Set up SCIM provisioning
Connect your directory over SCIM 2.0 so people join and leave the workspace, at the right role, as your directory changes.
Who can do this: the Owners of the account that holds the workspace, on the Enterprise plan.
Set up and test single sign-on first, including verifying your email domain. SCIM only provisions email addresses at the connection's verified domain, and the people it provisions sign in through your identity provider.
Open Single sign-on & SCIM
Open Settings, choose the Workspace tab, then Single sign-on & SCIM, and find 4. Directory sync (SCIM 2.0).
Enable SCIM
Select Enable SCIM.
Copy the token
Copy your SCIM token shows the bearer token. "Shown only once. Paste it into your IdP's SCIM connector now. We store only its hash and cannot recover it." Select Copy, then Done.
Configure your identity provider
In your identity provider's SCIM connector, enter the SCIM base URL, https://api.transglot.ai/scim/v2, and the token as a bearer token. Then assign the users and groups who should have access.
Map directory groups to roles (optional)
Under Directory groups to roles, select Add mapping for each group whose members should get a role other than Translator. See below.
What your directory can do
| Your directory does | What happens in the workspace |
|---|---|
| Assigns a user | They are added as a member. Unmapped users arrive as Translator. |
| Changes a user's role or group | Their role changes, within the limits below. |
Deactivates a user (active: false) or deletes them | They are removed from this workspace. Their login is kept, because they may belong to other workspaces. |
| Pushes a group you mapped | Every member your directory puts in that group holds the role you chose. |
"Deactivating a user in your directory revokes their access here, except an Owner of" the account, "who keeps access through the account until you remove them from it." The account's Owners get an email when that happens.
Every user provisioned or deprovisioned through SCIM is recorded in the audit log.
Map directory groups to roles
Add a mapping
Under Directory groups to roles, select Add mapping.
Identify the group
Fill in the Group ID, the Group name, or both. The group ID is "Your provider's stable id for the group. Survives a rename." If you give both, the group ID is what transglot matches on. Group names are matched ignoring capitalisation.
Choose the role
Choose the Role: Admin, Developer, Reviewer, Translator or one of your custom roles. Select Create mapping.
"Group mapping created. It is applied on the next directory sync."
How roles are decided:
- A group you mapped is applied exactly as you set it, on every sync, because you created the mapping inside transglot.
- A group or role you have not mapped is raw directory data. A value named after a role the workspace has (such as
admin,developer,reviewerortranslator) is honoured up to Admin. Anything else, including a group called "owner", gives Translator. A mis-sync in your directory can never hand out more than an admin holds. - No sync, mapped or not, makes anyone an Owner of the account. Account Owners are set on the account's Owners & billing members page.
- Map every group you want kept in sync. The groups your provider can read back are the built-in roles and the groups you mapped. An unmapped group is applied once, when your provider first pushes it, and your provider's next update to it fails with "Group not found".
Removing a mapping does not change anyone's current role. "Members already at that role keep it until your next directory sync, which is when the mapping stops being applied."
Rotate the token or turn SCIM off
- Rotate token issues a new token and stops the old one working. Do this if the token may have been exposed, and update your identity provider straight away, because provisioning stops until you do.
- Disable SCIM: "The bearer token stops working and your directory stops syncing, so joiners and leavers will no longer reach this workspace on their own. Members already here keep their access. Turning SCIM back on mints a new token."
If the account moves off the Enterprise plan, provisioning stops at once. Your directory can still read and remove members for 30 days afterwards, so leavers are still removed.
Technical reference
| Item | Value |
|---|---|
| Base URL | https://api.transglot.ai/scim/v2 |
| Authentication | Authorization: Bearer <token> |
| Users | GET /Users (paged with startIndex and count, at most 100 a page), POST /Users, GET /Users/<id>, PUT or PATCH /Users/<id>, DELETE /Users/<id> |
| Groups | GET /Groups, POST /Groups, PUT or PATCH /Groups/<id>, DELETE /Groups/<id> |
| Filter | userName eq "person@example.com" |
| User attributes read | userName (or the first emails value), displayName (or name.givenName and name.familyName), active, and an optional role or roles |
| Rate limit | 120 requests a minute per token |
userName must be an email address at the connection's verified domain. Other addresses are refused with an error naming the domain.
If it doesn't work
- The token was not copied: rotate it and copy the new one. A token cannot be recovered.
- Provisioning fails: check the base URL is exactly
https://api.transglot.ai/scim/v2, including the version segment, and that the token is current. - "userName must be an address at a verified domain.": verify your email domain under single sign-on first.
- Everyone lands as Translator: the group has no mapping, or the mapping's group ID does not match the one your provider sends. Try mapping on the group name instead.
- Your provider reports "Group not found" for a group it synced before: that group has no mapping. Add one, keyed on the group ID your provider sends.
- "Another mapping already claims that directory group ID." or "Another mapping already claims that directory group name.": edit the existing mapping instead. Names are compared ignoring capitalisation, so
Engineering-Leadsandengineering-leadsare the same name. - "... is the name of a built-in role, which is already its own group here. Use your directory group's own ID or name instead.": a group named
admin,developer,reviewerortranslatoralready provisions that role without a mapping.
Related
Set up single sign-on
Connect your identity provider over SAML 2.0 or OpenID Connect, verify your email domain, test the connection, then require SSO for everyone at that domain.
The audit log
An append-only record of every security-relevant act in a workspace, and a separate log of what changed on its account.