mirror of
https://github.com/hanzoai/kms.git
synced 2026-10-17 11:18:16 +00:00
zeekay
0ebffbd529
- Fix 381 files where branding script corrupted variable names (e.g. isHanzo KMSTemplate -> isKmsTemplate) - Rebrand from "Hanzo KMS" to just "KMS" for white-label support (allows Lux KMS, Hanzo KMS, etc. via configuration) - 856 files, purely string replacements, no logic changes
150 lines
6.9 KiB
Plaintext
150 lines
6.9 KiB
Plaintext
---
|
|
title: "PingOne SCIM"
|
|
description: "Learn how to configure SCIM provisioning with PingOne for KMS."
|
|
---
|
|
|
|
<Info>
|
|
PingOne SCIM provisioning is a paid feature.
|
|
|
|
If you're using KMS Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting KMS,
|
|
then you should contact [email protected] to purchase a self-hosted license to use it.
|
|
</Info>
|
|
|
|
Prerequisites:
|
|
- [Configure PingOne OIDC for KMS](/documentation/platform/sso/pingone-oidc)
|
|
|
|
<Steps>
|
|
<Step title="Create a SCIM token in KMS">
|
|
In KMS, head to the **Single Sign-On (SSO)** page and select the **Provisioning** tab. Under SCIM Configuration,
|
|
press the **Enable SCIM provisioning** toggle to allow PingOne to provision/deprovision users for your organization.
|
|
|
|
|
|
|
|
Next, press **Manage SCIM Tokens** and then **Create** to generate a SCIM token for PingOne.
|
|
|
|
|
|
|
|
Next, copy the **SCIM URL** and **New SCIM Token** to use when configuring SCIM in PingOne.
|
|
|
|
|
|
</Step>
|
|
<Step title="Add Users and Groups in PingOne">
|
|
Inside your PingOne environment, navigate to Directory > Users. Add any users and/or groups to your application that you would like
|
|
to be provisioned over to KMS.
|
|
|
|
|
|
|
|
</Step>
|
|
<Step title="Configure SCIM Connection in PingOne">
|
|
|
|
**1. Create a new connection**
|
|
|
|
In PingOne, head to Integrations > Provisioning, and inside provisioning, press the **Connections** tab. Here you'll see a plus icon to add a new connection.
|
|
|
|
|
|
|
|
|
|
|
|
Select the "Identity Store" option.
|
|
|
|
|
|
|
|
|
|
Search for the "SCIM Outbound" option to start the configuration process for SCIM. Finally, press the **Next** button. Give the connection a name and optionally add a description.
|
|
|
|
**2. Configure the connection**
|
|
|
|
Once you have selected the SCIM Outbound option, you'll be prompted to enter the authentication details that PingOne will use to authenticate with KMS SCIM. This is the **SCIM URL** and **New SCIM Token** from the previous step.
|
|
|
|
|
|
|
|
Set the following fields:
|
|
- `SCIM BASE URL`: Input the **SCIM URL** from the previous step.
|
|
- `Users Resource`: Leave as default, `/Users`.
|
|
- `Groups Resource`: Leave as default, `/Groups`.
|
|
- `SCIM Version`: Leave as default, `2.0`.
|
|
- `Authentication Method`: Select `OAuth 2 Bearer Token`.
|
|
- `Oauth Access Token`: Input the **New SCIM Token** from step 1.
|
|
- `Auth Type Header`: Select `Bearer`.
|
|
|
|
Once this is done, you can press the **Test Connection** button to check that SCIM is configured properly. You should see a success message saying "Connection Successful".
|
|
If the connection is successful, press the "Next" button.
|
|
|
|
In the final step, you'll be prompted to configure the mappings for the connection.
|
|
|
|
Set the following fields:
|
|
- `User Filter Expression`: `email.value Eq "%s"`.
|
|
- `User Identifier`: `workEmail`.
|
|
- `Deprovision on Rule Deletion:` Enabled.
|
|
|
|
|
|
|
|
Once this is configured, press the "Save" button.
|
|
|
|
**3. Enable the connection**
|
|
|
|
Finally, remember to enable the connection by pressing the enable toggle.
|
|
|
|
|
|
</Step>
|
|
|
|
<Step title="Configure SCIM Provisioning in PingOne">
|
|
|
|
**1. Create a new rule**
|
|
|
|
After creating a connection, you can now access the "Rules" tab under the Provisioning section. Here you can configure the rules for the connection.
|
|
|
|
|
|
|
|
|
|
|
|
Select the "New Rule" button and choose a name for the rule, then press the "Create Rule" button.
|
|
|
|
**2. Configure the rule connection**
|
|
|
|
Once you have created a rule, you now need to configure the connection to use for the rule.
|
|
|
|
|
|
|
|
Select the connection you created in the previous step and press the "Save" button.
|
|
|
|
**3. Configure the rule user filter**
|
|
|
|
|
|
|
|
Select the Edit pencil icon to open the user filter configuration. This step dictates which users will be provisioned to KMS.
|
|
|
|
|
|
|
|
In this case, we are provisioning all users that are enabled in PingOne. Configure your user filter to match your desired users, and then press the "Save" button.
|
|
|
|
**4. Configure Groups**
|
|
|
|
This step is optional and only relevant if you want to provision PingOne groups to KMS.
|
|
|
|
|
|
|
|
Open the "Group Provisioning" tab and press the "Add Groups" button to select which groups will be provisioned to KMS.
|
|
|
|
|
|
|
|
Select the groups you want to provision to KMS and press the "Save" button.
|
|
|
|
**5. Enable the rule**
|
|
|
|
Once you have configured the rule, you can enable it by pressing the "Enable" toggle.
|
|
|
|
|
|
</Step>
|
|
</Steps>
|
|
|
|
**FAQ**
|
|
|
|
<AccordionGroup>
|
|
<Accordion title="Why do SCIM-provisioned users have to finish setting up their account?">
|
|
KMS's SCIM implementation accounts for retaining the end-to-end encrypted architecture of KMS because we decouple the **authentication** and **decryption** steps in the platform.
|
|
|
|
For this reason, SCIM-provisioned users are initialized but must finish setting up their account when logging in the first time by creating a master encryption/decryption key. With this implementation, IdPs and SCIM providers cannot and will not have access to the decryption key needed to decrypt your secrets.
|
|
</Accordion>
|
|
</AccordionGroup>
|