mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-11 00:28:49 +00:00
42 lines
1.9 KiB
Plaintext
42 lines
1.9 KiB
Plaintext
---
|
|
title: "SCIM Overview"
|
|
description: "Learn how to provision users for Infisical via SCIM."
|
|
---
|
|
|
|
<Note>
|
|
SCIM provisioning can only be enabled when either SAML or OIDC is setup for
|
|
the organization.
|
|
</Note>
|
|
<Info>
|
|
SCIM provisioning is a paid feature. If you're using Infisical Cloud, then it
|
|
is available under the **Enterprise Tier**. If you're self-hosting Infisical,
|
|
then you should contact [email protected] to purchase an enterprise license
|
|
to use it.
|
|
</Info>
|
|
|
|
You can configure your organization in Infisical to have users and user groups be provisioned/deprovisioned using [SCIM](https://scim.cloud/#Implementations2) via providers like Okta, Azure, JumpCloud, etc.
|
|
|
|
- Provisioning: The SCIM provider pushes user information to Infisical. If the user exists in Infisical, Infisical sends an email invitation to add them to the relevant organization in Infisical; if not, Infisical initializes a new user and sends them an email invitation to finish setting up their account in the organization.
|
|
- Deprovisioning: The SCIM provider instructs Infisical to remove user(s) from an organization in Infisical.
|
|
|
|
SCIM providers:
|
|
|
|
- [Okta SCIM](/documentation/platform/scim/okta)
|
|
- [Azure SCIM](/documentation/platform/scim/azure)
|
|
- [JumpCloud SCIM](/documentation/platform/scim/jumpcloud)
|
|
|
|
**FAQ**
|
|
|
|
<AccordionGroup>
|
|
<Accordion title="Why do SCIM-provisioned users have to finish setting up their account?">
|
|
Infisical's SCIM implementation accounts for retaining the end-to-end
|
|
encrypted architecture of Infisical because we decouple the
|
|
**authentication** and **decryption** steps in the platform. For this
|
|
reason, SCIM-provisioned users are initialized but must finish setting up
|
|
their account when logging in the first time by creating a master
|
|
encryption/decryption key. With this implementation, IdPs and SCIM providers
|
|
cannot and will not have access to the decryption key needed to decrypt your
|
|
secrets.
|
|
</Accordion>
|
|
</AccordionGroup>
|