Set Up authentik SCIM Provisioning for User Sync

Sync users and groups from authentik to Kestra using SCIM.

Prerequisites

• authentik Account: An account with administrative privileges to configure SCIM provisioning.
• Enable multi-tenancy in Kestra: Tenants must be enabled in Kestra to support SCIM provisioning. You can enable tenants by setting the kestra.ee.tenants.enabled configuration property to true:

kestra:
  ee:
    tenants:
      enabled: true

Kestra SCIM setup: create a new provisioning integration

1. Go to Instance Owner, select your tenant from the sidebar, open IAM, and click the SCIM Provisioning tab.
2. Click + Create.
3. Fill in the following fields:
   • Name: Enter a name for the provisioning integration.
   • Description: Provide a brief description of the integration.
   • Provisioning Type: Only SCIM 2.0 is supported — leave the default selection and click Save.

These steps generate a SCIM endpoint URL and a Secret Token. Save both — you will need them in the next steps.

The endpoint should look as follows:

https://<your_kestra_host>/api/v1/<your_tenantID>/integrations/integration_id/scim/v2

The Secret Token will be a long string (approximately 200 characters) used to authenticate requests from authentik to Kestra.

Enable or disable SCIM integration

You can disable or remove the SCIM integration at any time. When disabled, all incoming requests to that endpoint are rejected.

IAM role and service account

When creating a new Provisioning Integration, Kestra will automatically create two additional objects:

1. Role SCIMProvisioner with the following permissions:

   • GROUPS: CREATE, READ UPDATE, DELETE
   • USERS: CREATE, READ, UPDATE
   • BINDINGS: CREATE, READ, UPDATE, DELETE

2. Service Account with an API Token which was previously displayed as a Secret Token for the integration:

authentik SCIM 2.0 setup

Configuring SCIM 2.0 follows a process similar to SSO — you’ll need to create a new Application. Then, in the second step, select SCIM as the Provider Type.

In the Protocol settings section, enter the URL and Secret Token obtained from Kestra.

Test both SSO and SCIM by adding users and groups

First, create Users and Groups in the Directory settings.

Then assign your user(s) to an existing group.

You can set a password for each authentik user to allow them to log in directly to Kestra with their username/email and password.

Once groups and users are created, they are visible in the Kestra UI under IAM → Users and Groups. Log in as the default admin user and attach the desired role to each group to set the necessary permissions.

Then, to verify access, log in as one of those new authentik users in a separate browser or incognito mode and verify that the user has the permissions you expect.

Additional resources

• SCIM for authentik Documentation
• Manage applications in authentik Documentation