Configuring SSO and SCIM

Configures Single Sign-On (SSO) and SCIM 2.0 provisioning for CockroachDB across four distinct layers:

1. Cloud Console SSO — SAML or OIDC for the CockroachDB Cloud web console
2. DB Console SSO — OIDC for the DB Console web UI (Advanced/Enterprise only)
3. SQL/Cluster SSO — JWT-based or LDAP/AD authentication for SQL client connections
4. SCIM 2.0 — Automated user provisioning on the Cloud Console

Prerequisites

• Console SSO/SCIM: Organization Admin + ccloud CLI
• DB Console/SQL SSO: Cluster admin role + Advanced or Enterprise plan (DB Console SSO not on Standard/Basic)
• LDAP/AD: Self-hosted only (not available on CockroachDB Cloud)
• SCIM 2.0: Enterprise plan required

Configuration Decisions

Before proceeding, determine which layers the user needs. Ask which of the following apply, then follow only the relevant Parts below.