Overviews on Scim - Libre.sh

Identity Management

Mon, 01 Jan 0001 00:00:00 +0000

Authentication

Who is this user ?

The solution, SCIM

Mon, 01 Jan 0001 00:00:00 +0000

Quick overview

The SCIM protocol is an application-level protocol for provisioning and managing identity data specified through SCIM schemas. Its intent is to reduce the cost and complexity of user management operations.

A common existing user schema and deployments
Extension models
Placing specific emphasis on simplicity of development and integration
Applying existing models (authentication, authorization, and privacy)
Binding documents to provide patterns for exchanging this schema using standard protocols
Easily improve GDPR compliance
Consolidate the user experience across multiple FOSS applications as one platform

Resource based

In SCIM 2.0 a Resource is the common denominator and all SCIM objects are derived from it.

How do we use SCIM ?

Mon, 01 Jan 0001 00:00:00 +0000

SCIM Client and Server

While SCIM is a protocol for provisioning and managing identity, there isn’t really a concept of Identity Provider (IdP). In SCIM architecture, there is (only) the Client, making the HTTP calls and the Server receiving them.

Our use of SCIM Our chosen architecture is as follows : a SCIM Client collocated with the Identity Provider will reflect changes by calling all SCIM Server collocated with each application.

Why is SCIM better ?

Mon, 01 Jan 0001 00:00:00 +0000

Others management protocols

With this LDAP approach everything is centralized (except authorization).

Everything speaks the LDAP protocol langage. Identities are stored in an LDAP directory, which is provisioned via LDAP protocol. Authentication is done by the application that asks the user’s credentials and validates them against the directory via LDAP protocol.

This architecture tackles the two main drawbacks of the only LDAP approach : the missing single sign-on and the security vulnerability. Authentication is delegated to other web protocols (like OAuth, OIDC or SAML). This way, the user logs in only once to the identity provider.