ClickHouse Cloud Embraces SCIM for Seamless Access

Automating Access with SCIM

The introduction of SCIM 2.0 provisioning in ClickHouse Cloud is a well-timed and highly practical enhancement, directly addressing a significant pain point for enterprise users: the manual overhead and security risks associated with user lifecycle management. By integrating with identity providers (IdPs) like Okta and Microsoft Entra ID, ClickHouse Cloud moves towards a more robust, automated, and secure operational model. This move is particularly noteworthy as it standardizes a critical aspect of cloud database management, allowing organizations to leverage their existing identity infrastructure for a seamless user experience. The emphasis on SCIM building on SAML SSO is a logical progression, ensuring that authentication and authorization are managed holistically. The detailed explanation of how group mappings translate to custom roles in ClickHouse Cloud is crucial for administrators, highlighting the flexibility and granular control offered. The deliberate scoping of SCIM's capabilities, such as not managing system roles or manually invited users, is a wise design choice that minimizes the attack surface and maintains clarity on what is being automated. This focus on security and simplicity in the SCIM implementation is commendable, ensuring that the automation doesn't introduce unforeseen vulnerabilities.

However, a key limitation mentioned is the requirement for SAML SSO to be pre-configured, which might present a barrier for organizations not yet leveraging SSO. While understandable from a security and integration perspective, it adds an initial setup step. Furthermore, the restriction to only provision users on verified domains means that organizations with complex multi-domain structures might need additional consideration. The article also clearly states that custom roles are the only ones manageable via SCIM, meaning administrators will still need to manage system roles separately. While this is a security-conscious decision, it implies that complete user role automation isn't yet achievable through SCIM alone. The availability tiering (Basic, Scale, Enterprise) for SAML and SCIM is also a factor; while SCIM is available for Enterprise and BYOC, it's not a universal feature across all ClickHouse Cloud plans, which might limit adoption for some segments of their user base. The article effectively communicates the benefits but could perhaps delve slightly deeper into potential migration strategies for organizations moving from manual provisioning to SCIM, or more detailed troubleshooting tips for common IdP integration issues.

Key Points

• ClickHouse Cloud now supports SCIM 2.0 for automated user provisioning and deprovisioning.
• This integrates with identity providers (IdPs), making them the source of truth for user access.
• SCIM builds on SAML SSO, meaning SAML must be configured first.
• It automates user assignment, role changes, and account removal based on IdP actions.
• Group mappings in the IdP can be linked to custom roles in ClickHouse Cloud.
• SCIM does not manage system roles (e.g., Admin) or manually invited users.
• Password synchronization remains with the IdP; ClickHouse Cloud does not handle credentials.
• SCIM provisioning is available for Enterprise and BYOC organizations.

---

📖 Source: Introducing SCIM Provisioning in ClickHouse Cloud