SCIM User Provisioning

SingleStore System for Cross Identity Management (SCIM) enables user provisioning from an identity provider to the Cloud Portal and SingleStore database. When SCIM is configured, changes in the identity provider synchronize automatically with the Cloud Portal. For example, assigning a user in the identity provider application automatically adds that user to the organization.

SingleStore SCIM supports SCIM 2.0 protocol. When users are provisioned through SCIM from an identity provider, their default access depends on whether RBAC is enabled:

• If RBAC is disabled, the system assigns Owner access by default, similar to inviting new users manually.

• If RBAC is enabled, the system grants the user basic permissions based on the role defined for new users.This provides only limited access unless additional roles or permissions are explicitly assigned.

RBAC is required for managing user permissions both in the SingleStore Helios and the SingleStore database engine.

The following table shows the identity provider application assignments and the corresponding actions in SingleStore Helios:

When SCIM is configured with RBAC enabled, adding a group in the identity provider automatically creates a corresponding team in the Cloud Portal. The permissions configured for the team are then automatically granted to users added to the team.