Miro✓ Verified

Miro is a visual collaboration platform built around shared online whiteboards. Teams use it for brainstorming, planning, and diagramming. RSA G&L collects users, groups, group memberships, and user roles through the Miro SCIM API. Identities ❌ | Accounts ✔️ | Groups ✔️ | App Roles ✔️ | Entitlements ❌

Miro supports both the REST API ¹ and SCIM APIs ². For the purposes of this article, we will use the SCIM APIs.

Application

Steps

1. Login to RSA G&L console as System Administrator.
2. Navigate to Resources > Application.
3. Click on Create Application and select Other Application.
4. Enter the details as shown below.
   
   
5. Click Finish.

---

Account Collector

This section explains the process for configuring an account collector for the Miro application. We will use the RSA G&L Generic REST collector for this purpose.

Steps

1. Login to RSA G&L console as System Administrator.
2. Navigate to Resources > Applications.
3. Click on Miro.
4. Navigate to Collectors tab and click on Create Account Collector. Enter the details as shown below.
   
   
   
5. Click Next and enter the connection details.
   
   
   
6. Click Next. Select the data types that the collector will be collecting from Miro
   
   
   
7. Click Next. On the Account Data page, enter the following configurations.
   
   
   
   
   
   
   
   
   
   
   

Request
Method	GET
URL	/scim/Users
Query Parameters
attributes	id,userName,active
Request Headers
Accept	application/json
Authorization	Bearer ${AuthenticationToken}
Response Mappings
AccountId	$.Resources.*.userName
Id	$.Resources.*.id
IsActive	$.Resources.*.active

8. Click Next. On the Group Data page, enter the following configurations.
   
   
   
   
   
   
   
   
   
   
   

Request
Method	GET
URL	/scim/Groups
Query Parameters
attributes	id,displayName
Request Headers
Accept	application/json
Authorization	Bearer ${AuthenticationToken}
Response Mappings
GroupId	$.Resources.*.displayName
Id	$.Resources.*.id

9. Click Next. On the Account Group Membership page, enter the following configurations.
   
   
   
   
   
   
   
   

Request
Method	GET
URL	/scim/Groups
Query Parameters
attributes	id,members.value
Request Headers
Accept	application/json
Authorization	Bearer ${AuthenticationToken}
Response Mappings
Account Identifier	$.Resources.*.members.*.value
Group Identifier	$.Resources.*.id

10. Click Next. In the Map Collector Attributes to Account Attributes, map the collected account attributes.
    
    
    
11. Click Next. In the Map Collector Attributes to Account Mapping Attributes, map the user reference attribute.
    
    
    
12. Click Next. In the Map Collector Attributes to Group Attributes, map the collected group attributes.
    
    
    
13. Click Next. In the User Resolution Rules, map the user to account.
    
    
    
14. Click Next. In the Member Account Resolution Rules, map the account.
    
    
    

💡 Info: This value MUST always be mapped to the Account Name for any generic REST collector.

15. Click Finish. Use the Test function to make sure the configurations are accurate.

---

Entitlement Collector

This section explains the process for configuring an entitlement collector to collect user roles and assignments from the Miro application. We will use the RSA G&L Generic REST collector for this purpose.

Steps

1. Login to RSA G&L console as AveksaAdmin.
2. Navigate to Resources > Applications.
3. Click on Miro.
4. Navigate to Collectors tab and click on Create Entitlement Collector. Enter the details as shown below.
   
   
   
5. Click Next and enter the connection details as shown in Step 5 of Account Collector. Leave Use Base URL for all API(s) unchecked.
6. Click Next. Select the data types that the collector will be collecting from Miro.
   
   
   
7. Click Next. On the App Role Data page, enter the following configurations.
   
   
   
   
   
   
   
   

Request
Method	GET
URL	https://instance.securid.com/aveksa/custom/external_jsp/MiroRolesv1.jsp
Request Headers
Accept	application/json
Response Mappings
ApplicationRoleId	$.roles.*.role
Description	$.roles.*.description

8. Click Next. On the App-Role Account Membership collection page, enter the following configurations.
   
   
   
   
   
   
   
   
   
   
   

Request
Method	GET
URL	https://miro.com/api/v1/scim/Users
Query Parameters
attributes	id,roles
Request Headers
Accept	application/json
Authorization	Bearer ${AuthenticationToken}
Response Mappings
Application Role Id	$.Resources.*.roles.*.value
Account Identifier	$.Resources.*.id

9. Click Next. In the Map Collector Attributes to App Role Attributes, map the collected account attributes.
   
   
   
10. Click Next. In the Account Evaluation, map the account collector to account value.
    
    
    
11. Click Next and then click Finish. Use the Test function to make sure the configurations are accurate.

---

Application Setup

SCIM

This section explains the process of setting up Miro for integration with G&L using the SCIM APIs.

Steps

1. Login to the Miro dashboard at https://miro.com/app/dashboard/.
2. Click on profile and select Settings.
   
   
   
3. Navigate to Security & compliance > Authentication page and enable SSO/SAML feature.
   
   
   
4. Navigate to Account > Enterprise integrations page and copy the Base URL and API token
   
   
   

---

OAuth2

This section explains the process of setting up Miro for integration with G&L using OAuth2 authentication.

Steps

1. Login to the Miro dashboard at https://miro.com/app/dashboard/.
2. Click on profile and select Settings.
   
   
   
3. Under Profile Settings, click on Integrations tab.
   
   
   
4. Click on Create New App.
5. Provide a suitable name for the application.
6. Select a Developer Team to place the application in. If you do not have a team, go to Teams under User Management and create developer team.
   
   
7. Click on Create App.
8. Copy the Client ID and Client Secret.
   
   
   
9. Add the G&L callback URL to redirect to https://instance/aveksa/oauth/callback
   
   
   
10. Provide the necessary permissions to the app and click Install App and Get OAuth Token.
    
    
    

---

Authentication

OAuth2

This section explains the process of setting up RSA G&L ADC and EDC to acquire the OAuth2 token dynamically from Miro.

Steps

1. Login to RSA G&L console as System Administrator.
2. Create or Edit a generic REST ADC that will be using OAuth2 authentication.
3. On the Connection Details page, configure the following.
   

Request
Client ID	CLIENT_ID
Client Secret	CLIENT_SECRET
Authentication URL	https://miro.com/oauth/authorize
Access Token URL	https://api.miro.com/v1/oauth/token
Scope

4. Click on Get OAuth 2.0 Access Token.
5. Click on Proceed For Authorization.
   
   
   
6. Login to Miro account.
   
   
   
7. The below message indicates that RSA G&L has successfully acquired a token.
   
   
   
8. Click Close.
9. Save the collector configuration. Use the Test function to make sure the configurations are accurate.

---

References

• Miro REST API 2.0 Reference
• Miro SCIM API
• OAuth 2.0 Authorization Code Grant (RFC 6749)

COL025

Footnotes

1. REST API 2.0 ↩
2. SCIM API ↩