mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 05:52:51 +00:00
d8ea041c56
## Todos for release - [x] Configure Env in docs project on vercel - [x] Configure Root Path in the docs project on vercel - [ ] Remove old CSP https://github.com/zitadel/website/pull/1592 ## What we did This pull request migrates the project documentation from the old `docs/` directory to the new `apps/docs/` directory, introduces a new documentation system built with Next.js and Fumadocs, and updates all relevant references, configuration files, and documentation to reflect this change. It also adds new configuration and ignore files for the new documentation app, updates CI and linting to exclude the new docs from certain checks, and revises the contributing guidelines accordingly. **Documentation System Migration and New Docs App** * Migrated all documentation from `docs/` to `apps/docs/`, and updated all references in `README.md`, `CONTRIBUTING.md`, and other files to point to the new location. [[1]](diffhunk://#diff-eca12c0a30e25b4b46522ebf89465a03ba72a03f540796c979137931d8f92055L585-L640) [[2]](diffhunk://#diff-eca12c0a30e25b4b46522ebf89465a03ba72a03f540796c979137931d8f92055L660-R607) [[3]](diffhunk://#diff-eca12c0a30e25b4b46522ebf89465a03ba72a03f540796c979137931d8f92055L740-R687) [[4]](diffhunk://#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5L2-R3) [[5]](diffhunk://#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5L30-R30) * Added a new Next.js/Fumadocs-based documentation app under `apps/docs/`, including core app files, layouts, routing, search API, and a comprehensive `README.md` with development and contribution instructions. [[1]](diffhunk://#diff-5a1b07344a2c1b4d3f37b23ff1388b62cd9f57dea3c1cd23d8a0412b7602b132R1-R74) [[2]](diffhunk://#diff-462b9ad1eabbb7d1c29bb9c36e4931eb180fd7190900e6d2babf8f4d66ad1c28R1-R39) [[3]](diffhunk://#diff-e16ae25660ded787b10ac35dea96d5ecaacf895dae0afc8a9bd4382dc79a8c87R1-R7) [apps/docs/app/[[...slug]]/layout.tsxR1-R81](diffhunk://#diff-59e08acde4e805b7aeccef1dcf98f1d71dfc550777e6b9402085cee0e9fa4e0aR1-R81), [apps/docs/app/[[...slug]]/page.tsxR1-R79](diffhunk://#diff-e5df3f80d0fa01e12d63d81f29c57a9d14e846c78fd3beabb2ef768e38fd9580R1-R79), [[4]](diffhunk://#diff-389b34918e040cacaa87cd7201ffa462cc2b0b716736f537e3d3c660ac69353bR1-R7) [[5]](diffhunk://#diff-d3b03416d1c457b19f1c27b26f2db741412df841b875c26ccadc36e4522247f4R1-R29) [[6]](diffhunk://#diff-c8fb8339570a5305809be7c618e14705fd86390dc278e6ce8ba224a7bc8b0c3cR1-R25) **Configuration and Tooling Updates** * Updated `.github/workflows/codeql.yml`, `.golangci.yaml`, and `.github/dependabot.yml` to properly handle the new docs app: excluded `apps/docs` from certain checks, added npm dependency updates for the docs app, and excluded generated content. [[1]](diffhunk://#diff-12783128521e452af0cfac94b99b8d250413c516ec71fe6d97dbea666ff7ba27L8-R14) [[2]](diffhunk://#diff-9917ddc9f1c3304218f7269265b746d997c5c0615478177b5fceecd33ef47cb5R5-R6) [[3]](diffhunk://#diff-9917ddc9f1c3304218f7269265b746d997c5c0615478177b5fceecd33ef47cb5R126-R129) [[4]](diffhunk://#diff-dd4fbda47e51f1e35defb9275a9cd9c212ecde0b870cba89ddaaae65c5f3cd28R89-R106) * Updated `.devcontainer/devcontainer.json` to use the latest Go 1.25.3 version for consistency. **Licensing and Miscellaneous** * Added `apps/docs/` to the list of licensed directories in `LICENSING.md`. These changes ensure the documentation is now maintained in a modern, scalable system and all project tooling is updated to support the new structure. --------- Co-authored-by: Federico Coppede <[email protected]>
125 lines
14 KiB
Plaintext
125 lines
14 KiB
Plaintext
---
|
||
title: SCIM v2.0
|
||
---
|
||
|
||
Zitadel’s **[SCIM v2](https://scim.cloud/) service provider interface** enables standardized provisioning and lifecycle management of users and other IAM resources.
|
||
By implementing the official *System for Cross-domain Identity Management (SCIM) v2.0* specification, Zitadel allows seamless and automated user creation, updates, deactivation, and deprovisioning across systems.
|
||
|
||
## API
|
||
|
||
For full reference details of Zitadel’s SCIM API, consult the API documentation [here](/apis/scim2).
|
||
|
||
## Provisioning domain
|
||
|
||
A **provisioning domain** represents an external administrative domain—separate from the service provider—typically introduced for legal, organizational, or technical reasons.
|
||
Refer to the SCIM specification definitions in **RFC7643**:
|
||
https://datatracker.ietf.org/doc/html/rfc7643#section-1.2
|
||
|
||
Zitadel uses provisioning domains to scope the handling of the SCIM **`externalId`**, ensuring that different customers or systems provisioning users do not conflict with each other.
|
||
|
||
### Setting a provisioning domain
|
||
|
||
A provisioning domain can be assigned to a **machine user** by adding the following metadata entry:
|
||
|
||
- **Key:** `urn:zitadel:scim:provisioningDomain`
|
||
- **Value:** the name of the provisioning domain
|
||
|
||
### How Zitadel stores `externalId`
|
||
|
||
If a machine user has a provisioning domain set, any SCIM `externalId` provided during user provisioning or lookup is stored under:
|
||
`urn:zitadel:scim:{provisioningDomain}:externalId`
|
||
|
||
If *no* provisioning domain is configured, Zitadel falls back to a simplified metadata key:
|
||
`urn:zitadel:scim:externalId`
|
||
|
||
This ensures that different provisioning sources remain isolated, and the correct `externalId` is returned when queried through SCIM.
|
||
|
||
## Mapping
|
||
|
||
The following table describes how Zitadel maps SCIM User attributes to Zitadel user fields.
|
||
Attributes without a direct Zitadel equivalent are stored in **user metadata**.
|
||
For more information about user metadata, see [here](../customize/user-metadata).
|
||
|
||
| SCIM | Zitadel | Remarks |
|
||
|------------------------|-----------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||
| `id` | `userId` | |
|
||
| `username` | `username` | |
|
||
| `name.formatted` | `profile.displayName` | The SCIM attribute `displayName` takes precedence over `name.formatted` |
|
||
| `name.familyName` | `profile.familyName` | |
|
||
| `name.middleName` | `metadata[urn:zitadel:scim:name.middleName]` | |
|
||
| `name.honorificPrefix` | `metadata[urn:zitadel:scim:name.honorificPrefix]` | |
|
||
| `name.honorificSuffix` | `metadata[urn:zitadel:scim:name.honorificSuffix]` | |
|
||
| `displayName` | `profile.displayName` | The SCIM attribute `displayName` takes precedence over `name.formatted` |
|
||
| `nickName` | `profile.nickName` | |
|
||
| `profileUrl` | `metadata[urn:zitadel:scim:profileUrl]` | |
|
||
| `title` | `metadata[urn:zitadel:scim:title]` | |
|
||
| `preferredLanguage` | `profile.preferredLanguage` | |
|
||
| `locale` | `metadata[urn:zitadel:scim:locale]` | |
|
||
| `timezone` | `metadata[urn:zitadel:scim:timezone]` | |
|
||
| `active` | `state` | `Initial` and `Active` are mapped to `active = true`, all other states are mapped to `active = false`.<br />The `active` value can only be updated if the user is in the state `Active` or `Inactive`. |
|
||
| `password` | `password` | |
|
||
| `emails` | `email` | Only the `primary` email is stored in Zitadel, if there is no `primary` email, the first one is stored. By default emails from SCIM are considered verified, this can be adjusted in the [configuration](#configuration). |
|
||
| `phoneNumbers` | `phone` | Only the `primary` phone number is stored in Zitadel, if there is no `primary` phone number, the first one is stored. By default phone numbers from SCIM are considered verified, this can be adjusted in the [configuration](#configuration). |
|
||
| `ims` | `metadata[urn:zitadel:scim:ims]` | Serialized as JSON. |
|
||
| `photos` | `metadata[urn:zitadel:scim:photos]` | Serialized as JSON. |
|
||
| `addresses` | `metadata[urn:zitadel:scim:addresses]` | Serialized as JSON. |
|
||
| `entitlements` | `metadata[urn:zitadel:scim:entitlements]` | Serialized as JSON. |
|
||
| `roles` | `metadata[urn:zitadel:scim:roles]` | Serialized as JSON. |
|
||
| `externalId` | `metadata[urn:zitadel:scim:externalId]`<br />`metadata[urn:zitadel:scim:{provisioningDomain}:externalId]` | See [provisioning domain](#provisioning-domain). |
|
||
|
||
## Configuration
|
||
|
||
This section provides details on the runtime configuration of the SCIM interface of Zitadel.
|
||
|
||
### Defaults
|
||
|
||
- Emails from SCIM are treated as **verified**
|
||
- Phone numbers from SCIM are treated as **verified**
|
||
- Bulk SCIM operations can include up to **100 operations**
|
||
- Maximum SCIM request body size is **1 MB**
|
||
|
||
This behavior can be adjusted through the Zitadel runtime configuration settings:
|
||
|
||
```yaml
|
||
SCIM:
|
||
EmailVerified: true
|
||
PhoneVerified: true
|
||
MaxRequestBodySize: 1_000_000
|
||
Bulk:
|
||
MaxOperationsCount: 100
|
||
```
|
||
|
||
## Limitations
|
||
|
||
Zitadel’s SCIM implementation follows the core SCIM specification but includes the following limitations.
|
||
|
||
### Supported schemas
|
||
|
||
Zitadel currently supports only the SCIM User schema: `urn:ietf:params:scim:schemas:core:2.0:User`
|
||
Group provisioning and other extended schemas are not supported.
|
||
|
||
### Required attributes
|
||
|
||
In addition to SCIM-standard required fields, Zitadel requires:
|
||
|
||
* `name.familyName`
|
||
* `name.givenName`
|
||
* `emails`: at least one email is required
|
||
|
||
### Duplicated attribute mapping
|
||
|
||
The SCIM user attributes `name.formatted` and `displayName` are both mapped to the `profile.displayName` attribute in
|
||
Zitadel.
|
||
If both are provided, `displayName` always takes precedence and is the value that will be stored and returned in future SCIM queries.
|
||
|
||
## Resources
|
||
|
||
- **[Zitadel SCIM API Documentation](/apis/scim2)**: Documentation of Zitadel's SCIM API implementation.
|
||
- **[SCIM](https://scim.cloud/)**: The Webpage of SCIM.
|
||
- **[RFC7643](https://tools.ietf.org/html/rfc7643) Core Schema**:
|
||
The Core Schema provides a platform-neutral schema and extension model for representing users and groups.
|
||
- **[RFC7644](https://tools.ietf.org/html/rfc7644) Protocol**:
|
||
The SCIM Protocol is an application-level, REST protocol for provisioning and managing identity data on the web.
|
||
- **[RFC7642](https://tools.ietf.org/html/rfc7642) Definitions, Overview, Concepts, and Requirements**:
|
||
This document lists the user scenarios and use cases of System for Cross-domain Identity Management (SCIM).
|