SCIM and WSO2 Identity Server

447–4476553_ietf-scim-working-group-reaches-consensus-scim-logo.png

What is SCIM ?

What is SCIM ?

SCIM is an open standard specification which makes identity provisioning in cloud native applications and services easier and cheaper. The focus of this open standard specification is simplicity of development and integration while it's built upon the experience of existing schemas and deployments. These make SCIM, a far suitable specification for provisioning use-cases related to enterprise-to-cloud service providers, inter cloud scenarios and more.

According to RFC 7644:

The System for Cross-domain Identity Management (SCIM) specification is an HTTP-based protocol that makes managing identities in multi- domain scenarios easier to support via a standardised service.

How does SCIM achieve this ?

SCIM specifies a standard way of representing identity related resources. The basic component of its object model is a resource. The resource has specific must have common attributes such as id, meta and some others.

The SCIM core defines User and Group Schemas and Enterprise User Schema Extensions which extend from the Resource. This SCIM core resources are platform independant. Each resource has it’s own attributes and specified by the resource’s resource type “schema” attribute. It is also possible to define new resource types as well as attribute extensions to resources. These resources are represented as a JSON object.

Here is a sample User resource JSON object from rfc7643:

{
     "schemas":
       ["urn:ietf:params:scim:schemas:core:2.0:User",
         "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"],

     "id": "2819c223-7f76-453a-413861904646",
     "externalId": "701984",

     "userName": "bjensen@example.com",
     "name": {
       "formatted": "Ms. Barbara J Jensen, III",
       "familyName": "Jensen",
       "givenName": "Barbara",
       "middleName": "Jane",
       "honorificPrefix": "Ms.",
       "honorificSuffix": "III"
     },
    ...

     "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User": {
       "employeeNumber": "701984",
       "costCenter": "4130",
       ...
     },

     "meta": {
       "resourceType": "User",
       "created": "2010-01-23T04:56:22Z",
       "lastModified": "2011-05-13T04:42:34Z",
       "version": "W\/\"3694e05e9dff591\"",
       "location":
         "https://example.com/v2/Users/2819c223-7f76-453a-413861904646"
     }
   }

The SCIM protocol also specifies well-known endpoints and HTTP methods for managing the above resources. These can be accessed via RFC7644-SCIM Endpoints and HTTP Methods. These method enable create, retrieve, modify and delete resources. The endpoints are defined for each resource types as well as to view supported resource types and schemas and do bulk operations and searches on resource types.

SCIM in WSO2 Identity Server

Current WSO2 Identity Server 5.11 supports SCIM 2.0 by default. However SCIM 1.1 is supported as well. It is recommended to use SCIM 2.0. because,

• SCIM 2.0 APIs provide additional methods that are not available with SCIM 1.1 APIs (e.g., additional search filters for filtering users).
• The SCIM 2.0 schema supports more fine-grained requirements.
• There is more focus on feature development for SCIM 2.0 APIs.

WSO2 Identity Server 5.11 supports inbound provisioning using SCIM2 API and outbound provisioning to SCIM 2.0 supported systems.

Inbound Provisioning with SCIM

Inbound provisioning is where users or groups from external systems are provisioned to the Identity Provider in concern.

WSO2 Identity Server 5.11 supports a REST API for SCIM operations for the endpoints mentioned in the core with the addition of Roles endpoint. The Identity Server can be provisioned and deprovisioned with users,roles and groups. An extensive SCIM 2.0 API documentation is provided and we can try the REST APIs with a local instance of Identity Server running.

WSO2 Identity Server 5.11 supports a REST API for SCIM operations for the endpoints mentioned in the core with the addition of Roles endpoint. The Identity Server can be provisioned and deprovisioned with users,roles and groups. An extensive SCIM 2.0 API documentation is provided and we can try the REST APIs with a local instance of Identity Server running.

When users or groups from the Identity Provider in concern are provisioned to external systems, it it called as outbound provisioning.

Outbound Provisioning with SCIM

WSO2 Identity Server 5.11 supports outbound provisioning for SCIM supported systems where, after configuring, whenever a user/role/group is created/updated/deleted in the Identity Server, the supported system will also be subject to the opearations. We can try out outbound provisioning with WSO2 Identity Server following Identity Server documentation-Outbound Provisioning with SCIM.

Summary

SCIM is an open standard specification for managing identities in multi-domain scenarios. It achieves this by defining a standard way of representing resources and binding documents to provide patterns for exchanging this schema using HTTP. This makes it cost effective, efficient and less complex for user management operations. WSO2 Identity Server uses SCIM for Inbound and Outbound provisioning.

References

[1] https://datatracker.ietf.org/doc/html/rfc7644

[2] https://datatracker.ietf.org/doc/html/rfc7642

[3] https://datatracker.ietf.org/doc/html/rfc7643

[4] https://wso2.com/library/article/2017/10/system-for-cross-domain-identity-management-scim/

[5] https://is.docs.wso2.com/en/latest/develop/scim2-rest-apis/

[6] https://is.docs.wso2.com/en/latest/learn/outbound-provisioning-with-scim/#!