How to Integrate Vultr Single Sign-On and SCIM with an Identity Provider

Single Sign-On (SSO) through OpenID Connect (OIDC) lets your team sign in to Vultr using their identity provider's credentials instead of a separate Vultr password. System for Cross-domain Identity Management (SCIM) provisioning uses the SCIM 2.0 standard to let your identity provider automatically create, update, and deactivate Vultr users and groups. Both are open standards, so this integration works with any identity provider that implements them.

Follow this guide to connect any OIDC-compliant and SCIM 2.0-compliant identity provider to Vultr for SSO and SCIM provisioning.

Setup Order

Enable SSO first, then enable SCIM as a separate step. Enabling one does not enable the other automatically. After both are enabled, provision a user, then test the login last. SSO can sign in only users that already exist in Vultr, and SCIM is what creates them. Configure both features before you verify a sign-in, because a provisioned user has no password and cannot log in until SSO works.

The two features also configure in opposite directions:

• For SSO, you create an application in your identity provider first, which gives you a Client ID and Client Secret, then you enter those values in Vultr.
• For SCIM, you enable it in Vultr first, which gives you a token, then you enter that token in your identity provider.

What You Need From Your Identity Provider

Create an OIDC application in your identity provider (sometimes called an app integration, app registration, or web application), and gather the following:

If you also want SCIM provisioning, confirm your identity provider supports:

• SCIM 2.0 with OAuth Bearer Token authentication, meaning a single static, long-lived token, not a full OAuth client-credentials exchange.
• A SCIM base URL field you can point at a third-party endpoint, rather than only pre-built catalog integrations.

Not every identity provider meets both conditions. Some providers, including Google Workspace, provision users only into applications with a pre-built vendor-specific integration and have no way to enter a custom SCIM endpoint at all. Confirm your identity provider supports custom SCIM endpoints before planning a SCIM rollout around it.

What You Need From Vultr

These three values are fixed. You don't need to look them up per organization, except for the SCIM Token, which Vultr generates for you.

Configure Single Sign-On

Create an OIDC Application in Your Identity Provider

1. In your identity provider's admin console, create a new OIDC application.

2. Set the sign-in redirect URI to https://console.vultr.com/openid/. If your identity provider has a separate sign-out redirect URI field, set it to the same value.

   The redirect URI must match exactly, including the trailing slash. A mismatch is the most common cause of login errors.

3. Assign the application to the users or groups who should have SSO access.

4. Copy the application's Client ID, Client Secret, and Issuer URL (or discovery URL).

Configure SSO in Vultr

1. Log in to the Vultr Console.

2. Click the organization name in the top navigation bar.

3. Click Manage Organization.

4. Click Federated Identity under Identity and Access Management in the left sidebar.

5. Under Single Sign-On, click Enable. The Enable Single Sign-On panel opens on the right.

6. Enter the Provider URL, Client ID, and Client Secret from your identity provider.

7. Click Enable SSO.

   The Single Sign-On card displays your Provider URL and Client ID, and Status shows Active, which confirms the connection is configured.

Configure SCIM Provisioning

Enable SCIM in Vultr

Only a root user can enable SCIM for an organization.

1. Log in to the Vultr Console.

2. Click the organization name in the top navigation bar.

3. Click Manage Organization.

4. Click Federated Identity under Identity and Access Management in the left sidebar.

5. Under System for Cross-domain Identity Management (SCIM), click Enable.

   The SCIM Status changes to Enabled, and the card displays the SCIM Base URL and a generated SCIM Token.

6. Click the eye icon next to the SCIM Token to reveal it, then copy the value.

You can also enable SCIM using the Vultr API. See How to Enable SCIM for an Organization.

Configure Your Identity Provider to Provision Users

1. In your identity provider, create or enable a SCIM provisioning connector, sometimes offered as a generic "SCIM 2.0" or "custom SCIM app" option in its application catalog.
2. Enter the SCIM Base URL (https://api.vultr.com/scim/v2) and the SCIM Token you copied from Vultr.
3. If your identity provider offers a test or verify option, use it to confirm the connection before assigning any users.
4. Enable the actions you want your identity provider to perform, typically labeled Create Users, Update User Attributes, and Deactivate Users.
5. Assign the users or groups you want to provision.

Verify the Sign-In

Users assigned to the application, and members of groups assigned to it, can now sign in to the Vultr Console with SSO. Test the login with a user that SCIM has provisioned.

1. Open a fresh or incognito browser window and go to the Vultr Console.

2. Click SSO in the login options.

3. Enter the email address of a provisioned user, then click Continue.

   The Vultr Console redirects you to your identity provider for authentication.

4. Authenticate with that user's account.

   Your identity provider redirects you back and signs you in to the Vultr Console. Vultr verifies that the user your identity provider returns matches the email address you entered. If your browser is already signed in to your identity provider as a different person, the login is rejected, so use an incognito window signed in as the intended user. A successful sign-in confirms the integration is complete.

How Permissions Work

Your identity provider decides who is in a group, and Vultr decides what that group can do. In your identity provider, you control group membership. In Vultr, you attach roles and permission policies to those groups to define what members can do, such as managing servers or viewing billing.

The recommended model is to assign permissions to groups in Vultr and add or remove people from those groups in your identity provider. You grant access by adding someone to a group in your identity provider, and you revoke it by removing them.

Day-to-Day Behavior

After your identity provider and Vultr are connected, routine changes in your identity provider drive the matching changes in Vultr.

Root users are exempt from this flow.

Troubleshooting

Use these fixes for the most common errors.

• Redirect URI error on login: Match your identity provider's redirect URI exactly to https://console.vultr.com/openid/, including the trailing slash.
• Username mismatch on login: Your browser is signed in to your identity provider as a different user. Use an incognito window signed in as the intended user.
• Provisioning does nothing or the SCIM test fails: Set the SCIM base URL to https://api.vultr.com/scim/v2, not the Console address, and verify that the SCIM token is current.
• Provisioning fails with Email is already in use: The email address already belongs to a Vultr user. Invite that user to your organization and have them accept the invitation, then provision the email address again.