![SCIM copy token](/images/platform/scim/scim-copy-token.png)
</Step>
<Step title="Configure SCIM in Azure">
In Azure, head to your Enterprise Application > Provisioning > Overview and press **Get started**.
![SCIM Azure](/images/platform/scim/azure/scim-azure-get-started.png)
Next, set the following fields:
- Provisioning Mode: Select **Automatic**.
- Tenant URL: Input **SCIM URL** from Step 1.
- Secret Token: Input the **New SCIM Token** from Step 1.
Afterwards, press the **Test Connection** button to check that SCIM is configured properly.
![SCIM Azure](/images/platform/scim/azure/scim-azure-config.png)
After you hit **Save**, select **Provision Microsoft Entra ID Users** under the **Mappings** subsection.
![SCIM Azure](/images/platform/scim/azure/scim-azure-select-user-mappings.png)
Next, adjust the mappings so you have them configured as below:
![SCIM Azure](/images/platform/scim/azure/scim-azure-user-mappings.png)
Finally, head to your Enterprise Application > Provisioning and set the **Provisioning Status** to **On**.
![SCIM Azure](/images/platform/scim/azure/scim-azure-provisioning-status.png)
Alternatively, you can go to **Overview** and press **Start provisioning** to have Azure start provisioning/deprovisioning users to Infisical.
![SCIM Azure](/images/platform/scim/azure/scim-azure-start-provisioning.png)
Now Azure can provision/deprovision users to/from your organization in Infisical.
</Step>
</Steps>
**FAQ**
<AccordionGroup>
<Accordion title="Why do SCIM-provisioned users have to finish setting up their account?">
Infisical's SCIM implmentation accounts for retaining the end-to-end encrypted architecture of Infisical because we decouple the **authentication** and **decryption** steps in the platform.
For this reason, SCIM-provisioned users are initialized but must finish setting up their account when logging in the first time by creating a master encryption/decryption key. With this implementation, IdPs and SCIM providers cannot and will not have access to the decryption key needed to decrypt your secrets.
</Accordion>
</AccordionGroup>