Skip to Content
RigFabTech docs
Operate

User provisioning (SCIM)

Your identity provider provisions people and groups to one SCIM 2.0 endpoint that the base chart runs. Every product reads them from there, so you connect your provider once, not once per product.

The endpoint

  • Endpoint: https://scim.<domain>/scim/v2. directory.host changes scim.

  • Token: Secret rft-system/rft-directory, key scim-token:

    kubectl --namespace rft-system get secret rft-directory --output jsonpath='{.data.scim-token}' | base64 -d

  • Users: userName, externalId, displayName, name, emails and active. Other attributes are accepted and ignored.

  • Groups: displayName, externalId and members.

People and groups are kept as DirectoryUser and DirectoryGroup objects in rft-system, so they're backed up with the cluster. To list them:

kubectl get directoryusers --namespace rft-system

How products use the directory

  • Each product reads the directory with its own token, from Secret <product>-directory.
  • Products built on the platform's identity libraries check it when they sign someone in and every few minutes during the session. A person your provider deactivates (active: false) or deletes is signed out within minutes.
  • A deleted person is kept, marked deleted, so every product learns of it.
  • The products' tokens can read everyone in the directory. Rotating app-key in rft-directory replaces every product's token at once.

Microsoft Entra ID

Create the application

In the Microsoft Entra admin center, go to Enterprise applications > New application > Create your own application.

  • Name it, for example, RigFabTech platform provisioning.
  • Choose Integrate any other application you don't find in the gallery.

Connect it to the endpoint

Under Provisioning, set:

  • Provisioning Mode to Automatic
  • Tenant URL to https://scim.<domain>/scim/v2
  • Secret Token to the token

Then select Test Connection.

Map the object ID

Under Mappings, map objectId to externalId instead of mailNickname:

  • Provision Microsoft Entra ID Users: a product then finds a signed-in person by the oid claim of their token, which never changes.
  • Provision Microsoft Entra ID Groups: products that grant access by group then use that ID, so renaming a group doesn't change who has access.

Start provisioning

Under Users and groups, assign the people and groups to provision, then select Start provisioning.

Entra ID provisions every 40 minutes. Provision on demand pushes one person at once.

Network access

Entra ID's provisioning service calls the endpoint from the internet, from the address ranges of the AzureActiveDirectory service tag, over TLS 1.2. Your ingress must answer scim.<domain> there. You can allow only those ranges, for that host.

If nothing may reach the cluster from the internet, use the On-premises SCIM app instead:

  • Install the Microsoft Entra provisioning agent on a Windows Server inside your network.
  • The agent only connects out to Microsoft and calls the endpoint from inside.
  • It needs Entra ID P1.

Other providers

Any provider that speaks SCIM 2.0 (RFC 7644), such as Okta, OneLogin, JumpCloud or authentik, provisions to the same endpoint with the same token. RigFabTech tests the requests Microsoft documents for Entra ID. Tell support if another provider's requests are refused.

A provider without SCIM provisions no one. The products then know only the people who have signed in, and a disabled person keeps a product session until it ends.

Uninstall

Stop provisioning in your provider first. The directory's people and groups stay in rft-system with their CustomResourceDefinitions after the base chart is uninstalled. See Uninstall.

Next steps

  • Sign-in to assign roles and see how long sessions last.
  • Products to see what each product gets from the platform.