SCIM Configuration with Entra ID (Azure AD)

[Owl-Tec]

Hi Everyone,

I need a hand figuring out Snipe-IT SCIM integration with Entra ID.

My environment:

• Snipe-IT is self-hosted within my server environment -> this instance of Snipe-IT is NOT publicly accessible
• I have a hybrid Active Directory environment syncing with Entra ID -> I know I can just use local LDAP to connect with Snipe-IT but I want to integrate the application with Entra ID instead.

Now the question is, in order for Snipe-IT to connect to Entra ID via SCIM what do I have to do to make that happen? Do I have to connect my on-premise environment to Azure via Azure VPN? Or can I use an Entra Application Proxy? I am assuming the issue I am going to run into is that because my instance is locally hosted and not externally accessible, Entra ID will be unable to connect to my instance via SCIM.

I am just throwing this out here as I am sure someone else has dealt with this issue before and I want to know what they did.

Thanks for the help.

[snipe]

because my instance is locally hosted and not externally accessible, Entra ID will be unable to connect to my instance via SCIM.

That's correct - you'd need to use some kind of VPN and/or make your Snipe-IT available to just the Entra IP address(es)

[Owl-Tec]

Update: I figured out a way to use SCIM with Entra ID with the Azure AD Connect Provisioning Agent (no VPN or external access required).

Once I am done creating a blog post, I'll upload the content here as well for others to see.

[kladderadeng]

@Owl-Tec
I am looking forward to see your solution. Thinking about implementing Snipe-IT too and would love to have Entra ID integrated :-)
Thank you very much for sharing your knowledge!

[Owl-Tec]

@Owl-Tec I am looking forward to see your solution. Thinking about implementing Snipe-IT too and would love to have Entra ID integrated :-) Thank you very much for sharing your knowledge!

I am still writing up my post but essentially what has to happen is that Snipe-IT and Entra ID has to be able to connect with each other so that requires either an Entra ID App Proxy or the use of Azure AD Connect Provisioning Agent (if you do not want to use an Azure VPN or publish your application externally). The App Proxy option is my first choice as then everything integrates within M365 and you can access the application externally.

[Owl-Tec]

Alright, I managed to finish my blog post outlining what I did:

• https://owltec.ca/Docker+Containers+%26+Applications/Snipe-IT/Connecting+an+internal+Snipe-IT+instance+to+Entra+ID+via+an+Entra+Application+Proxy+(for+SCIM%2C+SAML%2C+and+External+Access)

It is a verbose post but literally covers everything.

The TL;DR?

1. Deploy an internal Snipe-IT instance with a URL based on an external domain that exists within one's Entra ID tenant and make sure that same URL is properly referenced by an internal DNS record
2. Deploy an Entra Application Proxy via an Entra ID application
3. Configure Snipe-IT to work with the Entra Application Proxy
4. Configure Snipe-IT to work with SCIM
5. Configure Snipe-IT to work with SAML (for SSO)
6. ???
7. Profit!