authentik ​S​C​I​M ​Provisioning

Sync Users and Groups from authentik to Kestra using SCIM.

Prerequisites

• authentik Account: an account with administrative privileges to configure SCIM provisioning.
• Enable multi-tenancy in Kestra: tenants MUST be enabled in Kestra to support SCIM provisioning. You can enable tenants by setting the kestra.ee.tenants.enabled configuration property to true:

kestra:
  ee:
    tenants:
      enabled: true

Kestra SCIM Setup: Create a New Provisioning Integration

1. In the Kestra UI, navigate to the Administration → IAM → Provisioning page.
2. Click on the Create button in the top right corner of the page.
3. Fill in the following fields:
   • Name: Enter a name for the provisioning integration.
   • Description: Provide a brief description of the integration.
   • Provisioning Type: currently, we only support SCIM 2.0 — leave the default selection and click Save.

The above steps will generate a SCIM endpoint URL and a Secret Token that you will use to authenticate authentik with the SCIM integration in Kestra. Save those details as we will need them in the next steps.

The endpoint should look as follows:

https://your_kestra_host/api/v1/your_tenant/integrations/integration_id/scim/v2

The Secret Token will be a long string (ca. 200 characters) that will authenticate requests from authentik to Kestra.

Enable or Disable SCIM Integration

Note that you can disable or completely remove the SCIM Integration at any time. When an integration is disabled, all incoming requests for that integration endpoint will be rejected.

IAM Role and Service Account

When creating a new Provisioning Integration, Kestra will automatically create two additional objects:

1. Role SCIMProvisioner with the following permissions:
   • GROUPS: CREATE, READ UPDATE, DELETE
   • USERS: CREATE, READ, UPDATE
   • BINDINGS: CREATE, READ, UPDATE, DELETE
2. Service Account with an API Token which was previously displayed as a Secret Token for the integration:

authentik SSO Setup

Install authentik

Authentik provides a simple docker-compose installer for testing purposes. Follow the instructions and click on the initial setup URL http://docker.for.mac.localhost:9000/if/flow/initial-setup/ to create your first user.

Create Application and SSO Provider in authentik

On the left-hand side select Applications → Applications. For simplicity we’ll use the Create with Wizard button as this will create both an application and a provider.

On the Application Details screen, fill in the application name and slug. Set both here to kestra and click Next.

On the Provider Type screen, select OAuth2/OIDC and click Next.

On the Provider Configuration screen:

1. In the Authentication flow field, select “default-authentication-flow (Welcome to authentik!)”
2. In the Authorization flow field, select “default-provider-authorization-explicit-consent (Authorize Application)”
3. Keep the Client type as Confidential and under the Redirect URIs/Origins (RegEx), enter your Kestra host's /oauth/callback/authentik endpoint in the format http://<kestra_host>:<kestra_port>/oauth/callback/authentik e.g. http://localhost:8080/oauth/callback/authentik and then Submit the Application:

Note the Client ID and Client Secret as you will need these to configure Kestra in the next step.

Configure Authentik SSO in Kestra Settings

With the above Client ID and Secret, add the following in the micronaut configuration section:

        micronaut:
          security:
            oauth2:
              enabled: true
              clients:
                authentik:
                  client-id: "CLIENT_ID"
                  client-secret: "CLIENT_SECRET"
                  openid:
                    issuer: "http://localhost:9000/application/o/kestra/"

You may need to adjust the above issuer URL if you named your application something other than kestra. Make sure to update that URL to match your application name http://localhost:9000/application/o/<application_name>/.

Configure a Default Role for your SSO users in Kestra Settings

To ensure that your SSO users have some initial permissions within Kestra UI, it's useful to set up a default role for them. You can do this by adding the following configuration under the kestra.security section:

kestra:
  security:
    default-role:
      name: default_admin_role
      description: "Default Admin Role"
      permissions:
        NAMESPACE: ["CREATE", "READ", "UPDATE", "DELETE"]
        ROLE: ["CREATE", "READ", "UPDATE", "DELETE"]
        GROUP: ["CREATE", "READ", "UPDATE", "DELETE"]
        EXECUTION: ["CREATE", "READ", "UPDATE", "DELETE"]
        AUDITLOG: ["CREATE", "READ", "UPDATE", "DELETE"]
        USER: ["CREATE", "READ", "UPDATE", "DELETE"]
        BINDING: ["CREATE", "READ", "UPDATE", "DELETE"]
        FLOW: ["CREATE", "READ", "UPDATE", "DELETE"]
        SECRET: ["CREATE", "READ", "UPDATE", "DELETE"]
        BLUEPRINT: ["CREATE", "READ", "UPDATE", "DELETE"]
        INFRASTRUCTURE: ["CREATE", "READ", "UPDATE", "DELETE"]
        KVSTORE: ["CREATE", "READ", "UPDATE", "DELETE"]
  ee:
    tenants:
      enabled: true
      default-tenant: false

authentik SCIM 2.0 Setup

Configuring SCIM 2.0 requires a similar process to SSO — you'll need to create a new Application. Then, in the second step, select SCIM as the Provider Type.

In the Protocol settings section, enter the URL and Secret Token obtained from Kestra.

Test both SSO and SCIM by adding users and groups

Create first Users and Groups in the Directory settings.

Then, assign your user(s) to an existing group:

You can set password for each authentik user to allow them to log in directly to Kestra with their username/email and password.

Once groups and users are created, they should be visible in the Kestra UI under the IAM → Users and Groups sections. It's best if you log in as the default admin user and attach a desired Role to each group to ensure that the users have the necessary permissions.

Then, to verify access, log in as one of those new authentik users in a separate browser or incognito mode and verify that the user has the permissions you expect.

Additional Resources

• SCIM for authentik Documentation
• Manage applications in authentik Documentation