summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTristan Williams <twilliams@gitlab.com>2019-07-23 23:25:26 -0700
committerTristan Williams <twilliams@gitlab.com>2019-07-23 23:25:26 -0700
commit3f70d0ee06a0ae2d5556a9ce95618a2f9e4fbb48 (patch)
tree5e2d50dcfa9ef1d241d5cbcc712fd48dc29b13ac
parent09b21aabf14aafd0ed2a66026c9614e71ceaf755 (diff)
downloadgitlab-ce-3f70d0ee06a0ae2d5556a9ce95618a2f9e4fbb48.tar.gz
Expand on SCIM configure steps
-rw-r--r--doc/user/group/saml_sso/img/scim_attribute_mapping.pngbin95420 -> 113191 bytes
-rw-r--r--doc/user/group/saml_sso/img/scim_provisioning_status.pngbin0 -> 23006 bytes
-rw-r--r--doc/user/group/saml_sso/scim_setup.md25
3 files changed, 15 insertions, 10 deletions
diff --git a/doc/user/group/saml_sso/img/scim_attribute_mapping.png b/doc/user/group/saml_sso/img/scim_attribute_mapping.png
index c9f6b71f5b0..dad459d8c28 100644
--- a/doc/user/group/saml_sso/img/scim_attribute_mapping.png
+++ b/doc/user/group/saml_sso/img/scim_attribute_mapping.png
Binary files differ
diff --git a/doc/user/group/saml_sso/img/scim_provisioning_status.png b/doc/user/group/saml_sso/img/scim_provisioning_status.png
new file mode 100644
index 00000000000..4b8887b5418
--- /dev/null
+++ b/doc/user/group/saml_sso/img/scim_provisioning_status.png
Binary files differ
diff --git a/doc/user/group/saml_sso/scim_setup.md b/doc/user/group/saml_sso/scim_setup.md
index 8332ceb7290..779a76d88c1 100644
--- a/doc/user/group/saml_sso/scim_setup.md
+++ b/doc/user/group/saml_sso/scim_setup.md
@@ -76,22 +76,25 @@ During this configuration, note the following:
- It is recommended to set a notification email and check the **Send an email notification when a failure occurs** checkbox.
- For mappings, we will only leave `Synchronize Azure Active Directory Users to AppName` enabled.
-You can then test the connection clicking on `Test Connection`. If the connection is successful, be sure to save your configuration before moving on.
+You can then test the connection by clicking on `Test Connection`. If the connection is successful, be sure to save your configuration before moving on.
-#### Synchronize Active Directory users
+#### Configure attribute mapping
-1. Click on `Synchronize Azure Active Directory Users to AppName`, to configure
- the attribute mapping.
-1. Select the unique identifier (in the example `objectId`) as the `id` and `externalId`,
- and enable the `Create`, `Update`, and `Delete` actions.
-1. Map the `userPricipalName` to `emails[type eq "work"].value` and `mailNickname` to
- `userName`.
+1. Click on `Synchronize Azure Active Directory Users to AppName`, to configure the attribute mapping.
+1. Click **Delete** next to the `mail` mapping.
+1. Map `userPrincipalName` to `emails[type eq "work"].value` and change it's **Matching precedence** to `2`.
+1. Map `mailNickname` to `userName`.
+1. Create a new mapping by clicking **Add New Mapping** then set **Source attribute** to `objectId`, **Target attribute** to `id`, **Match objects using this attribute** to `Yes`, and **Matching precedence** to `1`.
+1. Create a new mapping by clicking **Add New Mapping** then set **Source attribute** to `objectId`, and **Target attribute** to `externalId`.
+1. Click the `userPrincipalName` mapping and change **Match objects using this attribute** to `No`.
- Example configuration:
+ You should end up with a configuration similar to the following:
![Azure's attribute mapping configuration](img/scim_attribute_mapping.png)
-1. Click on **Show advanced options > Edit attribute list for AppName**.
+ NOTE: **Note:** If you used a unique identifier **other than** `objectId`, be sure to map it instead to both `id` and `externalId`
+
+1. Below the mapping list click on **Show advanced options > Edit attribute list for AppName**.
1. Leave the `id` as the primary and only required field.
NOTE: **Note:**
@@ -103,6 +106,8 @@ You can then test the connection clicking on `Test Connection`. If the connectio
1. Save all the screens and, in the **Provisioning** step, set
the `Provisioning Status` to `ON`.
+ ![Provisioning status toggle switch](img/scim_provisioning_status.png)
+
NOTE: **Note:**
You can control what is actually synced by selecting the `Scope`. For example,
`Sync only assigned users and groups` will only sync the users assigned to