1. Overview
To ensure a successful and secure integration between your organizational systems and the Spikerz platform, the following prerequisites must be addressed. This document outlines the systems, protocols, and configurations necessary to enable authentication, authorization, and employee lifecycle management within Spikerz.
2. Authentication Integration
2.1. Single Sign-On (SSO) Configuration
Requirement: Integration with your organization's Identity Provider (IdP) using SAML 2.0 standard.
To create the custom SAML app, please use the following values:
Entity ID: https://smip-320415.firebaseapp.com
Once the app is created, it will generate the following:
SSO Login URL
Entity ID
X.509 Certificate
Please share with us the SP metadata, which is available at the following URL: https://YOUR_PIM_SERVER/saml/metadata.
2.2. User Role Mapping
Requirement: Access to role attributes during authentication to assign user permissions within Spikerz.
Details to Provide:
Attribute name used for role assignment.
Role definitions and mappings to Spikerz roles (e.g., Admin, Manager, Viewer).
Spikerz to SSO Attribute Mapping
Spikerz Claims | SP Attributes | Name Format |
user.email | Basic | |
displayName | user.firstName + ' ' + user.lastName | Basic |
uid | user.id | Basic |
photoURL | user.profileUrl | Basic |
token | user.login | Basic |
phoneNumber | user.phone | Basic |
3. Authorization and Access Management
3.1. Role-Based Access Control (RBAC)
Requirement:
Roles must be provisioned as part of the authentication process.
Permissions based on roles should align with organizational security policies.
3.2. Group Membership (Optional)
Requirement:
Access to group membership attributes if authorization is determined by group affiliations.
Let’s start by creating those groups:
{OPTIONAL_YOUR_PREFIX}-spikerz-marketing-admins
{OPTIONAL_YOUR_PREFIX}-spikerz-security-admins
{OPTIONAL_YOUR_PREFIX}-spikerz-marketing-members
{OPTIONAL_YOUR_PREFIX}-spikerz-security-members
We’ll expand this in the near future by adding more groups based on teams and departments.
Before proceeding, please let us know who you plan to add to each group, and let’s make sure we get manager approval for the assignments.
Employee Lifecycle Management
4.1. SCIM Integration
Provisioning config:
Make sure you’ve turned on the provisioning method to SCIM 2.0
Use the Spikerz SCIM endpoint:
Use HTTP Header with the token Spikerz provided to you
Make sure you have selected all provisioning actions and set the unique identifier to email:
To app config
Make sure you have turned on the update to Spikerz App.
Groups & Config Push Groups
Create groups with the suffix "-admins" / "-members" based on the role of the users inside the group.
For example:
"spikerz-security-admins" will contain admins.
"spikerz-marketing-members" will contain members, then you should config their assets access in the platform explicitly.
In Spikerz App, add the new group to "Push Groups".
In the new group, assign the Spikerz (IDP) App into the new group.
Use Cases:
Automatically revoke access from Spikerz when an employee leaves.
OPTIONAL: Automatically revoke access from social assets when an employee leaves.
Sync roles according to the group suffix (admin / member) - We do NOT create new roles.
Important notes:
In your SP
the user must approve the the invitation to app (via an email) before the provisioning starts to work