All settings relevant for access to the identity provider, the Alfabet the Alfabet RESTful services and the Alfabet SCIM application are managed in the settings of the alfasettings.json file in the SCIM/Config folder of the Alfabet installation directory. Open the file with a text editor and set the fields of the JSON file. The file already contains an example configuration which you can alter. Sections not mentioned in the following shall not be altered.

Configure access to the Alfabet RESTful services under AlfabetSyncConfiguration:

You have created a system user for the Alfabet RESTful services

  • scheduledExecution: Enter EachHour , EachHalfHour , EachQuarterHour , or EachFiveMinutes to define the interval between data synchronizations. Select a longer interval for synchronization of data for a high number of users.
  • scheduledExecutionEnabled: Select true to activate pushing of data to the Alfabet RESTful services, or false if data should not be pushed.

    If you want to temporarily deactivate data synchronization, you do not need to re-set this parameter in the alfasettings.json file. You can use the mechanism for pausing data synchronization on the user interface of the Alfabet SCIM application instead.

  • alfabetApiBaseEndpoint: Enter the URL of the Alfabet API server followed by /api/.
  • alfabetApiScimEndpoint: Enter scim/.
  • alfabetScimUser: Enter the API User Name of the system user for access to the Alfabet API server.
  • alfabetScimUserToken: Enter the API User Password of the system user for access to the Alfabet API server.
  • alfabetVersion: Enter 10 . This is independent from the Alfabet release version you are using.

Configure database access for the Alfabet SCIM Application under DatabaseConfiguration:

You have created a SCIM application database with a login user on SQL Server or decided to use SQLite. Only use SQLite for testing and not in production environments.

For security reasons, you should have created environment variables for the database login.

  • DatabaseType: Enter MsSQL to use a database implemented on Microsoft SQL server or SQLite to use SQLite. If you selected SQLite, you can leave the data in the SQLite field as is. If you use Microsoft SQL server, you need to set the following fields in the MSSQL field:
  • DatabaseHost: Enter the database server name.
  • DatabaseName: Enter the database name.
  • UseIntegratedAuth: Set to false to log in to the database with the user name and password defined in the UserName and Password fields. Set to true to log in with the system user used to started the SCIM application process. Access on the database on the database server must then be configured to allow access for the operating system user used to start the process. This database configuration is not part of this documentation. For the described configuration the field must be set to false.
  • UserName: Enter the database login user name or the environment variable containing the database login name as Env: followed by the variable name.
  • Password: Enter the database login user password or the environment variable containing the database login name as Env: followed by the variable name.

Configure access parameters for the Alfabet SCIM application user interface under AlfabetConfiguration:

  • EnableHttpLogging: Enter false . Only if issues occur can this parameter be set to true to generate extensive log files for debugging. Extensive logging can cause performance issues.
  • EnableScimUserData: Enter false . Only set this field to true if issues with user authentication occur. You will then be able to see the user data stored in the internal database of the Alfabet SCIM application in a debug view and send this information to Alfabet Support to analyze the issue. The view provides security relevant information and should be hidden if no issues are encountered.
  • Alfabet/AlfabetUrl: Enter the URL of the Alfabet SCIM application. When the Alfabet SCIM application is started from the SCIM directory of the Alfabet installation directory, the URL is https://localhost:7160/.
  • Alfabet/AlfabetApiUrl: Enter https.
  • AuthenticationEnabled: Enter OAuth.

Configure access to the Alfabet SCIM application user interface with user name and password under AlfabetConfiguration

  • ResetAdminUser: Enter false . This setting shall only be set to true if the admin user specified with the two parameters below shall be changed. The user name and password is only read from the configuration file once for the first login of the user. It is then stored in the Alfabet SCIM application and shall be deleted from the configuration file for security reasons. If the administrator changes or the current administrator forgets the password, you can set this parameter to true and redefine user name and password to overwrite the user information stored in the Alfabet SCIM application.
  • AdminUserEmail: Enter the email address of the administrator that shall log in to the Alfabet SCIM application.
  • AdminCredentials: Enter a password for the administrator that shall log in to the Alfabet SCIM application.

Configure access to the Alfabet SCIM application user interface with single sign-on under SsoConfiguration. There are two separate fields for single sign-on via Microsoft Entra ID® or via Okta®.

You have registered an app for single sign-on access at the identity provider. The access parameter from the identity provider are required for the following

Configure single sign-on with Microsoft Azure as identity provider in the JSON object of the Microsoft field:

  • Enabled: Enter true.
  • ClientId: Enter the Application (client) ID of the Microsoft Entra app registration used for SSO. To find this value, open the Overview page for your application in the Microsoft Entra ID App registrations and copy the Application (client) ID.
  • ClientSecret: Enter the client secret value generated for the Microsoft Entra app registration. To create or retrieve a client secret, go to the Certificates & secrets > Client secrets page for your application in the Microsoft Entra ID App registrations.
  • TenantId:Enter The Directory (tenant) ID of the Microsoft Entra tenant. To find this value, open the Overview page of Microsoft Entra ID and copy the Directory (tenant) ID.
  • RedirectUri: Enter the redirect URI to which Microsoft Entra ID redirects the user after successful authentication. The value must match a redirect URI configured for the app registration in Microsoft Entra ID, for example https://<server>/callback/login/microsoft.
  • Scopes: Enter ['openid', 'profile', 'email']

Configure single sign-on with Okta as identity provider in the JSON object of the Okta field:

  • Enabled: Enter true.
  • Domain: Enter the base URL of the Okta organization, like for example https://<organization>.okta.com.
  • AuthorizationServerId: Enter the identifier of the Okta Authorization Server used for authentication and token issuance. To find this value in Okta, open Security > API > Authorization Servers and copy the Authorization Server ID.
  • ClientId: Enter the Client Id of the Okta application integration used for SSO. To find this value in Okta, open the General page of your application under Applications > Applications and copy the Client ID.
  • ClientSecret: Enter the Client Secret of the Okta application integration. To find this value in Okta, open the General page of your application under Applications > Applications and copy the Client Secret
  • RedirectUri: Enter the redirect URI to which Okta redirects the user after successful authentication. The value must match a redirect URI configured for the application in Okta, for example https://<server>/callback/login/okta.
  • Scopes: Enter ['openid', 'profile', 'email']

Configure access to the identity provider under OpenIdConfiguration:

You have registered the Alfabet SCIM application access with oauth authentication at the identity provider. The registered aplication has an API with Audience claim.

  • Enabled: Enter JwtValidation.
  • TokenLifetimeInMins: Enter the JSON token lifetime in minutes.
  • JwtValidation/TokenIssuer: Enter the URL of the Alfabet SCIM application.
  • JwtValidation/TokenAudience: Enter a GUID that will be used for encryption. You can use any GUID generator tool to generate the GUID