Skip to content

Commit 559259b

Browse files
dcpenadcpena
committed
Split out SCIM provisioning
1 parent fbe7b94 commit 559259b

File tree

3 files changed

+120
-116
lines changed

3 files changed

+120
-116
lines changed

‎src/content/docs/fundamentals/setup/account/account-security/scim-setup.mdx‎ renamed to ‎src/content/docs/fundamentals/setup/account/account-security/scim-provisioning/entra.mdx‎

Lines changed: 17 additions & 116 deletions
Original file line numberDiff line numberDiff line change
@@ -1,126 +1,27 @@
11
---
22
pcx_content_type: how-to
3-
title: Dashboard SCIM provisioning
4-
updated: 2024-12-04
5-
6-
---
7-
8-
Cloudflare supports bulk provisioning of users into the Cloudflare dashboard by using the System for Cross-domain Identity Management (SCIM) protocol. This allows you to connect your external identity provider (IdP) to Cloudflare and quickly onboard and manage users and their permissions. Cloudflare supports SCIM onboarding with Okta and Microsoft Entra.
9-
10-
:::note
11-
This section covers SCIM provisioning for the Cloudflare dashboard only. If you need to provision SCIM for Cloudflare Zero Trust, refer to [Zero Trust SCIM provisioning](/cloudflare-one/identity/users/scim/).
12-
:::
13-
14-
## Limitations
15-
16-
- If a user is the only Super Administrator on an Enterprise account, they will not be deprovisioned.
17-
- Cloudflare currently only supports [Account-scoped Roles](/fundamentals/setup/manage-members/roles/#account-scoped-roles) and does not support Domain-scoped Roles provisioning via SCIM.
18-
- Cloudflare does not allow custom user groups.
19-
20-
## Prerequisites
21-
22-
- Cloudflare provisioning with SCIM is only available to Enterprise customers using Okta or Microsoft Entra ID.
23-
- You must be a [Super Administrator](/fundamentals/setup/manage-members/roles/) on the account.
24-
- In your identity provider, you must have the ability to create applications and groups.
25-
26-
---
27-
## Gather the required data
28-
29-
To start, you will need to collect a couple of pieces of data from Cloudflare and set these aside for later use.
30-
31-
### Get your Account ID
32-
33-
34-
1. In the [Cloudflare dashboard](https://dash.cloudflare.com/), go to the Cloudflare account that you want to configure for SCIM provisioning.
35-
2. Copy your account ID from the account home page.
36-
37-
### Create an API token
38-
39-
1. [Create an API token](/fundamentals/api/get-started/create-token/) with the following permissions:
40-
41-
| Type | Item | Permission |
42-
| ------- | ----------------- | ---------- |
43-
| Account | SCIM Provisioning | Edit |
44-
45-
:::note
46-
47-
Cloudflare recommends using Account Owned API Tokens for SCIM Provisioning. Using user-specific API tokens, while supported, will lead to a broken SCIM connection in the event that the user's policies are revoked from the account with the SCIM integration. Learn more about [account owned tokens](/fundamentals/api/get-started/account-owned-tokens/).
48-
:::
49-
50-
2. Select **Continue to summary**.
51-
52-
3. Validate the permissions and select **Create Token**.
53-
54-
4. Copy the token value.
55-
3+
title: Provision with Microsoft Entra
4+
sidebar:
5+
label: Microsoft Entra
566
---
577

58-
## Provision with Okta
59-
60-
### Set up your Okta SCIM application
61-
62-
1. In the Okta dashboard, go to **Applications** > **Applications**.
63-
2. Select **Browse App Catalog**.
64-
3. Locate and select **SCIM 2.0 Test App (OAuth Bearer Token)**.
65-
4. Select **Add Integration** and name your integration.
66-
5. Enable the following options:
67-
68-
* **Do not display application icon to users**
69-
* **Do not display application icon in the Okta Mobile App**
70-
71-
6. Disable **Automatically log in when user lands on login page**.
72-
7. Select **Next**, then select **Done**.
73-
74-
### Integrate the Cloudflare API
75-
76-
:::note
77-
The **Update User Attributes** option is not supported.
78-
:::
79-
80-
1. In your integration page, go to **Provisioning** > **Configure API Integration**.
81-
2. Enable **Enable API Integration**.
82-
3. In SCIM 2.0 Base URL, enter: `https://api.cloudflare.com/client/v4/accounts/<accountID>/scim/v2`, substituting `accountID` for your [Cloudflare Account ID](/fundamentals/setup/account/account-security/scim-setup/#get-your-account-id).
83-
4. In the **OAuth Bearer Token** field, enter your API token value.
84-
5. Deselect **Import Groups**.
85-
86-
87-
### Set up your SCIM users and groups
88-
89-
1. In **Provisioning to App**, select **Edit**.
90-
2. Enable **Create Users** and **Deactivate Users**. Select **Save**.
91-
3. Select **Done**.
92-
4. In the Assignments tab, add the users you want to synchronize with Cloudflare Dash. You can add users in batches by assigning a group. If a user is removed from the application assignment via either direct user assignment or removed from the group that was assigned to the app, this will trigger a deprovisioning event from Okta to Cloudflare.
93-
5. In the Push Groups tab, add the Okta groups you want to synchronize with Cloudflare Dash. You can view these groups in the dash under Manage Account > Manage members > Members > User Groups.
94-
95-
:::note
96-
You must have opted into the Cloudflare User Groups Public Beta to synchronize groups from Okta to Cloudflare. Refer to the [User Groups](/fundamentals/setup/manage-members/user-groups/) documentation for more information.
97-
:::
98-
99-
To verify the integration, select **View Logs** in the Okta SCIM application, and check the Cloudflare Dash Audit Logs by navigating to **Manage Account** > **Audit Log**.
100-
101-
To grant permissions to Users & Groups in Cloudflare, refer to the Permission Policies guide.
102-
103-
This will provision all of the users in the group(s) affected to your Cloudflare account with "minimal account access."
104-
105-
## Provision with Microsoft Entra ID
106-
107-
### Set up the Microsoft Entra ID Enterprise application
8+
## Set up the Enterprise application
1089

10910
1. Go to your Microsoft Entra ID instance and select **Enterprise Applications**.
11011
2. Select **Create your own application** and name your application.
11112
3. Select **Integrate any other application you do not find in the gallery (Non-gallery)**.
11213
4. Select **Create**.
11314

114-
### Provision the Microsoft Entra ID Enterprise application
15+
## Provision the Enterprise application
11516

11617
1. Under **Manage** on the sidebar menu, select **Provisioning**.
11718
2. Select **Automatic** on the dropdown menu for the Provisioning Mode.
11819
3. Enter your API token value and the tenant URL: `https://api.cloudflare.com/client/v4/accounts/<your_account_ID>/scim/v2`.
11920
4. Select **Test Connection**, then select **Save**.
12021

121-
### Configure user permissions in Microsoft Entra ID
22+
## Configure user permissions in Microsoft Entra ID
12223

123-
1. Once the SCIM application is created, [assign users and groups to the application](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/assign-user-or-group-access-portal?pivots=portal.)
24+
1. Once the SCIM application is created, [assign users and groups to the application](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/assign-user-or-group-access-portal?pivots=portal).
12425

12526
:::note
12627
You must have opted into the Cloudflare User Groups Public Beta to synchronize groups from Okta to Cloudflare. Refer to the [User Groups](/fundamentals/setup/manage-members/user-groups/) documentation for more information.
@@ -139,13 +40,13 @@ To successfully provision with Microsoft Entra ID, the `user principal name` and
13940
5. To grant permissions to Users & Groups in Cloudflare, refer to the Permission Policies guide.
14041

14142

142-
### Automate Cloudflare's SCIM integration
43+
## (Optional) Automate Cloudflare's SCIM integration
14344

14445
Cloudflare's SCIM integration requires one external application per account. Customers with many accounts may want to automate part of the setup to save time and reduce the amount of time spent in the Entra administrative UI.
14546

14647
The initial setup of creating the non-gallery applications and adding the provisioning URL and API key are scriptable via API, but the rest of the setup is dependent on your specific need and IDP configuration.
14748

148-
1. Get an access token
49+
**1. Get an access token**
14950

15051
Get an Entra access token. Note that the example below is using the Azure CLI.
15152

@@ -156,7 +57,7 @@ az account get-access-token --resource https://graph.microsoft.com
15657
15758
(payload with accessToken returned)
15859
```
159-
2. Create a new application via template.
60+
**2. Create a new application via template.**
16061

16162
The template ID 8adf8e6e-67b2-4cf2-a259-e3dc5476c621 is the suggested template to create non-gallery apps in the Entra docs. Replace `<accessToken>` and `displayName` with your values.
16263

@@ -193,7 +94,7 @@ curl -X POST 'https://graph.microsoft.com/v1.0/applicationTemplates/8adf8e6e-67b
19394
}
19495
```
19596

196-
3. Create a provisioning job
97+
**3. Create a provisioning job**
19798

19899
To enable provisioning, you will also need to create a job. Note the SERVICE_PRINCIPAL_ID in the previous request will be used in the request below. The SCIM templateId is an Entra provided template.
199100

@@ -219,7 +120,7 @@ curl -X POST 'https://graph.microsoft.com/v1.0/servicePrincipals/<SERVICE_PRINCI
219120
// ... snipped rest of JSON payload
220121
```
221122

222-
4. Configure the SCIM provisioning URL and API token
123+
**4. Configure the SCIM provisioning URL and API token**
223124

224125
Next, configure the Tenant URL (Cloudflare SCIM endpoint) and API token (SCIM Provisioning API Token).
225126

@@ -252,10 +153,10 @@ After completing the tasks above, the next steps in Entra include:
252153

253154
Expectations for user lifecycle management with SCIM:
254155

255-
| Expected Cloudflare dash behavior | Identity provider action |
256-
| ---------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
257-
| User is added to account as member | Assign the user to a SCIM application. They will be assigned the Minimal Account Access role so that their dash experience is not broken. |
258-
| User is removed from account as member | Unassign the user from the SCIM application. |
156+
| Expected Cloudflare dash behavior | Identity provider action |
157+
| ---------------------------------------------- |-------------------------------|
158+
| User is added to account as member | Assign the user to a SCIM application. They will be assigned the Minimal Account Access role so that their dash experience is not broken. |
159+
| User is removed from account as member | Unassign the user from the SCIM application. |
259160
| Add role to user | Add the user to a group in the IdP which is pushed via SCIM. They must also be assigned to the SCIM application and exist as an account member. |
260-
| Remove role from user | Remove the user from the corresponding group in the IdP. |
161+
| Remove role from user | Remove the user from the corresponding group in the IdP. |
261162
| Retain user in account but with no permissions | Remove the user from all role groups but leave them assigned to the SCIM application. They will be an account member with only the role Minimal Account Access. |

‎src/content/docs/fundamentals/setup/account/account-security/scim-provisioning/index.mdx‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
pcx_content_type: how-to
3+
title: Dashboard SCIM provisioning
4+
updated: 2024-12-04
5+
6+
---
7+
8+
Cloudflare supports bulk provisioning of users into the Cloudflare dashboard by using the System for Cross-domain Identity Management (SCIM) protocol. This allows you to connect your external identity provider (IdP) to Cloudflare and quickly onboard and manage users and their permissions. Cloudflare supports SCIM onboarding with Okta and Microsoft Entra.
9+
10+
:::note
11+
This section covers SCIM provisioning for the Cloudflare dashboard only. If you need to provision SCIM for Cloudflare Zero Trust, refer to [Zero Trust SCIM provisioning](/cloudflare-one/identity/users/scim/).
12+
:::
13+
14+
## Limitations
15+
16+
- If a user is the only Super Administrator on an Enterprise account, they will not be deprovisioned.
17+
- Cloudflare currently only supports [Account-scoped Roles](/fundamentals/setup/manage-members/roles/#account-scoped-roles) and does not support Domain-scoped Roles provisioning via SCIM.
18+
- Cloudflare does not allow custom user groups.
19+
20+
## Prerequisites
21+
22+
- Cloudflare provisioning with SCIM is only available to Enterprise customers using Okta or Microsoft Entra ID.
23+
- You must be a [Super Administrator](/fundamentals/setup/manage-members/roles/) on the account.
24+
- In your identity provider, you must have the ability to create applications and groups.
25+
26+
---
27+
## Gather the required data
28+
29+
To start, you will need to collect a couple of pieces of data from Cloudflare and set these aside for later use.
30+
31+
### Get your Account ID
32+
33+
34+
1. In the [Cloudflare dashboard](https://dash.cloudflare.com/), go to the Cloudflare account that you want to configure for SCIM provisioning.
35+
2. Copy your account ID from the account home page.
36+
37+
### Create an API token
38+
39+
1. [Create an API token](/fundamentals/api/get-started/create-token/) with the following permissions:
40+
41+
| Type | Item | Permission |
42+
| ------- | ----------------- | ---------- |
43+
| Account | SCIM Provisioning | Edit |
44+
45+
:::note
46+
47+
Cloudflare recommends using Account Owned API Tokens for SCIM Provisioning. Using user-specific API tokens, while supported, will lead to a broken SCIM connection in the event that the user's policies are revoked from the account with the SCIM integration. Learn more about [account owned tokens](/fundamentals/api/get-started/account-owned-tokens/).
48+
:::
49+
50+
2. Select **Continue to summary**.
51+
52+
3. Validate the permissions and select **Create Token**.
53+
54+
4. Copy the token value.

‎src/content/docs/fundamentals/setup/account/account-security/scim-provisioning/okta.mdx‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
---
2+
pcx_content_type: how-to
3+
title: Provision with Okta
4+
sidebar:
5+
label: Okta
6+
---
7+
8+
## Set up your Okta SCIM application
9+
10+
1. In the Okta dashboard, go to **Applications** > **Applications**.
11+
2. Select **Browse App Catalog**.
12+
3. Locate and select **SCIM 2.0 Test App (OAuth Bearer Token)**.
13+
4. Select **Add Integration** and name your integration.
14+
5. Enable the following options:
15+
* **Do not display application icon to users**
16+
* **Do not display application icon in the Okta Mobile App**
17+
6. Disable **Automatically log in when user lands on login page**.
18+
7. Select **Next**, then select **Done**.
19+
20+
## Integrate the Cloudflare API
21+
22+
:::note
23+
The **Update User Attributes** option is not supported.
24+
:::
25+
26+
1. In your integration page, go to **Provisioning** > **Configure API Integration**.
27+
2. Enable **Enable API Integration**.
28+
3. In SCIM 2.0 Base URL, enter: `https://api.cloudflare.com/client/v4/accounts/<accountID>/scim/v2`, substituting `accountID` for your [Cloudflare Account ID](/fundamentals/setup/account/account-security/scim-setup/#get-your-account-id).
29+
4. In the **OAuth Bearer Token** field, enter your API token value.
30+
5. Deselect **Import Groups**.
31+
32+
33+
## Set up your SCIM users and groups
34+
35+
1. In **Provisioning to App**, select **Edit**.
36+
2. Enable **Create Users** and **Deactivate Users**. Select **Save**.
37+
3. Select **Done**.
38+
4. In the Assignments tab, add the users you want to synchronize with Cloudflare Dash. You can add users in batches by assigning a group. If a user is removed from the application assignment via either direct user assignment or removed from the group that was assigned to the app, this will trigger a deprovisioning event from Okta to Cloudflare.
39+
5. In the Push Groups tab, add the Okta groups you want to synchronize with Cloudflare Dash. You can view these groups in the dash under Manage Account > Manage members > Members > User Groups.
40+
41+
:::note
42+
You must have opted into the Cloudflare User Groups Public Beta to synchronize groups from Okta to Cloudflare. Refer to the [User Groups](/fundamentals/setup/manage-members/user-groups/) documentation for more information.
43+
:::
44+
45+
To verify the integration, select **View Logs** in the Okta SCIM application, and check the Cloudflare Dash Audit Logs by navigating to **Manage Account** > **Audit Log**.
46+
47+
To grant permissions to Users & Groups in Cloudflare, refer to the Permission Policies guide.
48+
49+
This will provision all of the users in the group(s) affected to your Cloudflare account with "minimal account access."

0 commit comments

Comments
 (0)