Commit 51e46f58 authored by Mike Jang's avatar Mike Jang

Merge branch 'doc-scimapi-header' into 'master'

Update SCIM header to avoid confusion

See merge request gitlab-org/gitlab!49801
parents f0c00e62 813f3b20
...@@ -15,7 +15,7 @@ The SCIM API implements the [RFC7644 protocol](https://tools.ietf.org/html/rfc76 ...@@ -15,7 +15,7 @@ The SCIM API implements the [RFC7644 protocol](https://tools.ietf.org/html/rfc76
To use this API, [Group SSO](../user/group/saml_sso/index.md) must be enabled for the group. To use this API, [Group SSO](../user/group/saml_sso/index.md) must be enabled for the group.
This API is only in use where [SCIM for Group SSO](../user/group/saml_sso/scim_setup.md) is enabled. It's a prerequisite to the creation of SCIM identities. This API is only in use where [SCIM for Group SSO](../user/group/saml_sso/scim_setup.md) is enabled. It's a prerequisite to the creation of SCIM identities.
## Get a list of SAML users ## Get a list of SCIM provisioned users
This endpoint is used as part of the SCIM syncing mechanism. It only returns This endpoint is used as part of the SCIM syncing mechanism. It only returns
a single user based on a unique ID which should match the `extern_uid` of the user. a single user based on a unique ID which should match the `extern_uid` of the user.
...@@ -74,7 +74,7 @@ Example response: ...@@ -74,7 +74,7 @@ Example response:
} }
``` ```
## Get a single SAML user ## Get a single SCIM provisioned user
```plaintext ```plaintext
GET /api/scim/v2/groups/:group_path/Users/:id GET /api/scim/v2/groups/:group_path/Users/:id
...@@ -115,7 +115,7 @@ Example response: ...@@ -115,7 +115,7 @@ Example response:
} }
``` ```
## Create a SAML user ## Create a SCIM provisioned user
```plaintext ```plaintext
POST /api/scim/v2/groups/:group_path/Users/ POST /api/scim/v2/groups/:group_path/Users/
...@@ -161,7 +161,7 @@ Example response: ...@@ -161,7 +161,7 @@ Example response:
Returns a `201` status code if successful. Returns a `201` status code if successful.
## Update a single SAML user ## Update a single SCIM provisioned user
Fields that can be updated are: Fields that can be updated are:
...@@ -193,7 +193,7 @@ curl --verbose --request PATCH "https://gitlab.example.com/api/scim/v2/groups/te ...@@ -193,7 +193,7 @@ curl --verbose --request PATCH "https://gitlab.example.com/api/scim/v2/groups/te
Returns an empty response with a `204` status code if successful. Returns an empty response with a `204` status code if successful.
## Remove a single SAML user ## Remove a single SCIM provisioned user
Removes the user's SSO identity and group membership. Removes the user's SSO identity and group membership.
......
...@@ -232,7 +232,7 @@ It is important that this SCIM `id` and SCIM `externalId` are configured to the ...@@ -232,7 +232,7 @@ It is important that this SCIM `id` and SCIM `externalId` are configured to the
Group owners can see the list of users and the `externalId` stored for each user in the group SAML SSO Settings page. Group owners can see the list of users and the `externalId` stored for each user in the group SAML SSO Settings page.
A possible alternative is to use the [SCIM API](../../../api/scim.md#get-a-list-of-saml-users) to manually retrieve the `externalId` we have stored for users, also called the `external_uid` or `NameId`. A possible alternative is to use the [SCIM API](../../../api/scim.md#get-a-list-of-scim-provisioned-users) to manually retrieve the `externalId` we have stored for users, also called the `external_uid` or `NameId`.
To see how the `external_uid` compares to the value returned as the SAML NameId, you can have the user use a [SAML Tracer](index.md#saml-debugging-tools). To see how the `external_uid` compares to the value returned as the SAML NameId, you can have the user use a [SAML Tracer](index.md#saml-debugging-tools).
...@@ -251,7 +251,7 @@ you can address the problem in the following ways: ...@@ -251,7 +251,7 @@ you can address the problem in the following ways:
- You can have users unlink and relink themselves, based on the ["SAML authentication failed: User has already been taken"](index.md#message-saml-authentication-failed-user-has-already-been-taken) section. - You can have users unlink and relink themselves, based on the ["SAML authentication failed: User has already been taken"](index.md#message-saml-authentication-failed-user-has-already-been-taken) section.
- You can unlink all users simultaneously, by removing all users from the SAML app while provisioning is turned on. - You can unlink all users simultaneously, by removing all users from the SAML app while provisioning is turned on.
- It may be possible to use the [SCIM API](../../../api/scim.md#update-a-single-saml-user) to manually correct the `externalId` stored for users to match the SAML `NameId`. - It may be possible to use the [SCIM API](../../../api/scim.md#update-a-single-scim-provisioned-user) to manually correct the `externalId` stored for users to match the SAML `NameId`.
To look up a user, you'll need to know the desired value that matches the `NameId` as well as the current `externalId`. To look up a user, you'll need to know the desired value that matches the `NameId` as well as the current `externalId`.
It is important not to update these to incorrect values, since this will cause users to be unable to sign in. It is also important not to assign a value to the wrong user, as this would cause users to get signed into the wrong account. It is important not to update these to incorrect values, since this will cause users to be unable to sign in. It is also important not to assign a value to the wrong user, as this would cause users to get signed into the wrong account.
...@@ -269,7 +269,7 @@ Changing the SAML or SCIM configuration or provider can cause the following prob ...@@ -269,7 +269,7 @@ Changing the SAML or SCIM configuration or provider can cause the following prob
| Problem | Solution | | Problem | Solution |
|------------------------------------------------------------------------------|--------------------| |------------------------------------------------------------------------------|--------------------|
| SAML and SCIM identity mismatch. | First [verify that the user's SAML NameId matches the SCIM externalId](#how-do-i-verify-users-saml-nameid-matches-the-scim-externalid) and then [update or fix the mismatched SCIM externalId and SAML NameId](#update-or-fix-mismatched-scim-externalid-and-saml-nameid). | | SAML and SCIM identity mismatch. | First [verify that the user's SAML NameId matches the SCIM externalId](#how-do-i-verify-users-saml-nameid-matches-the-scim-externalid) and then [update or fix the mismatched SCIM externalId and SAML NameId](#update-or-fix-mismatched-scim-externalid-and-saml-nameid). |
| SCIM identity mismatch between GitLab and the Identify Provider SCIM app. | You can confirm whether you're hitting the error because of your SCIM identity mismatch between your SCIM app and GitLab.com by using [SCIM API](../../../api/scim.md#update-a-single-saml-user) which shows up in the `id` key and compares it with the user `externalId` in the SCIM app. You can use the same [SCIM API](../../../api/scim.md#update-a-single-saml-user) to update the SCIM `id` for the user on GitLab.com. | | SCIM identity mismatch between GitLab and the Identify Provider SCIM app. | You can confirm whether you're hitting the error because of your SCIM identity mismatch between your SCIM app and GitLab.com by using [SCIM API](../../../api/scim.md#update-a-single-scim-provisioned-user) which shows up in the `id` key and compares it with the user `externalId` in the SCIM app. You can use the same [SCIM API](../../../api/scim.md#update-a-single-scim-provisioned-user) to update the SCIM `id` for the user on GitLab.com. |
### Azure ### Azure
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment