Synchronization with an external IdP

The script performs synchronization with an external identity provider (IdP). Current script version:

  • Creates new IdP users.
  • Creates new IdP groups.
  • Updates user membership in IdP groups.
  • Updates group headers.
  • Updates user roles.
  • Updates user profile data.

Script execution requirements

  • To run the synchronization script, you need Node.js version 20 or higher. If Node.js is not installed or you need a newer version, select the suitable installation option on the Node.js website.
  • Set up a configuration for Auth using the AUTH_PROVIDERS_CONFIG environment variable.
  • Disable syncUserGroups in AUTH_PROVIDERS_CONFIG for your IdP if you have used this script to set up regular synchronization.

Example of running the script

node ./idp-sync.js \
     usEndpoint=https://us.domain.org \
     authEndpoint=https://auth.domain.org \
     usMasterToken=usmastertoken \
     authMasterToken=authmastertoken \
     idpSlug=someidpslug \
     idpData=./idp-data.json

Where:

  • idpSlug: Slug from the IdP configuration in Auth.
  • usEndpoint: United Storage endpoint.
  • authEndpoint: Auth endpoint.
  • usMasterToken: US_MASTER_TOKEN master token for United Storage.
  • authMasterToken: AUTH_MASTER_TOKEN master token for Auth.
  • idpData: Path to data from IdP, in JSON format.

IdP data from source

Prepare data from IdP, in JSON format, as per AUTH_PROVIDERS_CONFIG for auth:

type JsonData = {
    users: {
        idpUserId: string, // internal ID of user from IdP
        login: string,
        email : string | null,
        firstName: string | null,
        lastName: string | null,
        roles: string[], // datalens.admin, datalens.creator, datalens.visitor
    }[];
    groups: {
        groupId: string, // internal ID of group from IdP
        title: string,
        memberIds: string[], // internal IDs of users from IdP, idpUserId
    }[];
}

Example of idp-data.json for OpenLDAP

{
    "users": [
        {
            "idpUserId": "id-bob",
            "login": "bob",
            "email" : "bob@example.org",
            "firstName": "Bob",
            "lastName": "Smith",
            "roles": ["datalens.visitor"]
        },
        {
            "idpUserId": "id-carl",
            "login": "carl",
            "email" : "carl@example.com",
            "firstName": "Carl",
            "lastName": "Snow",
            "roles": ["datalens.creator"]
        }
        ...
    ],
    "groups": [
        {
            "groupId": "id-datalensadmins",
            "title": "DataLens admins",
            "memberIds": ["id-bob", "id-carl"]
        },
        ...
    ]
}
Previous
Configuring an OIDC authentication provider
Next
Service version