SCIM is a standard interface to manage Users/Roles/Groups. It is based on REST. The interface is described in http://www.simplecloud.info/
CoreOne can connect to target systems using SCIM and provision there users and groups. The target system has to implement SCIM correctly - there are many small discrepancies between existing implementations. Please check below implementation details to see if your system supports SCIM.
Set up target system
Target system attribute | Description |
|---|---|
SCIM base URL | Specification of the base URL of the SCIM API interface, incl. schema, domain and path (like https://localhost:44319/scim) |
SCIM login URL | Specification of the URL for token endpoint (username and password is only supported authentication method for now). CoreOne uses the token to authenticate in SCIM endpoint |
SCIM login username | Username to be used for login |
SCIM login password | Password to be used for login |
Disable SSL handshake | Checkbox → if selected, the SSL certificate check is skipped, e.g. if no valid certificate is available. Should be avoided in principle |
Operations
Below you can find what are exact requests that CoreOne will make to other SCIM system. Please check if your system supports them.
Let’s assume we provision some standard attributes:
userName,
name.givenName,
name.familyName,
emails.value
SCIM allows for multivalue attributes - like email but it is not supported by CoreOne for now.
Create user
URL | /scim/users |
HTTP Verb | POST |
Body | {
"userName":"John Novak",
"name": {
"givenName":"John",
"familyName":"Novak"
},
"emails":[{
"value":"john.novak@swiss.ch",
"primary":true
}]
}
|
Remarks | As you can see the primary subattribute was added. CoreOne does not support multivalue and will only work with primary values. In response CoreOne should get the newly created user data. The only attribute that it needs is id that will be written in CoreOne database. |
Update user
URL | /scim/users/{user_id} |
HTTP Verb | PATCH |
Body | {
"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
"Operations": [{
"Path":"userName",
"Op":"Replace",
"Value":"NewUserName"
},
{
"Path":"name.givenName",
"Op":"Replace",
"Value":"NewGivenName"
},
{
"Path":"emails[primary eq true].value",
"Op":"Replace",
"Value":"updatedMail@swiss.ch"
}]
}
|
Remarks | SCIM allows to do update in a few ways (with path/without, with full attribute name or short one). CoreOne specifies all changes as separate operations. All operations have Path property with short name of attribute to change and Op property equals to Replace. For multivalue attributes (like email) the change is applied to the item with Primary property set to true. Only the attributes that changed will be send to the target system. |
Select users
URL | /scim/users |
HTTP Verb | GET |
Body | - |
Remarks | Should return the collection of users according to SCIM specification. To check if attributes are unique CoreOne uses To get matching users based on username CoreOne uses |
Select user
URL | /scim/users/{user_id} |
HTTP Verb | GET |
Body | - |
Remarks | Should return the collection of users according to SCIM specification. To get the groups assigned to user CoreOne uses |
Delete user
URL | /scim/users/{user_id} |
HTTP Verb | DELETE |
Body | - |
Remarks | - |
CRUD group
Group support is similar to users. When querying groups target system should return members attribute.
Assign Member
URL | /scim/groups/{group_id} |
HTTP Verb | PATCH |
Body | {
"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
"Operations": [{
"op": "add",
"path": "members",
"value": [{"value": "c6eda4fd-e7ab-490a-a1e6-17fbca28b2ed"}]
}]
}
|
Remarks | value.value in above example holds user id |
Remove Member
URL | /scim/groups/{group_id} |
HTTP Verb | PATCH |
Body | {
"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
"Operations": [{
"op": "remove",
"path": "members",
"value": [{"value": "c6eda4fd-e7ab-490a-a1e6-17fbca28b2ed"}]
}]
}
|
Remarks | value.value in above example holds user id |