Failed SCIM Bridge Upgrade DigitalOcean

Hi @kurtd. My name is De Ville and I am part of the provisioning team.

I apologize that you ran into this issue upgrading your SCIM bridge deployed with Digital Ocean (DO). Unfortunately we discovered an issue with our deployment configuration that could not be fixed in a backward compatible way. This fix is to redeploy the SCIM bridge. This should be a one-time process which will enable future updates to happen without error.

The good news is that the SCIM bridge is stateless and the only impact is that automated provisioning will be disabled while the SCIM bridge is redeployed. Users will continue to have access to their 1Password accounts.

We are in the process of updating our DO-specific instructions, but I will the share the instructions with you here.

You can use the following (soon to be published) steps to redeploy your SCIM bridge on your Digital Ocean cluster.

1. Disable provisioning on the identity provider. This is an optional but recommended step to avoid the identity provider reporting errors when trying to access a SCIM bridge that is not accessible.
2. Delete the namespace using the DigitalOcean console:
   
   1. Navigate to the https://cloud.digitalocean.com/kubernetes/clusters page and select the cluster that you previously deployed the SCIM bridge to.
   2. Click the button to open the "Kubernetes Dashboard"
   3. Select "Namespaces" under the "Cluster" menu on the left hand side of the screen
   4. Find the "op-scim-bridge" namespace and select Delete from the menu. Select Delete on the confirmation window.
3. Alternatively, delete the namespace using kubectl:
   1. Ensure you are connected to the DigitalOcean Kubernetes cluster where the SCIM bridge is deployed.
   2. Delete the "op-scim-bridge" namespace with the following command: kubectl delete namespace op-scim-bridge
4. Visit https://marketplace.digitalocean.com/apps/1password-scim-bridge and click Install App.
5. Choose the cluster where the SCIM bridge was previously deployed, then click Install. The installation can take up to 10 minutes to complete.
6. Update the DNS record:
   1. Navigate to the Kubernetes Dashboard for your cluster.
   2. Select "Services" under the Service section.
   3. Find "op-scim-bridge-svc" in the list and take note of the IP address listed under the "External Endpoints".
   4. Update the DNS record to match the publicly accessible (external endpoint) address of the SCIM bridge.
   5. Wait for the DNS change to propagate.
7. Navigate to the IP address where the SCIM bridge is deployed.
8. Enter the domain and click Verify.
9. Click Sign in with 1Password. You should be redirected to the Provisioning Details Page once logged in.
10. Click Regenerate Credentials and be sure to store the new credentials.
11. Click Install credentials. You should be redirected to the SCIM bridge address and the new credentials will be installed.
12. Re-enable provisioning in your 1Password account on the Provisioning Details page.
13. Visit the SCIM bridge domain in your browser and enter your OAuth bearer token to confirm that the redeployment was successful.
14. Update the OAuth bearer token used by the identity provider.
15. Resume provisioning on the identity provider.

Please let me know if you get stuck at any of the steps.

I finally got around to updating the bridge and your instructions worked great. They posted some instructions here https://support.1password.com/scim-update/ but the ones you posted were more detailed. Thanks

Hi @kurtd. Thanks for letting us know. Happy to help! =)