SCIM System Connector

Introduction

The System for Cross-domain Identity Management is a well-known standard for provisioning and managing users accross multiple domains. In a nutshell, it specifies a restful API that an application or a system has to expose that other systems then can use for provisioning and information retrieval purposes. The standard on a high-level is documented on the projects website (http://www.simplecloud.info/ ) and in a more detailed and technical fashion in the appropriate IEFT SCIM Core Schema documentation (https://datatracker.ietf.org/doc/html/rfc7643 ).

The CoreOne Suite SCIM System Connector allows you to provision users to any system that supports the SCIM standard. So if you are thinking about implementing an API for user management for your own applications and systems, SCIM is an easy way to do so that allows you to integrate easily with the CoreOne Suite while following a defined standard that might be used by other applications or systems as well.

System Identity Types

The following system identity types are supported:

Identity Type	Description
SCIM User	A default SCIM user with the properties defined in section Section 4.1 of rfc7643 (Standard User Schema) and Section 4.3 of rfc7643 (Enterprise User Schema). You can extend those properties by creation system identity type attributes in the CoreOne Suite Admin UI.

SCIM User

The following user attributes can be manged by default:

SCIM supports complex and multi value attributes. Attributes in the CoreOne Suite are - by default - flat objects. To simplify this use case the system identity type attributes follow a simple transformation. The complex SCIM name conists of a familyName, givenName and so on. Within the CoreOne Suite we simply track them as name.familyName, name.givenName and so on.

Attribute	Description
userName	The username of the user
`name`.formatted	The formatted name, similar to the display name
name.familyName	The family name of the user
name.givenName	The given name of the user
name.middleName	The middle name of the user
name.`honorificPrefix`	The honorific prefix(es) of the user
name.`honorificSuffix`	The honorific suffix(es) of the User
`displayName`	The display name of the user
`nickName`	The nick name of the user
`profileUrl`	An URI that locates a users profile
`title`	The title of the user
`userType`	The type of a user should an application or system support that
`preferredLanguage`	The prefered language in the format of Section 5.3.5 of rfc7231.
`locale`	The users default location as specified in https://datatracker.ietf.org/doc/html/rfc5646
`timezone`	The users time zone as specified in https://datatracker.ietf.org/doc/html/rfc6557
`active`	An indication whether the user is active or not
emails	A `multivalue` field with the users email addresses
phoneNumbers	A `multivalue` field with the users phone numbers
ims	A `multivalue` field with the users instanst messaging services
photos	A `multivalue` field with the users photos
addresses	A `multivalue` field with the users addresses

Note that the section 4.1.2 of rfc 7643 specifies a groups, entitlements and a roles attribute on the user. Those are managed via the assigned resources and not directly on the user itself.

System Resource Types

The following system resource types are supported:

Identity Type	Description
SCIM Group	A SCIM Group according to section 4.2 of rfc 7643

Target System Parameters

Whenever you connect a SAP system to the CoreOne Suite you will need to specify the following parameters.

Parameter	Mandatory	Example	Description
API base url	✅	https://scim.webapp.com	The base url of the SCIM endpoint
Login base url	✅	https://scim.webapp.com/login	The endpoint where the authentication for the SCIM endpoint has to be performed
Login username	✅	svc_cos	The user name to be used for authentication
Login passowrd	✅	🔑 * * * * * * *	The password of the user
Disable SSL Handshake	✅	false	If the SSL handshake can not be performed because of invalid certificates. Be very cautions with this and only disable it if really necessary.