Overview
SafeBase's SCIM Feature allows organizations to automatically provision and/org de-provision users into the Trust Center utilizing their own identity provider (IdP).
This feature is included in all Advanced and Enterprise plans. Please contact your CSM with any eligibility questions.
Prerequisites
Be a SafeBase admin and have correct permissions in an org's identity provider
Have already configured SAML and enforced SAML by toggling
"Require SAML Authentication for all members" in SafeBase's Settings.
Setup
Once the prerequisites have been met, the Configure Directory Sync (SCIM) option in the top right of the Organization Members table will become available.
Once Clicked, a Directory Sync modal will appear. Select Go To Directory Sync.
This will direct the user to SafeBase's third-party SCIM service, WorkOS. Select an identity provider.
Note: Since a SAML app was already created in the previous setup, SafeBase recommends reusing that existing connection and simply adding SCIM information to this app. WorkOS will offer an option to use your existing app or create a new one. Reusing the existing app will ensure SafeBase can avoid syncing duplicate users from a new app.
The screenshot below shows that a SCIM Base URL and OAuth Bearer Token were added from what WorkOS provided.
For each specific provider, WorkOS will provide exact steps to take.
Users will be able to choose options such as:
Import new users to SafeBase based on IdP permissions
Import changes to users, such as name/email changes
Automatically suspend users in SafeBase if they are suspended in the IdP or removed from the appropriate group(s)
Permissions
Once the setup is completed, users will be populated in SafeBase.
Existing users who were created using the standard Just-In-Time provisioning before SCIM will not be provisioned again.If
push groupsis chosen via SCIM (the WorkOS instructions will explain this), this will be seen in the Groups tab, which will allow SafeBase administrators to map a specific group to a role.All users not in one of these groups will inherit the default role.
Note: We recommend setting the default role to the least privileged Trust Library Viewer role.
Permissions inheritance
SafeBase can override a specific user's permission using the existing Role selector in the Organization Members tab. SafeBase will determine the highest permission level of a specific user based on group permissions and the Role selector.
For example, if a user is in the Sales Department group, which is mapped to Viewer, but is granted Admin in the Role Selector, they will be an Admin. In contrast, if Viewer is selected in the Role Selector, and a group grants them Account Manager privileges, they will be Account Managers.
Troubleshooting
If a specific user is not syncing into SafeBase, ensure they have been assigned the SafeBase SCIM app in your identity provider.
Ensure the admin making the SCIM connection is in one of the groups being pushed to SafeBase.
Disconnecting the directory will allow active organization members to log in via their past authentication method. To do this, click the "Configure Directory Sync (SCIM)" button to the upper right of the Organization Members table, and click "Disconnect directory."