SCIM Bridge Setup

Hi @bathrinarayanan ,

Thanks for reaching out.
Based on the error you've provided, it sounds like there's an issue with TLS.

Are you using the Let's Encrypt certificate management built into the SCIM bridge to handle the TLS certificate or are you bringing your own certificate? A couple thoughts:

If you are using your own TLS certificate, have you set the "OP_LETSENCRYPT_DOMAIN" variable in scim.env to an empty string and configured "OP_PORT" to listen for traffic on the correct port for your networking environment. Your SCIM bridge will listen on port 3002 by default (or another port specified using the OP_PORT environment variable) for unencrypted traffic redirected from the the TLS endpoint. See the brief documentation on our GitHub repo

If you are using the Let's Encrypt features built into the SCIM bridge to handle TLS and manage the certificate, Let's Encrypt needs to perform handshakes with the SCIM bridge's certificate manager component to handle the initial certificate issuance and subsequent renewals. Let's Encrypt uses dynamic IP addresses for this, make sure your firewall rules are not blocking port 443.

You can definitely host Scim bridge in private subnet with the Load balancer in a public subnet.
Feel free to share anymore queries/concerns around the same.

Hello @hemal_g_1p Thanks for the inputs I have used using the Lets Encrypt certificate method and it was working as expected when the server is in a public subnet am facing this issue when the server is in a private subnet so if I use a load balancer for a privately hosted server and the load balancer is in public it's failing in health check. May I know what is the health check path we need to define in the loadbalancer ?

@hemal_g_1p Can you help me out on this what is the exact health check path when we are going with Loadbalancer ?

Hi there,

You can activate the SCIM bridge health monitoring from your 1Password account as follows:
1. Go to your configured integration, Click on the Manage option for the Health Monitoring section.
2. Toggle the activation on for Health Monitoring.
3. Enter the DNS address of you SCIM bridge:
It would be the URL that refers to the DNS record for your chosen domain, that is pointing to the IP address of your load balancer.
4. Save the change.

Hi @hemal_g_1p I am not looking for that health check am looking for the health check in the load balancer in aws ?

My apology, I didn't follow your question right.
I would like to be aware of your deployment-method details to understand what problem you're facing (however feel free to reach us at support@1password.com with your scim-logs for thorough assistance)

Have you already set ingress firewall rule in place given the information we discussed above?
Could you confirm the path in AWS health monitoring spec ? the Terraform plan would likely have aws_lb_target_group.op_scim_bridge.health_check.path = "/". That value should be updated to "/app" and as its present here.