diff --git a/docs/docs.json b/docs/docs.json index b342bf09e..444f74b5d 100644 --- a/docs/docs.json +++ b/docs/docs.json @@ -248,6 +248,7 @@ "documentation/platform/scim/okta", "documentation/platform/scim/azure", "documentation/platform/scim/jumpcloud", + "documentation/platform/scim/pingone", "documentation/platform/scim/group-mappings" ] } diff --git a/docs/documentation/platform/scim/overview.mdx b/docs/documentation/platform/scim/overview.mdx index 5b8507961..21f06cd8d 100644 --- a/docs/documentation/platform/scim/overview.mdx +++ b/docs/documentation/platform/scim/overview.mdx @@ -24,3 +24,4 @@ SCIM providers: - [Okta SCIM](/documentation/platform/scim/okta) - [Azure SCIM](/documentation/platform/scim/azure) - [JumpCloud SCIM](/documentation/platform/scim/jumpcloud) +- [PingOne SCIM](/documentation/platform/scim/pingone) diff --git a/docs/documentation/platform/scim/pingone.mdx b/docs/documentation/platform/scim/pingone.mdx new file mode 100644 index 000000000..d1ea9071d --- /dev/null +++ b/docs/documentation/platform/scim/pingone.mdx @@ -0,0 +1,149 @@ +--- +title: "PingOne SCIM" +description: "Learn how to configure SCIM provisioning with PingOne for Infisical." +--- + + + PingOne SCIM provisioning is a paid feature. + + If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical, + then you should contact sales@infisical.com to purchase a self-hosted license to use it. + + +Prerequisites: +- [Configure PingOne OIDC for Infisical](/documentation/platform/sso/pingone-oidc) + + + + In Infisical, head to the **Single Sign-On (SSO)** page and select the **Provisioning** tab. Under SCIM Configuration, + press the **Enable SCIM provisioning** toggle to allow PingOne to provision/deprovision users for your organization. + + ![SCIM enable provisioning](/images/platform/scim/scim-enable-provisioning.png) + + Next, press **Manage SCIM Tokens** and then **Create** to generate a SCIM token for PingOne. + + ![SCIM create token](/images/platform/scim/scim-create-token.png) + + Next, copy the **SCIM URL** and **New SCIM Token** to use when configuring SCIM in PingOne. + + ![SCIM copy token](/images/platform/scim/scim-copy-token.png) + + + Inside your PingOne environment, navigate to Directory > Users. Add any users and/or groups to your application that you would like + to be provisioned over to Infisical. + + ![SCIM PingOne Users and Groups](/images/platform/scim/pingone/pingone-create-user.png) + + + + + **1. Create a new connection** + + In PingOne, head to Integrations > Provisioning, and inside provisioning, press the **Connections** tab. Here you'll see a plus icon to add a new connection. + + ![SCIM PingOne Connections](/images/platform/scim/pingone/pingone-new-connection.png) + + ![SCIM PingOne Connections](/images/platform/scim/pingone/pingone-new-connection-identity-store.png) + + Select the "Identity Store" option. + + + ![SCIM PingOne SCIM Outbound](/images/platform/scim/pingone/pingone-connection-select-scim-outbound.png) + + Search for the "SCIM Outbound" option to start the configuration process for SCIM. Finally, press the **Next** button. Give the connection a name and optionally add a description. + + **2. Configure the connection** + + Once you have selected the SCIM Outbound option, you'll be prompted to enter the authentication details that PingOne will use to authenticate with Infisical SCIM. This is the **SCIM URL** and **New SCIM Token** from the previous step. + + ![SCIM PingOne SCIM Outbound](/images/platform/scim/pingone/pingone-connection-auth.png) + + Set the following fields: + - `SCIM BASE URL`: Input the **SCIM URL** from the previous step. + - `Users Resource`: Leave as default, `/Users`. + - `Groups Resource`: Leave as default, `/Groups`. + - `SCIM Version`: Leave as default, `2.0`. + - `Authentication Method`: Select `OAuth 2 Bearer Token`. + - `Oauth Access Token`: Input the **New SCIM Token** from step 1. + - `Auth Type Header`: Select `Bearer`. + + Once this is done, you can press the **Test Connection** button to check that SCIM is configured properly. You should see a success message saying "Connection Successful". + If the connection is successful, press the "Next" button. + + In the final step, you'll be prompted to configure the mappings for the connection. + + Set the following fields: + - `User Filter Expression`: `email.value Eq "%s"`. + - `User Identifier`: `workEmail`. + - `Deprovision on Rule Deletion:` Enabled. + + ![SCIM PingOne Connection Mappings](/images/platform/scim/pingone/pingone-connection-preferences.png) + + Once this is configured, press the "Save" button. + + **3. Enable the connection** + + Finally, remember to enable the connection by pressing the enable toggle. + + ![SCIM PingOne Connection Enable](/images/platform/scim/pingone/pingone-connection-enable.png) + + + + + **1. Create a new rule** + + After creating a connection, you can now access the "Rules" tab under the Provisioning section. Here you can configure the rules for the connection. + + ![SCIM PingOne Create New Rule 1](/images/platform/scim/pingone/pingone-new-rule-1.png) + + ![SCIM PingOne Create New Rule 2](/images/platform/scim/pingone/pingone-new-rule-2.png) + + Select the "New Rule" button and choose a name for the rule, then press the "Create Rule" button. + + **2. Configure the rule connection** + + Once you have created a rule, you now need to configure the connection to use for the rule. + + ![SCIM PingOne Create New Rule 3](/images/platform/scim/pingone/pingone-rule-select-connection.png) + + Select the connection you created in the previous step and press the "Save" button. + + **3. Configure the rule user filter** + + ![SCIM PingOne Create New Rule 4](/images/platform/scim/pingone/pingone-rule-select-user-filter.png) + + Select the Edit pencil icon to open the user filter configuration. This step dictates which users will be provisioned to Infisical. + + ![SCIM PingOne Create New Rule 5](/images/platform/scim/pingone/pingone-rule-user-filter.png) + + In this case, we are provisioning all users that are enabled in PingOne. Configure your user filter to match your desired users, and then press the "Save" button. + + **4. Configure Groups** + + This step is optional and only relevant if you want to provision PingOne groups to Infisical. + + ![SCIM PingOne Create New Rule 6](/images/platform/scim/pingone/pingone-rule-group-provisioning-tab.png) + + Open the "Group Provisioning" tab and press the "Add Groups" button to select which groups will be provisioned to Infisical. + + ![SCIM PingOne Create New Rule 7](/images/platform/scim/pingone/pingone-select-group.png) + + Select the groups you want to provision to Infisical and press the "Save" button. + + **5. Enable the rule** + + Once you have configured the rule, you can enable it by pressing the "Enable" toggle. + + ![SCIM PingOne Create New Rule 8](/images/platform/scim/pingone/pingone-rule-enable.png) + + + +**FAQ** + + + + Infisical's SCIM implmentation accounts for retaining the end-to-end encrypted architecture of Infisical because we decouple the **authentication** and **decryption** steps in the platform. + + For this reason, SCIM-provisioned users are initialized but must finish setting up their account when logging in the first time by creating a master encryption/decryption key. With this implementation, IdPs and SCIM providers cannot and will not have access to the decryption key needed to decrypt your secrets. + + diff --git a/docs/images/platform/scim/pingone/pingone-connection-auth.png b/docs/images/platform/scim/pingone/pingone-connection-auth.png new file mode 100644 index 000000000..c29d8b702 Binary files /dev/null and b/docs/images/platform/scim/pingone/pingone-connection-auth.png differ diff --git a/docs/images/platform/scim/pingone/pingone-connection-enable.png b/docs/images/platform/scim/pingone/pingone-connection-enable.png new file mode 100644 index 000000000..24e423742 Binary files /dev/null and b/docs/images/platform/scim/pingone/pingone-connection-enable.png differ diff --git a/docs/images/platform/scim/pingone/pingone-connection-preferences.png b/docs/images/platform/scim/pingone/pingone-connection-preferences.png new file mode 100644 index 000000000..e8372fd68 Binary files /dev/null and b/docs/images/platform/scim/pingone/pingone-connection-preferences.png differ diff --git a/docs/images/platform/scim/pingone/pingone-connection-select-scim-outbound.png b/docs/images/platform/scim/pingone/pingone-connection-select-scim-outbound.png new file mode 100644 index 000000000..a83d4a590 Binary files /dev/null and b/docs/images/platform/scim/pingone/pingone-connection-select-scim-outbound.png differ diff --git a/docs/images/platform/scim/pingone/pingone-create-user.png b/docs/images/platform/scim/pingone/pingone-create-user.png new file mode 100644 index 000000000..f48d4e74c Binary files /dev/null and b/docs/images/platform/scim/pingone/pingone-create-user.png differ diff --git a/docs/images/platform/scim/pingone/pingone-new-connection-identity-store.png b/docs/images/platform/scim/pingone/pingone-new-connection-identity-store.png new file mode 100644 index 000000000..371645ace Binary files /dev/null and b/docs/images/platform/scim/pingone/pingone-new-connection-identity-store.png differ diff --git a/docs/images/platform/scim/pingone/pingone-new-connection.png b/docs/images/platform/scim/pingone/pingone-new-connection.png new file mode 100644 index 000000000..ea17e15f4 Binary files /dev/null and b/docs/images/platform/scim/pingone/pingone-new-connection.png differ diff --git a/docs/images/platform/scim/pingone/pingone-new-rule-1.png b/docs/images/platform/scim/pingone/pingone-new-rule-1.png new file mode 100644 index 000000000..065ffb446 Binary files /dev/null and b/docs/images/platform/scim/pingone/pingone-new-rule-1.png differ diff --git a/docs/images/platform/scim/pingone/pingone-new-rule-2.png b/docs/images/platform/scim/pingone/pingone-new-rule-2.png new file mode 100644 index 000000000..4aedebaad Binary files /dev/null and b/docs/images/platform/scim/pingone/pingone-new-rule-2.png differ diff --git a/docs/images/platform/scim/pingone/pingone-rule-enable.png b/docs/images/platform/scim/pingone/pingone-rule-enable.png new file mode 100644 index 000000000..0cc3f58a1 Binary files /dev/null and b/docs/images/platform/scim/pingone/pingone-rule-enable.png differ diff --git a/docs/images/platform/scim/pingone/pingone-rule-group-provisioning-tab.png b/docs/images/platform/scim/pingone/pingone-rule-group-provisioning-tab.png new file mode 100644 index 000000000..25decadba Binary files /dev/null and b/docs/images/platform/scim/pingone/pingone-rule-group-provisioning-tab.png differ diff --git a/docs/images/platform/scim/pingone/pingone-rule-select-connection.png b/docs/images/platform/scim/pingone/pingone-rule-select-connection.png new file mode 100644 index 000000000..5eabc22f3 Binary files /dev/null and b/docs/images/platform/scim/pingone/pingone-rule-select-connection.png differ diff --git a/docs/images/platform/scim/pingone/pingone-rule-select-user-filter.png b/docs/images/platform/scim/pingone/pingone-rule-select-user-filter.png new file mode 100644 index 000000000..d40a951f0 Binary files /dev/null and b/docs/images/platform/scim/pingone/pingone-rule-select-user-filter.png differ diff --git a/docs/images/platform/scim/pingone/pingone-rule-user-filter.png b/docs/images/platform/scim/pingone/pingone-rule-user-filter.png new file mode 100644 index 000000000..3470f5678 Binary files /dev/null and b/docs/images/platform/scim/pingone/pingone-rule-user-filter.png differ diff --git a/docs/images/platform/scim/pingone/pingone-select-group.png b/docs/images/platform/scim/pingone/pingone-select-group.png new file mode 100644 index 000000000..4a234b3b1 Binary files /dev/null and b/docs/images/platform/scim/pingone/pingone-select-group.png differ