Authentication

SCIM

The System for Cross‑domain Identity Management (SCIM) specification is an open standard designed to manage user identity information. Cloudsmith is SCIM 2.0‑compliant.

With Cloudsmith’s support for SCIM, you can automatically provision new users, de‑provision existing users, and update user profile information based on changes within your identity provider (IdP).

Note

SCIM authentication is available and enabled by default for users on Ultra and Enterprise plans. To use SCIM with Cloudsmith, you must configure it in your IdP.

How it works

IdP groups map to Cloudsmith teams with the same name. If a team with the same name doesn’t exist, Cloudsmith creates it automatically during the next IdP sync.

When a user is added to or removed from a group in the IdP, Cloudsmith team membership updates automatically via SCIM.

Note

Configuring SCIM with Cloudsmith will remove members of a team who don't exist in the mapped IdP group.

Known limitation

SCIM groups do not currently support custom role mapping. There is no way to assign the Owner, Manager, or Collaborator workspace roles from the IdP group.

Cloudsmith assigns the Member role to users provisioned via SCIM groups. To assign a different role, manually update it from the Accounts tab of your workspace.

All SCIM integrations with Cloudsmith use:

• The Cloudsmith SCIM connector base URL: https://api.cloudsmith.io/scim/v2

• Basic authentication with the username token and a SCIM authentication token generated by Cloudsmith. For example:

  

• Email address as a unique user identifier.

  Unique user identifier

  When you configure your IdP, ensure that you use each user’s email address as their unique identifier.

  The following fields are mandatory:

  - email
  - givenName
  - familyName

Configure SCIM for your workspace

Prerequisites

To configure SCIM for your workspace, you must meet the following requirements:

• Your account must be on an Ultra or Enterprise plan.
• You must have the Owner role for your Cloudsmith workspace.
• At least one domain must be claimed in Cloudsmith for your workspace. To claim a domain or confirm that a domain has already been claimed for your workspace, reach out to our support team.
• You must have an IdP that supports SCIM 2.0.

Copy the SCIM authentication token for your workspace

Before you configure your IdP, you’ll need the SCIM authentication token for your workspace.

1. In the Cloudsmith web app, go to the workspace Settings tab, then select Authentication > SCIM.

2. On the SCIM page, confirm that SCIM functionality is enabled for the workspace.

   If SCIM is not enabled, click Allow SCIM.

3. Click the Copy button to copy the SCIM authentication token.

Configure your IdP for SCIM with Cloudsmith

Cloudsmith works with any generic SCIM 2.0‑compliant IdP. Steps to configure your IdP for SCIM with Cloudsmith vary from one provider to another.

See the following table for SCIM resources for some well-known providers:

If you need help configuring your IdP for SCIM with Cloudsmith, contact us.

Updated 2 weeks ago