diff --git a/platform-cloud/docs/sso/idp-delegation/group-catalog/scim-entra-id.md b/platform-cloud/docs/sso/idp-delegation/group-catalog/scim-entra-id.md index 427c11a3f..d013600f9 100644 --- a/platform-cloud/docs/sso/idp-delegation/group-catalog/scim-entra-id.md +++ b/platform-cloud/docs/sso/idp-delegation/group-catalog/scim-entra-id.md @@ -10,7 +10,7 @@ Configure Microsoft Entra ID (formerly Azure AD) to push your tenant's groups to :::info[**Prerequisites**]{#prerequisites} You need the following: -- An active [SSO connection](../../single-sign-on) for your organization with Entra ID as the IdP. +- An active [SSO connection](../../single-sign-on) for your organization with Entra ID as the IdP. SCIM provisioning requires a separate enterprise application that you create in this guide. - Organization owner access to your Platform organization. - Administrator access to your Entra ID tenant with permission to manage application provisioning. ::: @@ -27,19 +27,33 @@ To get Platform SCIM connection details: The bearer token grants write access to your group catalog. Store it in a secrets manager and rotate it on a schedule. To rotate, generate a new token in Seqera and update Entra ID's configuration. The previous token is revoked when the new token is issued. ::: +## Create a provisioning application + +:::caution +Entra ID does not support automatic provisioning on applications created through **App Registrations**. If your [SSO connection](../../single-sign-on) uses an application created that way, you cannot use it for SCIM. Its **Provisioning > Get started** button is disabled and Entra ID warns that out-of-the-box automatic provisioning is not supported. Create a separate non-gallery enterprise application for provisioning instead. Your existing SSO application continues to handle sign-in unchanged. +::: + +To create the provisioning application: + +1. In the Azure portal, open **Entra ID**, then **Enterprise applications**. +2. Select **New application**, then **Create your own application**. +3. Enter a name (for example, `Seqera SCIM provisioning`) and select **Integrate any other application you don't find in the gallery (Non-gallery)**. +4. Select **Create**. + +Use this application only for SCIM provisioning. Do not configure sign-on for it. + ## Enable provisioning in Entra ID To enable provisioning in Entra ID: -1. Sign in to the Azure portal and open **Entra ID**, then **Enterprise applications**. -2. Select the application that fronts your Platform SSO connection. -3. Open **Provisioning** and select **Get started**. -4. Set **Provisioning Mode** to **Automatic**. -5. Under **Admin Credentials**, provide: - - **Tenant URL**: The Platform SCIM endpoint URL from the previous section. - - **Secret Token**: The Platform bearer token from the previous section. -6. Select **Test Connection**. Entra ID should report success. -7. Select **Save**. +1. In **Enterprise applications**, select the provisioning application you created in the previous section. +2. Open **Provisioning** and select **Get started**. +3. Set **Provisioning Mode** to **Automatic**. +4. Under **Admin Credentials**, provide: + - **Tenant URL**: The Platform SCIM endpoint URL from [Get the Platform SCIM connection details](#get-the-platform-scim-connection-details). + - **Secret Token**: The Platform bearer token from the same section. +5. Select **Test Connection**. Entra ID should report success. +6. Select **Save**. ## Scope and start provisioning @@ -48,7 +62,7 @@ To scope and start provisioning: 1. With **Provisioning** still open, expand **Settings**. 2. Set **Scope** to **Sync only assigned users and groups**. 3. Save, then set **Provisioning Status** to **On**. -4. Return to the application's **Users and groups** tab and assign the groups you want Platform to receive. +4. Return to the provisioning application's **Users and groups** tab and assign the groups you want Platform to receive. Entra ID runs an initial cycle within minutes and then syncs incrementally every ~40 minutes. diff --git a/platform-cloud/docs/troubleshooting_and_faqs/sso_troubleshooting.md b/platform-cloud/docs/troubleshooting_and_faqs/sso_troubleshooting.md index 9fd4f42f3..45e54c183 100644 --- a/platform-cloud/docs/troubleshooting_and_faqs/sso_troubleshooting.md +++ b/platform-cloud/docs/troubleshooting_and_faqs/sso_troubleshooting.md @@ -44,6 +44,10 @@ If Seqera can't link an existing account to the SSO identity, the user should co ## IdP group provisioning (SCIM) +#### The Get started button under Provisioning is disabled (Entra ID) + +The application was created through **App Registrations**, which doesn't support automatic provisioning. Create a separate non-gallery enterprise application for SCIM. See [Create a provisioning application](../sso/idp-delegation/group-catalog/scim-entra-id#create-a-provisioning-application). + #### Groups appear in the IdP but not in Seqera Confirm the bearer token configured in your IdP matches the latest token that Seqera issued. If you generated a new token after configuring the IdP, the previous token is revoked. diff --git a/platform-enterprise_docs/enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id.md b/platform-enterprise_docs/enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id.md index ced553407..d84498241 100644 --- a/platform-enterprise_docs/enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id.md +++ b/platform-enterprise_docs/enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id.md @@ -10,7 +10,7 @@ Configure Microsoft Entra ID (formerly Azure AD) to push your tenant's groups to :::info[**Prerequisites**]{#prerequisites} You will need the following to get started: -- An Entra ID enterprise application configured as your Platform SSO connection. See [Entra ID authentication](../../oidc). +- An Entra ID application registration configured as your Platform SSO connection. See [Entra ID authentication](../../oidc). SCIM provisioning requires a separate enterprise application that you create in this guide. - Organization owner access to your Platform organization. - Administrator access to your Entra ID tenant with permission to manage application provisioning. ::: @@ -25,24 +25,36 @@ You will need the following to get started: The bearer token grants write access to your group catalog. Store it in a secrets manager and rotate it on a schedule. To rotate, generate a new token in Seqera and update Entra ID's configuration. The previous token is revoked when the new token is issued. ::: +## Create a provisioning application + +:::caution +Entra ID does not support automatic provisioning on applications created through **App Registrations**. You cannot use the SSO application you created in [Entra ID authentication](../../oidc) for SCIM. Its **Provisioning > Get started** button is disabled and Entra ID warns that out-of-the-box automatic provisioning is not supported. Create a separate non-gallery enterprise application for provisioning instead. Your existing SSO application registration continues to handle sign-in unchanged. +::: + +1. In the Azure portal, open **Entra ID**, then **Enterprise applications**. +2. Select **New application**, then **Create your own application**. +3. Enter a name (for example, `Seqera SCIM provisioning`) and select **Integrate any other application you don't find in the gallery (Non-gallery)**. +4. Select **Create**. + +Use this application only for SCIM provisioning. Do not configure sign-on for it. + ## Enable provisioning in Entra ID -1. Sign in to the Azure portal and open **Entra ID**, then **Enterprise applications**. -2. Select the application that fronts your Platform SSO connection. -3. Open **Provisioning** and select **Get started**. -4. Set **Provisioning Mode** to **Automatic**. -5. Under **Admin Credentials**, provide: - - **Tenant URL**: The Platform SCIM endpoint URL from the previous section. - - **Secret Token**: The Platform bearer token from the previous section. -6. Select **Test Connection**. Entra ID should report success. -7. Select **Save**. +1. In **Enterprise applications**, select the provisioning application you created in the previous section. +2. Open **Provisioning** and select **Get started**. +3. Set **Provisioning Mode** to **Automatic**. +4. Under **Admin Credentials**, provide: + - **Tenant URL**: The Platform SCIM endpoint URL from [Get the Platform SCIM connection details](#get-the-platform-scim-connection-details). + - **Secret Token**: The Platform bearer token from the same section. +5. Select **Test Connection**. Entra ID should report success. +6. Select **Save**. ## Scope and start provisioning 1. With **Provisioning** still open, expand **Settings**. 2. Set **Scope** to **Sync only assigned users and groups**. 3. Save, then set **Provisioning Status** to **On**. -4. Return to the application's **Users and groups** tab and assign the groups you want Platform to receive. +4. Return to the provisioning application's **Users and groups** tab and assign the groups you want Platform to receive. Entra ID runs an initial cycle within minutes and then syncs incrementally every ~40 minutes. diff --git a/platform-enterprise_docs/troubleshooting_and_faqs/authentication.md b/platform-enterprise_docs/troubleshooting_and_faqs/authentication.md index b2e3ae98a..0599e8ed1 100644 --- a/platform-enterprise_docs/troubleshooting_and_faqs/authentication.md +++ b/platform-enterprise_docs/troubleshooting_and_faqs/authentication.md @@ -12,6 +12,10 @@ When configuring authentication for Seqera Platform, you might encounter the fol These issues apply to SCIM group provisioning with [Okta](../enterprise/configuration/authentication/idp-delegation/group-catalog/scim-okta) and [Entra ID](../enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id). +#### The Get started button under Provisioning is disabled in Entra ID + +This issue occurs when the application was created through **App Registrations**, which doesn't support automatic provisioning. To resolve, create a separate non-gallery enterprise application for SCIM. See [Create a provisioning application](../enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id#create-a-provisioning-application). + #### Groups appear in the identity provider but not in Platform This issue occurs when the bearer token configured in your identity provider doesn't match the current Platform token. Generating a new token in Platform revokes the previous one. To resolve, confirm the token in your identity provider matches the current Platform token, and replace it if necessary. diff --git a/platform-enterprise_versioned_docs/version-26.1/enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id.md b/platform-enterprise_versioned_docs/version-26.1/enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id.md index ced553407..d84498241 100644 --- a/platform-enterprise_versioned_docs/version-26.1/enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id.md +++ b/platform-enterprise_versioned_docs/version-26.1/enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id.md @@ -10,7 +10,7 @@ Configure Microsoft Entra ID (formerly Azure AD) to push your tenant's groups to :::info[**Prerequisites**]{#prerequisites} You will need the following to get started: -- An Entra ID enterprise application configured as your Platform SSO connection. See [Entra ID authentication](../../oidc). +- An Entra ID application registration configured as your Platform SSO connection. See [Entra ID authentication](../../oidc). SCIM provisioning requires a separate enterprise application that you create in this guide. - Organization owner access to your Platform organization. - Administrator access to your Entra ID tenant with permission to manage application provisioning. ::: @@ -25,24 +25,36 @@ You will need the following to get started: The bearer token grants write access to your group catalog. Store it in a secrets manager and rotate it on a schedule. To rotate, generate a new token in Seqera and update Entra ID's configuration. The previous token is revoked when the new token is issued. ::: +## Create a provisioning application + +:::caution +Entra ID does not support automatic provisioning on applications created through **App Registrations**. You cannot use the SSO application you created in [Entra ID authentication](../../oidc) for SCIM. Its **Provisioning > Get started** button is disabled and Entra ID warns that out-of-the-box automatic provisioning is not supported. Create a separate non-gallery enterprise application for provisioning instead. Your existing SSO application registration continues to handle sign-in unchanged. +::: + +1. In the Azure portal, open **Entra ID**, then **Enterprise applications**. +2. Select **New application**, then **Create your own application**. +3. Enter a name (for example, `Seqera SCIM provisioning`) and select **Integrate any other application you don't find in the gallery (Non-gallery)**. +4. Select **Create**. + +Use this application only for SCIM provisioning. Do not configure sign-on for it. + ## Enable provisioning in Entra ID -1. Sign in to the Azure portal and open **Entra ID**, then **Enterprise applications**. -2. Select the application that fronts your Platform SSO connection. -3. Open **Provisioning** and select **Get started**. -4. Set **Provisioning Mode** to **Automatic**. -5. Under **Admin Credentials**, provide: - - **Tenant URL**: The Platform SCIM endpoint URL from the previous section. - - **Secret Token**: The Platform bearer token from the previous section. -6. Select **Test Connection**. Entra ID should report success. -7. Select **Save**. +1. In **Enterprise applications**, select the provisioning application you created in the previous section. +2. Open **Provisioning** and select **Get started**. +3. Set **Provisioning Mode** to **Automatic**. +4. Under **Admin Credentials**, provide: + - **Tenant URL**: The Platform SCIM endpoint URL from [Get the Platform SCIM connection details](#get-the-platform-scim-connection-details). + - **Secret Token**: The Platform bearer token from the same section. +5. Select **Test Connection**. Entra ID should report success. +6. Select **Save**. ## Scope and start provisioning 1. With **Provisioning** still open, expand **Settings**. 2. Set **Scope** to **Sync only assigned users and groups**. 3. Save, then set **Provisioning Status** to **On**. -4. Return to the application's **Users and groups** tab and assign the groups you want Platform to receive. +4. Return to the provisioning application's **Users and groups** tab and assign the groups you want Platform to receive. Entra ID runs an initial cycle within minutes and then syncs incrementally every ~40 minutes. diff --git a/platform-enterprise_versioned_docs/version-26.1/troubleshooting_and_faqs/authentication.md b/platform-enterprise_versioned_docs/version-26.1/troubleshooting_and_faqs/authentication.md index 67fd6f47e..127974a80 100644 --- a/platform-enterprise_versioned_docs/version-26.1/troubleshooting_and_faqs/authentication.md +++ b/platform-enterprise_versioned_docs/version-26.1/troubleshooting_and_faqs/authentication.md @@ -12,6 +12,10 @@ When configuring authentication for Seqera Platform, you might encounter the fol These issues apply to SCIM group provisioning with [Okta](../enterprise/configuration/authentication/idp-delegation/group-catalog/scim-okta) and [Entra ID](../enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id). +#### The Get started button under Provisioning is disabled in Entra ID + +This issue occurs when the application was created through **App Registrations**, which doesn't support automatic provisioning. To resolve, create a separate non-gallery enterprise application for SCIM. See [Create a provisioning application](../enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id#create-a-provisioning-application). + #### Groups appear in the identity provider but not in Platform This issue occurs when the bearer token configured in your identity provider doesn't match the current Platform token. Generating a new token in Platform revokes the previous one. To resolve, confirm the token in your identity provider matches the current Platform token, and replace it if necessary.