PurpleComputing/scim-examples
2
0
Fork 0
mirror of https://github.com/PurpleComputing/scim-examples.git synced 2026-09-17 09:10:39 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Documentation changes

Browse Source
This commit is contained in:
Duncan Stevenson-Price
2019-07-10 12:06:16 +01:00
parent 313c764dbb
commit 9ed6045515
4 changed files with 58 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
README.md
View File

@@ -5,7 +5,13 @@ Here you can find configuration files and best practice instructions for deployi
To streamline your setup, it is suggested to have Docker installed on your local machine.
### Deployments
### Specific Deployment Guides
The easiest way to deploy the SCIM bridge is with our one-click installation currently available for Google Cloud Platform. If you'd like to deploy to GCP [use this guide instead](https://support.1password.com/cs/scim-deploy-gcp/).
We also have specific, detailed instructions for deployments to Azure using the [Azure Kubernetes Service](https://support.1password.com/cs/scim-deploy-azure/).
### General Deployment Guides
To deploy on Kubernetes, read the [Kubernetes example](https://github.com/1Password/scim-examples/tree/master/kubernetes)

18
aws-terraform/README.md
View File

@@ -8,18 +8,18 @@ This example describes one of the simplest methods of deploying the 1Password SC
* Anonymous access is not supported. A bearer token and session file is required for authentication with the SCIM Bridge and the 1Password service.
* The session file is an encrypted file containing privileged 1Password account credentials. This file is created before the bridge application is deployed. The bearer token combined with the encrypted session file represent an authentication mechanism and must be treated extremely seriously in terms of security.
## Session file
## Prepare your 1Password Account
The session file must be generated prior to deploying and starting the endpoint service. You can generate the session file and bearer token using the [scim-setup.sh](https://github.com/1Password/scim-examples/tree/master/scim-setup.sh) script on administrator's local machine. This script uses a Docker container to run the `op-scim setup` command and writes the scimsession file back to your local machine using a mounted volume. Your bearer token will be printed to the console.
Consider using Secrets Manager to securely store and provision scimsession file during the application deployment.
Log in to your 1Password account [using this link](https://my.1password.com/scim/setup). It will take you to a hidden setup page for the SCIM bridge.
As an alternative, you can generate the session file and bearer token by running the 1Password SCIM Bridge binary in init mode:
```
op-scim setup
```
__Note:__ When prompted for user credentials by the `init` command, use the credentials for the provision manager user and __not__ an Owner or Administrator user.
Follow the on-screen instructions which will guide you through the following steps:
Init mode will guide the administrator through an interactive process which generates the encrypted session file and bearer token. Although strong encryption is used to secure the session file, prevent unauthorized access to it. Never store the session file in the same place as the bearer token. The bearer token will be required to configure the identity provider (Azure, Okta, etc) to authenticate your connection.
* Create a Provision Managers group
* Create and confirm a Provision Manager user
You can then download the `scimsession` file and save your bearer token. The `scimsession` file contains the credentials for the new Provision Manager user. This user will creates, confirms, and suspends users, and creates and manages access to groups. You should use an email address that is unique and not that of another user.
The bearer token and scimsession file combined can be used to sign in to your Provision Manager account. You’ll need to share the bearer token with your identity provider, but it’s important to **never share it with anyone else**. And never share your scimsession file with **anyone at all**.
## OP-SCIM Bridge

37
docker/README.md
View File

@@ -24,27 +24,28 @@ Install [Docker for Desktop](https://www.docker.com/products/docker-desktop) on
The 1Password SCIM bridge requires SSL/TLS in order to communicate with your IdP. In order to use TLS, you must create a DNS record that points to your Docker node. _Do not attempt to perform a provisioning sync before the DNS records have been propogated_. The DNS record must exist and the SCIM bridge server must be running if you wish to have LetsEncrypt automatically issue a TLS certificate for your SCIM bridge. _Please refer to your cloud provider on how to setup a DNS record if you do not have one set up already or are experiencing difficulties doing so._
## 4: Create your scimsession file and Deploy SCIM bridge
## 4: Prepare your 1Password Account
Log in to your 1Password account [using this link](https://my.1password.com/scim/setup). It will take you to a hidden setup page for the SCIM bridge.
Follow the on-screen instructions which will guide you through the following steps:
* Create a Provision Managers group
* Create and confirm a Provision Manager user
You can then download the `scimsession` file and save your bearer token. The `scimsession` file contains the credentials for the new Provision Manager user. This user will creates, confirms, and suspends users, and creates and manages access to groups. You should use an email address that is unique and not that of another user.
The bearer token and scimsession file combined can be used to sign in to your Provision Manager account. You’ll need to share the bearer token with your identity provider, but it’s important to **never share it with anyone else**. And never share your scimsession file with **anyone at all**.
You should move your newly created `scimsession` file into the `scim-examples` folder (the root folder of this repository which you cloned earlier).
## 5: Deploy SCIM bridge
1. Connect to your remote Docker host from your local machine
- Either connect using [docker-machine](https://docs.docker.com/machine/), OR use SSH to access your remote maching and clone this repo.
- Either connect using [docker-machine](https://docs.docker.com/machine/), OR use SSH to access your remote machine and clone this repo.
2. In your terminal, use the bash script [./scim-setup.sh](../session/scim-setup.sh) to authenticate your account and generate a `scimsession` file : This script uses a Docker container to run the `op-scim setup` command and writes the scimsession file back to your local machine using a mounted volume. Your bearer token will be printed to the console. **Save your bearer token, as it will be needed to authenticate with your IdP**.
_The scimsession file is equivalent to your Master Password and Secret Key when combined with the bearer token, therefore they should never be stored in the same place._
Example:
```
> cd [location of cloned scim-examples folder]
> ./scim-setup.sh
[interactive script]
Bearer token: jafewnqrrupcnoiqj0829fe209fnsoudbf02efsdo
> ./docker/deploy.sh
```
3. Once your scimsession file has been created, use the bash script `./docker/deploy.sh` to deploy the SCIM bridge. _Have the domain name indicated by the DNS record created for the SCIM bridge ready_. This script will do the following :
2. In your terminal, use the bash script [./docker/deploy.sh](deploy.sh) to deploy your SCIM bridge. If you cloned this repo on your remote machine using SSH, you should copy the `scimsession` file to the `scim-examples` folder on your server. _Have the domain name indicated by the DNS record created for the SCIM bridge ready_. This script will do the following:
1. Ask if you want to deploy with Docker Swarm or Compose

37
kubernetes/README.md
View File

@@ -2,6 +2,8 @@
This example explains how to deploy the 1Passwrd SCIM bridge on Kubernetes running on Google Cloud Platform, but the basic principles can be applied to any Kubernetes cluster.
If deploying to the Azure Kubernetes Service, you can refer to our [detailed deployment guide instead](https://support.1password.com/cs/scim-deploy-azure/).
## Create your DNS record
The 1Password SCIM bridge requires SSL/TLS in order to communicate with your IdP. You must create a DNS record that points to your Kubernetes load balancer. This is a chicken and egg problem, as we need the load balancer before we can create the record. Please follow all of the steps until the load balancer has been created, then create your DNS record, but _do not attempt to perform a provisioning sync before the DNS records have been propogated_. The record must exist and the SCIM Bridge server must be running in order for LetsEncrypt to issue a certificate.
@@ -18,25 +20,26 @@ kubectl apply -f redis-service.yaml
This will deploy a single redis instance listening on Kubernetes internal DNS `redis:6379`, which the SCIM Bridge will use for caching during operation. A redis instance is required when using the SCIM Bridge.
## Prepare your 1Password Account
Log in to your 1Password account [using this link](https://my.1password.com/scim/setup). It will take you to a hidden setup page for the SCIM bridge.
Follow the on-screen instructions which will guide you through the following steps:
* Create a Provision Managers group
* Create and confirm a Provision Manager user
You can then download the `scimsession` file and save your bearer token. The `scimsession` file contains the credentials for the new Provision Manager user. This user will creates, confirms, and suspends users, and creates and manages access to groups. You should use an email address that is unique and not that of another user.
The bearer token and scimsession file combined can be used to sign in to your Provision Manager account. You’ll need to share the bearer token with your identity provider, but it’s important to **never share it with anyone else**. And never share your scimsession file with **anyone at all**.
## Create your `scimsession` Kubernetes secret
Firstly, use the [scim-setup.sh](https://github.com/1Password/scim-examples/tree/master/scim-setup.sh) script on your local machine to set up your account and generate a `scimsession` file. This script uses a Docker container to run the `op-scim setup` command and writes the scimsession file back to your local machine using a mounted volume. Your bearer token will be printed to the console.
The scimsession file is equivalent to your account key and master password when combined with the bearer token, therefore they should never be stored in the same place.
Example:
```
scim-setup.sh
[account sign-in]
Bearer token: jafewnqrrupcnoiqj0829fe209fnsoudbf02efsdo
```
This script is an interactive setup of your 1Password account. It is reccomended to save the bearer token in 1Password within an account _other than the provision manager's_.
Next, we must create a Kubernetes secret containing the scimsession file. Using kubectl, we can read the scimsession file and create the secret in one command:
```
kubectl create secret generic scimsession --from-file=./scimsession
```
Make sure to pass the filepath of the scimsession file that was created by the `scim-setup.sh` script.
Make sure to pass the filepath of the scimsession file that you downloaded. The above command will look for the file in this folder (the `/kubernetes/` folder) of the repository.
## Deploy the SCIM bridge
@@ -58,6 +61,12 @@ NOTE: Port 80 on the load balancer is forwarded to :8080 on the SCIM Bridge, and
At this point you should create your DNS record using the external IP address of the load balancer and wait for it to propogate.
Once the record is propogated, you can test your instance by requesting `https://[your-domain]/scim/Users`, with the header `Authorization: Bearer [bearer token]` which should return a list of the users in your 1Password account.
Once the record is propogated, you can test your instance by requesting `https://[your-domain]/scim/Users`, with the header `Authorization: Bearer [bearer token]` which should return a list of the users in your 1Password account. You can do this with `curl` as follows:
```
curl --header "Authorization: Bearer <bearertoken>" https://<domain>/scim/Users
```
Alternatively, visit the domain you configured earlier. You'll see a 1Password SCIM Bridge Status page which can be used to verify your OAuth bearer token.
You can now continue with the administration guide to configure your IdP to enable provisioning with your SCIM Bridge.