---
title: Why is SCIM better ?
description : Differences between several centralized user management protocols in a world of web application hosting that show **SCIM is an upgrade.**
color : green
weight : 4
---
### Others management protocols
{{< switch-box title="Ldap" >}}
With this LDAP approach **everything is centralized** (except authorization).

<picture>
    <source srcset="media/small/ldap-diagram.svg" media="(max-width: 768px)">
    <img src="media/ldap-diagram.svg" alt="LDAP diagram">
</picture>

**Everything speaks the LDAP protocol langage.** Identities are stored in an LDAP directory, which is provisioned via LDAP protocol. Authentication is done by the  application that asks the user’s credentials and validates them against the directory via LDAP protocol.
{{< /switch-box >}}

{{< switch-box title="Ldap+SSO" >}}
This architecture **tackles the two main drawbacks of the only LDAP approach** : the missing single sign-on and the security vulnerability. **Authentication is delegated to other web protocols** (like OAuth, OIDC or SAML). This way, the user logs in only once to the identity provider.

<picture>
    <source srcset="media/small/ldap-sso-diagram.svg" media="(max-width: 768px)">
    <img src="media/ldap-sso-diagram.svg" alt="LDAP with SSO diagram">
</picture>
{{< /switch-box >}}


{{< switch-box title="SSO" >}}
On modern web infrastructure, LDAP started to be abandoned because **loose provisioning can also be done via SSO protocols.**

<picture>
    <source srcset="media/small/sso-diagram.svg" media="(max-width: 768px)">
    <img src="media/sso-diagram.svg" alt="SSO only diagram">
</picture>
{{< /switch-box >}}

{{< switch-box title="SSO+SCIM" >}}
**SCIM solve the remaining problems** via a simple standard web api. This infrastructure is **event driven, a provisioning action on the IdP is quickly passed on all applications.**

<picture>
    <source srcset="media/small/sso-scim-diagram.svg" media="(max-width: 768px)">
    <img src="media/sso-scim-diagram.svg" alt="SSO with SCIM diagram">
</picture>
{{< /switch-box >}}

| | LDAP | LDAP & SSO | SSO | SSO & SCIM |
| -------- | -------- | -------- | -------- | -------- |
| Easy to implement | {{< svg-render cross >}} <br> *Mature but old and difficult* | {{< svg-render cross >}} <br> *Mature but old and difficult* | {{< svg-render cross >}} {{< svg-render check >}} <br> *Simple and web native, but non-standard IdP* | {{< svg-render check >}} <br> *Cli or UI could be used on IdP or on apps* |
| Many implementations | {{< svg-render check  >}} | {{< svg-render check  >}} | {{< svg-render check  >}} | {{< svg-render cross >}} <br> *Not a lot of implementations yet* |
| Single sign-on | {{< svg-render cross >}} <br> *User must sign-on each application* | {{< svg-render check  >}} | {{< svg-render check  >}} | {{< svg-render check  >}} |
| No trust issues | {{< svg-render cross >}} <br> *Expose user’s credentials to each application* | {{< svg-render cross >}} <br> ***???????*** | {{< svg-render check >}} <br> *Zero trust in applications* | {{< svg-render check >}} <br> *Zero trust in applications* |
| Scalable provisioning | {{< svg-render cross >}} <br> *By diffing, each app reads all and compares it* | {{< svg-render cross >}} <br> *By diffing, each app reads all and compares it* | {{< svg-render check >}} <br> *No diffing, modern storage, SQL database can be used* | {{< svg-render check >}} <br> *Real time atomic provisioning* |
| Scalable provisioning | {{< svg-render cross >}} <br> *Only when apps trigger it or when the user logs in* | {{< svg-render cross >}} <br> *Only when apps trigger it or when the user logs in* | {{< svg-render cross >}} <br> *No way to remove a user from the application* | {{< svg-render check  >}} |
| GDPR Compliant | {{< svg-render cross  >}} | {{< svg-render cross  >}} | {{< svg-render cross  >}} | {{< svg-render check  >}} |