IdP Configuration - Azure

Prerequisites

• RBAC authorization for the Organization Team feature is enabled.

• RBAC user sync should be enabled for the Engine RBAC at SingleStore database level.

SCIM Provisioning in the SingleStore Helios Portal

Follow the instructions specified in SCIM User Provisioning.

Note: SingleStore recommends that you check out the logAllRequests attribute to facilitate debugging.

SCIM Provisioning in the Azure Portal

The following steps should be used to set up SCIM in the Azure portal. Refer Azure documentation for additional information.

1. If you do not have an existing application in Enterprise applications, then create one by selecting Create your own application, Non-Gallery.

2. API Endpoint and Secret:

   1. Use the API endpoint and secret from the Cloud Portal SCIM configuration in the Provisioning section.

   2. Ensure you add '/?aadOptscim062020' to the end of the URL. Refer: Known issues with SCIM for further details.

   3. Select Test Connection.

   4. Enable the Send an email notification when a failure occurs option for easier debugging.

   5. Save the setting, (In case the grayed out buttons do not go back to normal display after saving, refresh the page.)

3. Set up the SCIM attribute mapping in the Attribute Mappings section:

   1. SCIM User: Ensure the primary email ID is valid and current so that SingleStore can match to the correct user. SingleStore recommends mapping userPrincipalName to email. However, if userPrincipalName does not contain the primary email ID, then enter the correct primary email source according to your tenant setup.

   2. Remove all unsupported attributes from the SCIM User mapping. Retain only the following attribute mappings, and delete every other row in the Attribute Mappings section before saving:

      customappsso Attribute	Microsoft Entra ID Attribute
      userName	userPrincipalName
      active	Switch([IsSoftDeleted], , "False", "True", "True", "False")
      displayName	displayName
      title	jobTitle
      emails[type eq "work"].value	mail
      preferredLanguage	preferredLanguage
      name.givenName	givenName
      name.familyName	surname
      name.formatted	Join(" ", [givenName], [surname])
      externalId	mailNickname

      Any attribute row not in this list should be deleted from the Attribute Mappings section before saving.

   3. SCIM Group: Leave the default settings.

4. Test with Provision on demand.

   1. Add users/groups to the provision.

   2. Test adding a user to SingleStore. If adding a user syncs successfully, then the user should appear in the SingleStore Helios portal Users tab.

   3. Test other actions, such as delete.

5. If all the above tests are successful, you can turn on the provisioning. Use the provision log to check for any errors or issues.