Versions Compared

Version Old Version 7 New Version 8
Changes made by

Witold Wabik

Witold Wabik

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

SCIM is a standard interface to manage Users/Roles/Groups. It is based on REST. The interface is described in http://www.simplecloud.info/

CoreOne can connect to other target systems using SCIM and provision there users and groups. The other target system has to implement SCIM correctly - there are many small discrepencies discrepancies between existing implementations. Please check below implementation details to see if your system supports SCIM.

...

URL

/scim/users

HTTP Verb

POST

Body

Code Block
{
  "userName":"John Novak",
  "name":  {
    "givenName":"John",
    "familyName":"Novak"
    },
  "emails":[{
    "value":"john.novak@swiss.ch",
    "primary":true
  }]
}

Remarks

As you can see the primary subattribute was added. CoreOne does not support multivalue and will only work with primary values.

In response CoreOne should get the newly created user data. The only attribute that it needs is id that will be written in CoreOne database.

Update user

URL

/scim/users/{user_id}

HTTP Verb

PATCH

Body

Code Block
{
"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
"Operations": [{
  "Path":"userName",
  "Op":"Replace",
  "Value":"NewUserName"
  },
  {
  "Path":"name.givenName",
  "Op":"Replace",
  "Value":"NewGivenName"
  },
  {
  "Path":"emails[primary eq true].value",
  "Op":"Replace",
  "Value":"updatedMail@swiss.ch"
  }]
}

Remarks

SCIM allows to do update in a few ways (with path/without, with full attribute name or short one).

CoreOne specifies all changes as separate operations. All operations have Path property with short name of attribute to change and Op property equals to Replace.

For multivalue attributes (like email) the change is applied to the item with Primary property set to true.

Only the attributes that changed will be send to the target system.

Select users

URL

/scim/users

HTTP Verb

GET

Body

-

Remarks

Should return the collection of users according to SCIM specification.

To check if attributes are unique CoreOne uses /?filter={propertyName} eq "{value}"

To get matching users based on username CoreOne uses /?filter=userName co "{searchValue}"&startIndex=1&count={maxResult}

Select user

URL

/scim/users/{user_id}

HTTP Verb

GET

...

Body

-

Remarks

Should return the collection of users according to SCIM specification.

To get the groups assigned to user CoreOne uses /?attributes=groups

Delete user

URL

/scim/users/{user_id}

HTTP Verb

DELETE

Create group

...

Body

-

Remarks

-

CRUD group

Group support is similar to users. When querying groups target system should return members attribute.

Assign Member

URL

/scim/groups/{group_id}

HTTP Verb

PATCH

Body

Code Block
{
"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
"Operations": [{
    "op": "add",
    "path": "members",
    "value": [{"value": "c6eda4fd-e7ab-490a-a1e6-17fbca28b2ed"}]
}]
}

Remarks

value.value in above example holds user id

Remove Member

URL

/scim/groups/{group_id}

...

HTTP Verb

PATCH

Body

Code Block
{
"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
"Operations": [{
    "op": "remove",
    "path": "members",
    "value": [{"value": "c6eda4fd-e7ab-490a-a1e6-17fbca28b2ed"}]
}]
}

Remarks

value.value in above example holds user id