SCIM User Provisioning on Confluent Cloud

System for Cross-domain Identity Management (SCIM) user provisioning is an industry-standard protocol that automates the exchange of user identity information between your identity provider (IdP) and Confluent Cloud. With SCIM, your IdP becomes the single source of truth for Confluent Cloud user accounts, automating provisioning and de-provisioning.

Note

SCIM-based user provisioning is generally available with the Advanced Security add-on. To enable the add-on, an OrganizationAdmin must turn it on for your organization.

The Advanced Security add-on is a Limited Availability feature in Confluent Cloud. For details about included capabilities, limits, and billing, see Advanced Security add-on for Confluent Cloud.

When you add, update, or deactivate a user in your IdP, Confluent Cloud syncs the change on a schedule determined by your IdP. This reduces administrative overhead and helps you meet security and compliance requirements by ensuring that former employees no longer have access to Confluent Cloud after you remove them from your IdP.

SCIM syncs the following user attributes from your IdP to Confluent Cloud:

• Email address

• Name

Important

When SCIM user provisioning is enabled, SCIM takes precedence for managing single sign-on (SSO) user accounts, and you can no longer invite SSO users from Confluent Cloud. Provision all new SSO user accounts through your IdP.

Enabling SCIM does not automatically turn off just-in-time (JIT) user provisioning. If both are enabled, a user who signs in with SSO can still be provisioned through JIT. To make your IdP the sole source of new SSO user accounts, turn off JIT user provisioning. For more information, see Disable JIT user provisioning.

How SCIM syncs users

Enable SCIM for your SSO identity provider and configure the connection in your IdP. Confluent Cloud manages user accounts through the SCIM protocol based on actions in your IdP:

• When you assign a user to the Confluent Cloud application in your IdP, Confluent Cloud provisions a matching single sign-on user account.

• When you update a user’s first or last name in the Confluent Cloud application in your IdP, Confluent Cloud syncs the updated name to the corresponding user account.

• When you deactivate or remove a user from the Confluent Cloud application in your IdP, Confluent Cloud de-provisions the corresponding user account.

Local user accounts are not affected by SCIM. You can still create and manage local users in Confluent Cloud.

Prerequisites

• The Advanced Security add-on is turned on for your Confluent Cloud organization.

• SSO is set up for your Confluent Cloud organization. The SCIM option is not available until SSO is configured. For more information, see Enable SAML SSO on Confluent Cloud.

• At least one trusted domain is verified for your Confluent Cloud organization. Verifying a domain mitigates the risk of user impersonation. SCIM user provisioning and de-provisioning operations require the user’s email domain to be verified.

• Only users granted the OrganizationAdmin role can enable SCIM and manage SCIM tokens.

• An IdP that supports SCIM 2.0, such as Okta or Microsoft Entra ID.

  Note

  Some IdPs, such as Google Workspace, support SCIM 2.0 only for a curated list of third-party applications in their application catalog. Okta and Microsoft Entra ID are tested with Confluent Cloud SCIM provisioning.

Enable SCIM and generate a SCIM token

A SCIM token authenticates your IdP requests to the Confluent Cloud SCIM endpoints. To connect your IdP to Confluent Cloud, enable SCIM for your SSO identity provider and generate a SCIM token.

1. In the Confluent Cloud Console, go to the Single sign-on page at https://confluent.cloud/sso, or select Single sign-on in the navigation menu.

2. With SSO enabled, turn on the SCIM toggle for your SSO identity provider.

3. Generate a SCIM token and set an expiration time for the token.

   The default expiration is six months. The minimum expiration is one month, and the maximum expiration is two years.

4. Copy the SCIM token and the SCIM base URL.

   The SCIM base URL uses the following format, where <sso_identifier> is the identifier for your organization:

   https://api.confluent.cloud/scim/v2/sso/<sso_identifier>
   

   The SCIM base URL is the same for every SCIM token in your organization.

   Important

   The SCIM token is shown only once when it is generated. Copy and store it in a secure location. If you lose the token, delete it and generate a new one.

5. After you generate the SCIM token, provide the token and the SCIM base URL to the administrator who configures SCIM provisioning in your IdP. To configure SCIM in your IdP, refer to the documentation for your IdP:

   • Okta

   • Microsoft Entra ID

   Confluent Cloud uses the userName attribute as the unique identifier for SCIM users. When you configure SCIM in your IdP, make sure that userName maps to the email address that you want to use for the Confluent Cloud user account:

   Okta

   In Okta, update your SCIM connection settings:

   1. For the Unique identifier field for users, type in “email”.

   2. Enable Push New Users and Push Profile Updates.

   3. Set the Authorization Mode to HTTP Header.

   4. Enter the authentication token from your SCIM token file.

   5. Test and save your connector configuration.

   Microsoft Entra ID

   In Microsoft Entra ID, update your SCIM connection settings:

   1. Select your Confluent Cloud application, and then select Manage > Provisioning > Connect your application.

   2. Select Bearer authentication as your authentication method.

   3. For your Tenant URL, enter the base URL from your SCIM token file.

   4. For your Secret token, enter the authentication token from your SCIM token file.

   5. Test and save your connector configuration.

   Important

   SCIM can only provision users whose email domain is verified as a trusted domain for your Confluent Cloud organization.

   If your provisioning attempt fails with a Forbidden error, verify the user’s email is correct and that the domain is verified for your Confluent Cloud organization. For more information, see Manage Trusted Domains on Confluent Cloud.

   Verify the attribute mapping in the provisioning settings of your IdP so that the Confluent Cloud userName attribute maps to the user’s email or mail attribute. After you update the mapping, retry provisioning.

Rotate and delete SCIM tokens

Confluent Cloud notifies you by email before a SCIM token expires so that you can rotate the token before it expires and avoid disruption to SCIM provisioning.

You can have up to two active SCIM tokens at a time.

To rotate a SCIM token without disrupting provisioning:

1. Generate a second SCIM token. For more information, see Enable SCIM.

2. Update the token in your IdP configuration.

3. Delete your old SCIM token on the Single sign-on page in the Confluent Cloud Console.

After you delete a token, any IdP configured to use that token can no longer authenticate to the Confluent Cloud SCIM endpoints.

Disable SCIM

If you disable SCIM, Confluent Cloud revokes all active SCIM tokens and stops your IdP from provisioning or de-provisioning Confluent Cloud user accounts through SCIM. Confluent Cloud does not remove existing user accounts when you turn off SCIM.

1. In the Confluent Cloud Console, go to the Single sign-on page at https://confluent.cloud/sso, or select Single sign-on in the navigation menu.

2. Turn off the SCIM toggle for your SSO identity provider.

Because SCIM depends on SSO, turning off SSO for your organization also stops SCIM provisioning and revokes all active SCIM tokens.

Limitations

• SCIM requires the Advanced Security add-on, SSO, and at least one verified trusted domain.

• When SCIM is enabled, you cannot invite new SSO users from Confluent Cloud. Local user accounts are not affected.

• Enabling SCIM does not turn off JIT user provisioning. If both are enabled, users can still be provisioned at first SSO sign-in.

• SCIM does not support group membership synchronization. SCIM syncs user provisioning and de-provisioning only.