Ignite supports user provisioning using the SCIM standard. This enables customers to sync users and roles between Azure AD and Ignite using Azure as the source of truth. More information from Microsoft about user provisioning in azure can be found here: What is app provisioning in Azure Active Directory?
This guide walks you through the steps of manually setting up user provisioning from Azure AD to Ignite.
1. Log into your company’s Azure account.
⚠️ Note: You need to be an Azure admin in order to do the following steps.
1.1 Create a new Application in Azure AD
Browse to Azure Active Directory > Enterprise applications.
Select + New application > + Create your own application.
Enter a fitting name ("Ignite SCIM Provisioning" e.g.) for your application, choose the option "integrate any other application you don't find in the gallery" and select Add to create an app object. The new app is added to the list of enterprise applications and opens to its app management screen.
In the new enterprise application, select Provisioning.
Select Get started.
Select Automatic for the provisioning mode.
1.2 Generate or grab an API Token from Ignite
Note: You will need to be an Admin on your Ignite workspace to complete this step.
In Ignite navigate to Settings -> API Tokens.
Create a new API token - you will need to have the Admin role to complete this step.
Copy the API token.
1.3 Enter Admin Credential in the Azure Application
Navigate back to the azure portal window. Under "Admin Credentials":
Paste the API token from Ignite into the "secret token" field in Azure.
In the "tenant url" field enter: https://authsidecar.igniteprocurement.com/api/v1/scim/v2?aadOptscim062020
Click "Test Connection"
Save
1.4 Set up Azure Mapping
Open the Mapping tab.
Click "provision azure active directory groups" and toggle enabled to "no"
save
Click "Provision Azure Active Directory Users"
Toggle "Show advanced options"
"Edit attribute list for customappsso"
Add "roles" to the list with the following values:
type=string
required=true
multi-value=true
for the attribute "active" set: required=true
Exit the attribute list
click "Add new mapping"
set mapping type to "expression"
in expression field enter "AppRoleAssignmentsComplex([appRoleAssignments])"
Create a new mapping from objectId to externalId
Your attribute mapping should look like this. Make sure to delete the mappings not in the screenshot:
In azure navigate to app registrations and the app registration with the same name as the enterprise application you created earlier. In the left sidbar navigate to "app roles" and create the following roles:
Navigate back to the enterprise application "ignite scim provisioning" and add users with roles.
Click "start provisioning"
Users and roles will now be synced between Azure and Ignite every 40 minutes.
The provisioning can be tested by provisioning user manually by clicking: "provision on demand"