Versions Compared

Version Old Version 6 New Version 7
Changes made by

Silvan Grüter

Luca Kurmann

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

The following system identity types are supported:

Identity Type

Description

SCIM User

A default SCIM user with the properties defined in section Section 4.1 of rfc7643 (Standard User Schema) and Section 4.3 of rfc7643 (Enterprise User Schema). You can extend those properties by creation system identity type attributes in the CoreOne Suite Admin UI.

SCIM User

The following user attributes can be manged by default:

Info

SCIM supports complex and multi value attributes. Attributes in the CoreOne Suite are - by default - flat objects. To simplify this use case the system identity type attributes follow a simple transformation. The complex SCIM name conists of a familyName, givenName and so on. Within the CoreOne Suite we simply track them as name.familyName, name.givenName and so on.

Attribute

Description

userName

The username of the user

name.formatted

The formatted name, similar to the display name

name.familyName

The family name of the user

name.givenName

The given name of the user

name.middleName

The middle name of the user

name.honorificPrefix

The honorific prefix(es) of the user

name.honorificSuffix

The honorific suffix(es) of the User

displayName

The display name of the user

nickName

The nick name of the user

profileUrl

An URI that locates a users profile

title

The title of the user

userType

The type of a user should an application or system support that

preferredLanguage

The prefered language in the format of Section 5.3.5 of rfc7231.

locale

The users default location as specified in https://datatracker.ietf.org/doc/html/rfc5646

timezone

The users time zone as specified in https://datatracker.ietf.org/doc/html/rfc6557

active

An indication whether the user is active or not

emails

A multivalue field with the users email addresses

phoneNumbers

A multivalue field with the users phone numbers

ims

A multivalue field with the users instanst messaging services

photos

A multivalue field with the users photos

addresses

A multivalue field with the users addresses

Info

Note that the section 4.1.2 of rfc 7643 specifies a groups, entitlements and a roles attribute on the user. Those are managed via the assigned resources and not directly on the user itself.

...

The following system resource types are supported:

Identity Type

Description

SCIM Group

A SCIM Group according to section 4.2 of rfc 7643

Target System Parameters

Whenever you connect a SAP system to the CoreOne Suite you will need to specify the following parameters.

Parameter

Mandatory

Example

Description

API base url

✅

https://scim.webapp.com

The base url of the SCIM endpoint

Login base url

❌

https://scim.webapp.com/login

The endpoint where the authentication for the SCIM endpoint has to be performed

This URL gets called together with the Username and Password as HTTP Basic Authentication request and has to return a Bearer Token in the form of { Token: ““ }

Login username

❌

svc_cos

The user name to be used for authentication

Login passowrd

❌

🔑 * * * * * * *

The password of the user

Disable SSL Handshake

✅

false

If the SSL handshake can not be performed because of invalid certificates. Be very cautions with this and only disable it if really necessary.

Scim operation mode - identity

✅

Updates done via PATCH method

Defines with which HTTP method identity updates should be sent. Currently PATCH and PUT are supported

Scim operation mode - resource

✅

Updates done via PATCH method

Defines with which HTTP method resource updates should be sent. Currently PATCH and PUT are supported

Scim default missing values

✅

false

If true, sets all the missing attributes on the entity sent back by the target system to the default values of their respective data types. Usually the target system sends back the whole entity with all attributes so this doesn’t need to be enabled.

Context Assignment

The SCIM Connector supports the assignment context as described here. As this assignment context is not part of the standard definition in SCIM, we made use of SCIMs capability to extend the schema. Whenever an assignment is made with a context, first the assignment context transformations are applied and then they are provisioned in as the relations property.

...

Info

Note: We still pass the members path, even if the system supports the context. The regular members path should be ignored by the system.

Identity functions

The following identity functions are supported:

Function (task feature)

Supported

create/delete identities

(tick)

provisioning identities 

(tick)

update identities          

(tick)

provisioning identity updates   

(tick)

deprovision identities  

(tick)

cleanup of inactive identities active

-

check password changed active

-

Resources functions

The following resource functions are supported:

Function (task feature)

Supported

create/delete resources

(tick)

provision resources     

(tick)

update resources         

(tick)

provisioning resource changes 

(tick)

deprovisioning resources         

(tick)

provisioning resource allocations         

(tick)

deprovisioning resource allocations     

(tick)

provisioning resources-resource allocations     

-

Deprovisioning resource resource allocations   

-

 

Cleanup functions

The following cleanup functions are supported:

Function (task feature)

Supported

Is available in the expected/actual comparison log          

(tick)

Clean up expected/actual

-

Read back user account properties

-

Resource identity assignments Target system cleanup  

-

Resource-resource assignments Target system cleanup 

-