From 600bee0832e76a1f2857c091f7064445b4378f10 Mon Sep 17 00:00:00 2001 From: Christopher Hakkaart Date: Mon, 20 Jul 2026 11:52:33 +1200 Subject: [PATCH 1/2] Add id scim provisioning section --- .../group-catalog/scim-entra-id.md | 36 +++++++++++++------ .../sso_troubleshooting.md | 4 +++ .../group-catalog/scim-entra-id.md | 34 ++++++++++++------ .../authentication.md | 4 +++ .../group-catalog/scim-entra-id.md | 34 ++++++++++++------ .../authentication.md | 4 +++ 6 files changed, 83 insertions(+), 33 deletions(-) diff --git a/platform-cloud/docs/sso/idp-delegation/group-catalog/scim-entra-id.md b/platform-cloud/docs/sso/idp-delegation/group-catalog/scim-entra-id.md index 427c11a3fe..d013600f9f 100644 --- a/platform-cloud/docs/sso/idp-delegation/group-catalog/scim-entra-id.md +++ b/platform-cloud/docs/sso/idp-delegation/group-catalog/scim-entra-id.md @@ -10,7 +10,7 @@ Configure Microsoft Entra ID (formerly Azure AD) to push your tenant's groups to :::info[**Prerequisites**]{#prerequisites} You need the following: -- An active [SSO connection](../../single-sign-on) for your organization with Entra ID as the IdP. +- An active [SSO connection](../../single-sign-on) for your organization with Entra ID as the IdP. SCIM provisioning requires a separate enterprise application that you create in this guide. - Organization owner access to your Platform organization. - Administrator access to your Entra ID tenant with permission to manage application provisioning. ::: @@ -27,19 +27,33 @@ To get Platform SCIM connection details: The bearer token grants write access to your group catalog. Store it in a secrets manager and rotate it on a schedule. To rotate, generate a new token in Seqera and update Entra ID's configuration. The previous token is revoked when the new token is issued. ::: +## Create a provisioning application + +:::caution +Entra ID does not support automatic provisioning on applications created through **App Registrations**. If your [SSO connection](../../single-sign-on) uses an application created that way, you cannot use it for SCIM. Its **Provisioning > Get started** button is disabled and Entra ID warns that out-of-the-box automatic provisioning is not supported. Create a separate non-gallery enterprise application for provisioning instead. Your existing SSO application continues to handle sign-in unchanged. +::: + +To create the provisioning application: + +1. In the Azure portal, open **Entra ID**, then **Enterprise applications**. +2. Select **New application**, then **Create your own application**. +3. Enter a name (for example, `Seqera SCIM provisioning`) and select **Integrate any other application you don't find in the gallery (Non-gallery)**. +4. Select **Create**. + +Use this application only for SCIM provisioning. Do not configure sign-on for it. + ## Enable provisioning in Entra ID To enable provisioning in Entra ID: -1. Sign in to the Azure portal and open **Entra ID**, then **Enterprise applications**. -2. Select the application that fronts your Platform SSO connection. -3. Open **Provisioning** and select **Get started**. -4. Set **Provisioning Mode** to **Automatic**. -5. Under **Admin Credentials**, provide: - - **Tenant URL**: The Platform SCIM endpoint URL from the previous section. - - **Secret Token**: The Platform bearer token from the previous section. -6. Select **Test Connection**. Entra ID should report success. -7. Select **Save**. +1. In **Enterprise applications**, select the provisioning application you created in the previous section. +2. Open **Provisioning** and select **Get started**. +3. Set **Provisioning Mode** to **Automatic**. +4. Under **Admin Credentials**, provide: + - **Tenant URL**: The Platform SCIM endpoint URL from [Get the Platform SCIM connection details](#get-the-platform-scim-connection-details). + - **Secret Token**: The Platform bearer token from the same section. +5. Select **Test Connection**. Entra ID should report success. +6. Select **Save**. ## Scope and start provisioning @@ -48,7 +62,7 @@ To scope and start provisioning: 1. With **Provisioning** still open, expand **Settings**. 2. Set **Scope** to **Sync only assigned users and groups**. 3. Save, then set **Provisioning Status** to **On**. -4. Return to the application's **Users and groups** tab and assign the groups you want Platform to receive. +4. Return to the provisioning application's **Users and groups** tab and assign the groups you want Platform to receive. Entra ID runs an initial cycle within minutes and then syncs incrementally every ~40 minutes. diff --git a/platform-cloud/docs/troubleshooting_and_faqs/sso_troubleshooting.md b/platform-cloud/docs/troubleshooting_and_faqs/sso_troubleshooting.md index b269b8d5da..c17afc5403 100644 --- a/platform-cloud/docs/troubleshooting_and_faqs/sso_troubleshooting.md +++ b/platform-cloud/docs/troubleshooting_and_faqs/sso_troubleshooting.md @@ -34,6 +34,10 @@ If Seqera can't link an existing account to the SSO identity, the user should co ## IdP group provisioning (SCIM) +#### The Get started button under Provisioning is disabled (Entra ID) + +The application was created through **App Registrations**, which doesn't support automatic provisioning. Create a separate non-gallery enterprise application for SCIM. See [Create a provisioning application](../sso/idp-delegation/group-catalog/scim-entra-id#create-a-provisioning-application). + #### Groups appear in the IdP but not in Seqera Confirm the bearer token configured in your IdP matches the latest token that Seqera issued. If you generated a new token after configuring the IdP, the previous token is revoked. diff --git a/platform-enterprise_docs/enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id.md b/platform-enterprise_docs/enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id.md index ced553407f..d84498241a 100644 --- a/platform-enterprise_docs/enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id.md +++ b/platform-enterprise_docs/enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id.md @@ -10,7 +10,7 @@ Configure Microsoft Entra ID (formerly Azure AD) to push your tenant's groups to :::info[**Prerequisites**]{#prerequisites} You will need the following to get started: -- An Entra ID enterprise application configured as your Platform SSO connection. See [Entra ID authentication](../../oidc). +- An Entra ID application registration configured as your Platform SSO connection. See [Entra ID authentication](../../oidc). SCIM provisioning requires a separate enterprise application that you create in this guide. - Organization owner access to your Platform organization. - Administrator access to your Entra ID tenant with permission to manage application provisioning. ::: @@ -25,24 +25,36 @@ You will need the following to get started: The bearer token grants write access to your group catalog. Store it in a secrets manager and rotate it on a schedule. To rotate, generate a new token in Seqera and update Entra ID's configuration. The previous token is revoked when the new token is issued. ::: +## Create a provisioning application + +:::caution +Entra ID does not support automatic provisioning on applications created through **App Registrations**. You cannot use the SSO application you created in [Entra ID authentication](../../oidc) for SCIM. Its **Provisioning > Get started** button is disabled and Entra ID warns that out-of-the-box automatic provisioning is not supported. Create a separate non-gallery enterprise application for provisioning instead. Your existing SSO application registration continues to handle sign-in unchanged. +::: + +1. In the Azure portal, open **Entra ID**, then **Enterprise applications**. +2. Select **New application**, then **Create your own application**. +3. Enter a name (for example, `Seqera SCIM provisioning`) and select **Integrate any other application you don't find in the gallery (Non-gallery)**. +4. Select **Create**. + +Use this application only for SCIM provisioning. Do not configure sign-on for it. + ## Enable provisioning in Entra ID -1. Sign in to the Azure portal and open **Entra ID**, then **Enterprise applications**. -2. Select the application that fronts your Platform SSO connection. -3. Open **Provisioning** and select **Get started**. -4. Set **Provisioning Mode** to **Automatic**. -5. Under **Admin Credentials**, provide: - - **Tenant URL**: The Platform SCIM endpoint URL from the previous section. - - **Secret Token**: The Platform bearer token from the previous section. -6. Select **Test Connection**. Entra ID should report success. -7. Select **Save**. +1. In **Enterprise applications**, select the provisioning application you created in the previous section. +2. Open **Provisioning** and select **Get started**. +3. Set **Provisioning Mode** to **Automatic**. +4. Under **Admin Credentials**, provide: + - **Tenant URL**: The Platform SCIM endpoint URL from [Get the Platform SCIM connection details](#get-the-platform-scim-connection-details). + - **Secret Token**: The Platform bearer token from the same section. +5. Select **Test Connection**. Entra ID should report success. +6. Select **Save**. ## Scope and start provisioning 1. With **Provisioning** still open, expand **Settings**. 2. Set **Scope** to **Sync only assigned users and groups**. 3. Save, then set **Provisioning Status** to **On**. -4. Return to the application's **Users and groups** tab and assign the groups you want Platform to receive. +4. Return to the provisioning application's **Users and groups** tab and assign the groups you want Platform to receive. Entra ID runs an initial cycle within minutes and then syncs incrementally every ~40 minutes. diff --git a/platform-enterprise_docs/troubleshooting_and_faqs/authentication.md b/platform-enterprise_docs/troubleshooting_and_faqs/authentication.md index b2e3ae98a5..0599e8ed18 100644 --- a/platform-enterprise_docs/troubleshooting_and_faqs/authentication.md +++ b/platform-enterprise_docs/troubleshooting_and_faqs/authentication.md @@ -12,6 +12,10 @@ When configuring authentication for Seqera Platform, you might encounter the fol These issues apply to SCIM group provisioning with [Okta](../enterprise/configuration/authentication/idp-delegation/group-catalog/scim-okta) and [Entra ID](../enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id). +#### The Get started button under Provisioning is disabled in Entra ID + +This issue occurs when the application was created through **App Registrations**, which doesn't support automatic provisioning. To resolve, create a separate non-gallery enterprise application for SCIM. See [Create a provisioning application](../enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id#create-a-provisioning-application). + #### Groups appear in the identity provider but not in Platform This issue occurs when the bearer token configured in your identity provider doesn't match the current Platform token. Generating a new token in Platform revokes the previous one. To resolve, confirm the token in your identity provider matches the current Platform token, and replace it if necessary. diff --git a/platform-enterprise_versioned_docs/version-26.1/enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id.md b/platform-enterprise_versioned_docs/version-26.1/enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id.md index ced553407f..d84498241a 100644 --- a/platform-enterprise_versioned_docs/version-26.1/enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id.md +++ b/platform-enterprise_versioned_docs/version-26.1/enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id.md @@ -10,7 +10,7 @@ Configure Microsoft Entra ID (formerly Azure AD) to push your tenant's groups to :::info[**Prerequisites**]{#prerequisites} You will need the following to get started: -- An Entra ID enterprise application configured as your Platform SSO connection. See [Entra ID authentication](../../oidc). +- An Entra ID application registration configured as your Platform SSO connection. See [Entra ID authentication](../../oidc). SCIM provisioning requires a separate enterprise application that you create in this guide. - Organization owner access to your Platform organization. - Administrator access to your Entra ID tenant with permission to manage application provisioning. ::: @@ -25,24 +25,36 @@ You will need the following to get started: The bearer token grants write access to your group catalog. Store it in a secrets manager and rotate it on a schedule. To rotate, generate a new token in Seqera and update Entra ID's configuration. The previous token is revoked when the new token is issued. ::: +## Create a provisioning application + +:::caution +Entra ID does not support automatic provisioning on applications created through **App Registrations**. You cannot use the SSO application you created in [Entra ID authentication](../../oidc) for SCIM. Its **Provisioning > Get started** button is disabled and Entra ID warns that out-of-the-box automatic provisioning is not supported. Create a separate non-gallery enterprise application for provisioning instead. Your existing SSO application registration continues to handle sign-in unchanged. +::: + +1. In the Azure portal, open **Entra ID**, then **Enterprise applications**. +2. Select **New application**, then **Create your own application**. +3. Enter a name (for example, `Seqera SCIM provisioning`) and select **Integrate any other application you don't find in the gallery (Non-gallery)**. +4. Select **Create**. + +Use this application only for SCIM provisioning. Do not configure sign-on for it. + ## Enable provisioning in Entra ID -1. Sign in to the Azure portal and open **Entra ID**, then **Enterprise applications**. -2. Select the application that fronts your Platform SSO connection. -3. Open **Provisioning** and select **Get started**. -4. Set **Provisioning Mode** to **Automatic**. -5. Under **Admin Credentials**, provide: - - **Tenant URL**: The Platform SCIM endpoint URL from the previous section. - - **Secret Token**: The Platform bearer token from the previous section. -6. Select **Test Connection**. Entra ID should report success. -7. Select **Save**. +1. In **Enterprise applications**, select the provisioning application you created in the previous section. +2. Open **Provisioning** and select **Get started**. +3. Set **Provisioning Mode** to **Automatic**. +4. Under **Admin Credentials**, provide: + - **Tenant URL**: The Platform SCIM endpoint URL from [Get the Platform SCIM connection details](#get-the-platform-scim-connection-details). + - **Secret Token**: The Platform bearer token from the same section. +5. Select **Test Connection**. Entra ID should report success. +6. Select **Save**. ## Scope and start provisioning 1. With **Provisioning** still open, expand **Settings**. 2. Set **Scope** to **Sync only assigned users and groups**. 3. Save, then set **Provisioning Status** to **On**. -4. Return to the application's **Users and groups** tab and assign the groups you want Platform to receive. +4. Return to the provisioning application's **Users and groups** tab and assign the groups you want Platform to receive. Entra ID runs an initial cycle within minutes and then syncs incrementally every ~40 minutes. diff --git a/platform-enterprise_versioned_docs/version-26.1/troubleshooting_and_faqs/authentication.md b/platform-enterprise_versioned_docs/version-26.1/troubleshooting_and_faqs/authentication.md index 67fd6f47eb..127974a804 100644 --- a/platform-enterprise_versioned_docs/version-26.1/troubleshooting_and_faqs/authentication.md +++ b/platform-enterprise_versioned_docs/version-26.1/troubleshooting_and_faqs/authentication.md @@ -12,6 +12,10 @@ When configuring authentication for Seqera Platform, you might encounter the fol These issues apply to SCIM group provisioning with [Okta](../enterprise/configuration/authentication/idp-delegation/group-catalog/scim-okta) and [Entra ID](../enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id). +#### The Get started button under Provisioning is disabled in Entra ID + +This issue occurs when the application was created through **App Registrations**, which doesn't support automatic provisioning. To resolve, create a separate non-gallery enterprise application for SCIM. See [Create a provisioning application](../enterprise/configuration/authentication/idp-delegation/group-catalog/scim-entra-id#create-a-provisioning-application). + #### Groups appear in the identity provider but not in Platform This issue occurs when the bearer token configured in your identity provider doesn't match the current Platform token. Generating a new token in Platform revokes the previous one. To resolve, confirm the token in your identity provider matches the current Platform token, and replace it if necessary. From bcdbae21582697117c47912d8e471d0b9c1c7def Mon Sep 17 00:00:00 2001 From: Christopher Hakkaart Date: Mon, 20 Jul 2026 12:10:04 +1200 Subject: [PATCH 2/2] Remove trailing whitespace in version-26.1 sidebars Co-Authored-By: Claude Fable 5 --- .../version-26.1-sidebars.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/platform-enterprise_versioned_sidebars/version-26.1-sidebars.json b/platform-enterprise_versioned_sidebars/version-26.1-sidebars.json index 98b42fe971..e4b13dfc06 100644 --- a/platform-enterprise_versioned_sidebars/version-26.1-sidebars.json +++ b/platform-enterprise_versioned_sidebars/version-26.1-sidebars.json @@ -319,7 +319,7 @@ "studios/managing", "studios/connect" ] - }, + }, { "type": "category", "label": "Administration",