github.com/treeverse/lakefs@v1.24.1-0.20240520134607-95648127bfb0/docs/howto/scim.md (about)

     1  ---
     2  title: System for Cross-domain Identity Management (SCIM)
     3  description: Use SCIM to automatically provision users/groups in lakeFS via your identity provider (IdP)
     4  parent: How-To
     5  redirect_from:
     6    - /cloud/scim.html
     7  ---
     8  
     9  # System for Cross-domain Identity Management (SCIM)
    10  {: .d-inline-block }
    11  lakeFS Cloud
    12  {: .label .label-green }
    13  
    14  lakeFS Cloud includes an [SCIM v2.0](https://datatracker.ietf.org/doc/html/rfc7644) compliant server, which can integrate with SCIM clients (IdPs) to automate provisioning/de-provisioning of users and groups.  
    15  
    16  {% include toc.html %}
    17  
    18  ## Officially Supported Clients (IdPs), Capabilities, and Limitations
    19  
    20  ### Supported Clients (IdPs)
    21  
    22  Currently, the lakeFS Cloud SCIM server has been tested and validated with [Entra ID](https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-id) (a.k.a Azure AD). However, with SCIM v2.0 being an accepted standard, any SCIM-compliant IdP should be able to integrate with lakeFS Cloud.
    23  
    24  ### Capabilities
    25  
    26  ### User Provisioning
    27  
    28  - **Create users:** Users and members of groups assigned to the application will be provisioned in lakeFS Cloud
    29  - **Update user attributes:** Changes to supported user attributes are synced to lakeFS Cloud
    30  - **Deactivate users:** Deactivating a user or removing their assignment to the application will disable them in lakeFS Cloud
    31  - **User adoption:** Users that are already found in lakeFS Cloud will be "adopted" by the IdP and not re-created
    32  
    33  ### Group Provisioning
    34  
    35  - **Create groups:** Groups assigned to the application are created in lakeFS Cloud and any group user members are created and added to the group in lakeFS Cloud
    36  - **Update group name:** When a synced group is renamed in the IdP, it will be renamed in lakeFS Cloud
    37  - **Add/remove members:** When members are added/removed from an assigned group, they will be added/removed from the group in lakeFS Cloud
    38  - **Group adoption:** Groups that already exist in lakeFS Cloud will be "adopted" by the IdP and not re-created
    39  
    40  ### User Attributes and Consent
    41  
    42  The lakeFS Cloud SCIM server requires the minimum set of user attributes required for provisioning. The required attributes are a sub-set of the basic user profile, which is exchanged during federated authentication/SSO login. User consent is requested by the IdP upon first login to lakeFS Cloud.
    43  
    44  ### Known Limitations
    45  
    46  - User and group policies can only be managed in lakeFS  
    47    This means groups and users newly created via SCIM only have basic read permissions. The lakeFS UI or API must be used to attach policies to those users and groups. However, if a user is created and added to an existing group with an attached policy, that user will receive the permissions allowed by the policy attached to the group.
    48  - Only direct group memberships are provisioned via SCIM  
    49    Both Okta and Entra ID only support syncing direct group membership via SCIM. This means that if you assign a group to the application, only its user members will be provisioned via SCIM. SCIM provisioning will not cascade to member groups and their members, and so forth.
    50  
    51  ## Enabling SCIM in lakeFS Cloud
    52  
    53  To enable SCIM support in lakeFS Cloud, you need to log into the cloud admin. In the cloud admin, SCIM settings are under **Access > Settings**. SCIM is not enabled by default, so to enable SCIM for the organization, click the **Setup Provisioning** Button.
    54  
    55  ![lakeFS Cloud SCIM Settings]({{ site.baseurl }}/assets/img/scim/lakefs_cloud_scim_settings.png)
    56  
    57  Clicking the button will enable SCIM for the organization and provide the details you'll need to set up your IdP to work with lakeFS Cloud SCIM.
    58  
    59  ![lakeFS Cloud SCIM Configuration]({{ site.baseurl }}/assets/img/scim/lakefs_cloud_scim_configuration.png)
    60  
    61  To set up your IdP, you'll need the lakeFS Cloud SCIM provisioning endpoint and you'll also need to generate an integration token. When creating a new integration token, you can optionally provide a description for future reference.
    62  
    63  {: .note}
    64  > **Note:** The token value is only presented once, right after creation. Make sure to copy the token, as its value isn't stored and cannot be retrieved after the initial creation.
    65  
    66  ## Setting Up SCIM Provisioning in Entra ID (a.k.a Azure AD)
    67  
    68  {: .note}
    69  > **Note:** This guide assumes you've already set up an Entra ID enterprise application for federated authentication to lakeFS Cloud.
    70  
    71  In the Entra ID admin dashboard, go to **Enterprise Applications** and choose the lakeFS Cloud enterprise application from the list. Then click **Provisioning** in the sidebar and then **Get Started**.
    72  
    73  1. In the provisioning settings set mode to **Automatic**
    74  2. In **Tenant URL** enter the URL from the lakeFS Cloud provisioning settings
    75  3. In **Secret Token** paste the token you copied in the previous step. If you haven't created a token yet, you may do so now
    76  4. Click **Test Connection**
    77  5. If the test fails, please ensure you've entered the correct SCIM endpoint URL from lakeFS Cloud and copied the token correctly. Otherwise, click "Save" at the top of the settings panel
    78  
    79  {: .note}
    80  > **Note:** lakeFS Cloud is designed to work with the default attribute mapping for users and groups provided by Entra ID.
    81  > If your organization has customized the user and/or group entities in Entra ID, you might want to set mappings in accordance with those.
    82  > You can find details of how this is done in the [Entra ID documentation](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/customize-application-attributes).  
    83  > Incorrectly modifying these mappings can break provisioning functionality, so it's advised to do so cautiously and only when necessary.