Deploy 1Password SCIM Bridge on Azure Kubernetes Service

With 1Password Business, you can automate many common administrative tasks using 1Password SCIM bridge. It uses the System for Cross-domain Identity Management (SCIM) protocol to connect 1Password with your existing identity provider, like Azure Active Directory, JumpCloud, Okta, OneLogin, or Rippling.

Step 1: Add provisioning to your 1Password account

Before you can deploy 1Password SCIM Bridge, you’ll need to add the provisioning integration and get credentials for it. Click Get Started, sign in to your 1Password account, and follow the onscreen instructions.

Get Started

If you see the details for an existing provisioning integration, you’ll need to deactivate it first. Click More Actions and choose Deactivate Provisioning.

After you complete the setup process, you’ll get a scimsession file and bearer token. Save them both in 1Password and save the scimsession file to your computer. You’ll need these to deploy the SCIM bridge and connect your identity provider.

Step 2: Create and configure the Kubernetes cluster

2.1: Gather information about your environment

1. Sign in to your account on the Microsoft Azure portal. 

2. Click the (Cloud Shell) button in the top right.

3. Get a list of your Azure subscriptions:

    az account list -o table
   

4. Find a subscription you’d like to use for the SCIM bridge deployment, then make note of its Name or SubscriptionID.

5. Get a list of available locations in your Azure account:

    az account list-locations -o table
   

6. Find your preferred server location (region) for the deployment and make note of its Name, such as eastus2.

7. Choose an existing resource group or create a new one.

   • To get a list of existing resource groups:

       az group list -o table
     

   • To create a new resource group:

       az group create --name <desiredName> --location <locationName>
     

8. Make note of the name of the resource group you want to use for the deployment.

After you complete these steps, you should have the following details:

• Subscription Name or SubscriptionID.
• Location (region).
• Resource group name.

2.2: Create the cluster

The SCIM bridge must be deployed to an Azure Kubernetes Service cluster. To create the Azure Kubernetes Service cluster you’ll deploy the SCIM bridge to, copy the relevant command for your shell to a text editor and change the <placeholders> to the values you noted in step 2.1.

az aks create -n op-scim \
	--node-count 1 \
	--node-vm-size Standard_B2s \
	--load-balancer-sku basic \
	--node-osdisk-size 32 \
	--location <AzureServerLocation> \
	--subscription <SubscriptionID> \
	--resource-group <resourceGroupName> \
	--generate-ssh-keys

az aks create -n op-scim `
	--node-count 1 `
	--node-vm-size Standard_B2s `
	--load-balancer-sku basic `
	--node-osdisk-size 32 `
	--location <AzureServerLocation> `
	--subscription <SubscriptionID> `
	--resource-group <resourceGroupName> `
	--generate-ssh-keys

After you edit the command for your deployment, run it in the Cloud Shell. It may take a few minutes for Azure to create your cluster.

When you see a shell notification that the cluster has been created, continue to the next step.

Step 3: Set up and deploy 1Password SCIM Bridge

3.1: Connect to your Kubernetes cluster

1. Open the Kubernetes Services Page. 
2. Click the name of the cluster you just created. If you kept the name in the template above, it will be called op-scim.
3. Click Connect at the top of the page, then click Open Cloud Shell to connect to the cluster.

   If you already have the Cloud Shell open, run the "Set the cluster subscription" and "Download cluster credentials" commands listed in the Connect pane.

3.2: Clone the scim-examples repository

All the configuration files you need to deploy the SCIM bridge are available in the scim-examples repository on GitHub.

Switch to the directory where you want to clone the repository, then run the following command:

git clone https://github.com/1Password/scim-examples.git

Switch to the Kubernetes directory in the cloned repository:

cd scim-examples/kubernetes

3.3: Upload your scimsession file

3.4: Create the Kubernetes Secret

To create the Kubernetes Secret, run the following command:

• Bash:

    kubectl create secret generic scimsession --from-file=scimsession=/home/$USER/scimsession
  

• PowerShell:

    kubectl create secret generic scimsession --from-file=scimsession=/home/$Env:USER/scimsession
  

3.5: Deploy 1Password SCIM Bridge

1Password SCIM Bridge uses a Redis instance to store and cache your Let’s Encrypt TLS certificate. Deploy the configuration, 1Password SCIM Bridge, Redis, and the load balancer using the following command:

kubectl apply -f .

3.6: Create the DNS record

1Password SCIM Bridge requires a public DNS record on a domain that you manage. Before you create the DNS record, get the external IP address of the load balancer:

kubectl get services

If you don’t see the IP address in the External IP column, wait a few minutes and try again.

Add an A record that points to the public IP address for the load balancer. For example, if your domain is example.com, use scim.example.com.

3.7: Configure and enable Let’s Encrypt

1Password SCIM Bridge uses a TLS certificate provided by Let’s Encrypt to secure communication with your identity provider.

Set the fully qualified domain name (FQDN) based on the DNS record you created in the last step (for example: scim.example.com) as the value for OP_TLS_DOMAIN:

kubectl set env deploy/op-scim-bridge OP_TLS_DOMAIN=scim.example.com

Step 4: Test your SCIM bridge

To check that the DNS has propagated and the SCIM bridge is deployed successfully, visit the domain you configured in the previous step in your browser. You’ll see a 1Password SCIM Bridge status page. Enter your OAuth bearer token to verify it’s correct.

Use your bearer token and domain (for example: scim.example.com) to test the connection to 1Password:

curl --header "Authorization: Bearer <bearer_token>" https://<domain>/scim/Users

If you see a list of the users in your 1Password account, your SCIM bridge is deployed correctly.

Step 5: Connect your identity provider to the SCIM bridge

Because 1Password SCIM Bridge provides a SCIM 2.0-compatible web service that accepts OAuth bearer tokens for authorization, you can use it with a variety of identity providers.

Get help

Get help with the SCIM bridge, like if you lose your bearer token or session file.

If you’ll be managing a large number of team members or groups, refer to the 1Password SCIM Bridge deployment examples on GitHub to customize your deployment for your needs.

To get more help or share feedback, contact 1Password Business Support or join the discussion with the 1Password Support Community.

Learn more

• Update 1Password SCIM Bridge
• Quickstart: Deploy an Azure Kubernetes Service (AKS) cluster using the Azure portal