[release-12.0.1] Docs: Update the guide on how to configure SCIM with okta (#105402)

Co-authored-by: Mihai Doarna <mihai.doarna@grafana.com>
This commit is contained in:
Irene Rodríguez
2025-05-14 08:27:11 -05:00
committed by GitHub
co-authored by Mihai Doarna
parent 908a5c8afb
commit e1a378434b
@@ -37,15 +37,15 @@ Before configuring SCIM with Okta, ensure you have:
- Grafana Enterprise or Grafana Cloud Advanced
- Admin access to both Grafana and Okta
- [SAML authentication configured with Okta](../../configure-authentication/saml/#set-up-saml-with-okta)
- [SAML authentication configured with Okta](../../configure-authentication/saml/configure-saml-with-okta/)
- SCIM feature enabled in Grafana
{{< admonition type="note" >}}
**Important SAML and SCIM Configuration:**
When using SAML for authentication alongside SCIM provisioning with Okta, it is crucial to correctly align user identifiers.
For detailed information on why this is critical for security and how to configure it, refer to the main [SCIM provisioning documentation (../\_index.md#critical-aligning-saml-user-id-with-scim-externalid)](../_index.md#critical-aligning-saml-user-id-with-scim-externalid).
For detailed information on why this is critical for security and how to configure it, refer to the main [SCIM provisioning documentation](../).
Ensure your Okta SAML application is configured to send a stable, unique identifier (that will map to the Grafana SCIM `externalId`) as a SAML claim. Then, configure the Grafana SAML settings to use this claim. For general Okta SAML setup, refer to [Set up SAML with Okta](../../configure-authentication/saml/#set-up-saml-with-okta).
Ensure your Okta SAML application is configured to send a stable, unique identifier (that will map to the Grafana SCIM `externalId`) as a SAML claim. Then, configure the Grafana SAML settings to use this claim. For general Okta SAML setup, refer to [Set up SAML with Okta](../../configure-authentication/saml/configure-saml-with-okta/).
{{< /admonition >}}
## Configure SCIM in Grafana
@@ -54,9 +54,10 @@ To enable SCIM provisioning in Grafana, create a service account and generate an
### Create a service account
1. Navigate to **Administration > User Access > Service accounts**
2. Click **Add new service account**
3. Create a new access token and save it securely
1. Navigate to **Administration > Users and access > Service accounts**
2. Click **Add service account**
3. Create a new service account with Admin role
4. Create a new token for the newly created service account and save it securely
- This token will be used in the Okta configuration
## Configure SCIM in Okta
@@ -71,35 +72,40 @@ Configure both SAML authentication and SCIM provisioning in Okta to enable autom
### Configure provisioning settings
In the **To App** tab, enable:
- Create Users
- Update User Attributes
- Deactivate Users
To enable user provisioning through SCIM, configure the SCIM integration settings in Grafana by specifying the connector URL, authentication mode, and supported provisioning actions. Follow these steps to complete the integration.
### Configure SCIM integration
In the **Integration** tab, configure:
- **SCIM Connector base URL:**
```
https://{your-grafana-domain}/apis/scim.grafana.app/v0alpha1/namespaces/stacks-{stack-id}
```
Replace `{your-grafana-domain}` with your Grafana instance's domain (e.g., `your-stack.grafana.net` for Grafana Cloud or `grafana.yourcompany.com` for self-hosted instances). Replace `{stack-id}` with your Grafana Cloud stack ID.
- For Grafana Cloud instances:
```
https://{stack-name}.grafana.net/apis/scim.grafana.app/v0alpha1/namespaces/stacks-{stack-id}
```
Replace `{stack-name}` and `{stack-id}` with your Grafana Cloud stack name and ID.
- For self-hosted instances:
```
https://{your-grafana-domain}/apis/scim.grafana.app/v0alpha1/namespaces/default
```
Replace `{your-grafana-domain}` with your Grafana instance's domain (e.g., `grafana.yourcompany.com`).
- **Unique identifier field:** userName
- **Supported provisioning actions:**
- Import New Users and Profile Updates
- Push New Users
- Push Profile Updates
- **Authentication Mode:** HTTP Header
- **Authorization:** Bearer {your-grafana-service-account-token}
- Click **Test Connector Configuration** and then save the configuration
## Test the integration
In the **To App** tab, enable:
- Create Users
- Update User Attributes
- Deactivate Users
After completing the configuration:
1. Test the SCIM connector in Okta
2. Assign a test user to the application
3. Verify the user is provisioned in Grafana
## Troubleshooting
For common issues and solutions when working with SCIM provisioning, refer to the [SCIM troubleshooting guide](../troubleshooting/).