Master IAM in the Cloud with SCIM v2.0

Master IAM in the Cloud with SCIM v2.0Kelly GrizzleSoftware Architect – SailPoint

Copyright © SailPoint Technologies, Inc. 2016 All rights reserved.

Overview

• What is SCIM?• Use Cases• Your special snowflake• Differences between 1.1 and 2.0• What's coming?• Adoption

What is SCIM?System for Cross-Domain Identity Management


Identity Management+

REST=


Identity Management + REST = SCIM

• REST is just architectural pattern- SCIM defines an identity management profile for it

• SCIM provides…- Standard definitions for User and Group

• Expressed in JSON (Javascript Object Notation)- Standard operations

• Create, Read, Update, Delete, Search, Partial Update, Bulk- Extensibility

• Add more attributes to existing object types or define new object types


Example – Retrieve User Request

GET /Users/2819c223-7f76-453a-919d-413861904646Host: example.comAccept: application/scim+jsonAuthorization: Bearer h480djs93hd8


Example – Retrieve User ResponseHTTP/1.1 200 OKContent-Type: application/scim+jsonLocation: https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646{ "schemas":["urn:ietf:params:scim:schemas:core:2.0:User"], "id": "2819c223-7f76-453a-919d-413861904646", "name": { "formatted": "Ms. Barbara J Jensen III", "familyName": "Jensen", "givenName": "Barbara“ }, "meta": { "resourceType": "User", "created": "2011-08-01T18:29:49.793Z", ... }}

Self-describingpayload

Single-valuedattribute

Complexattribute

Manydata types

https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646

Use CasesSCIM … huh … yeah … what is it good for? Absolutely … LOTS!


Use Cases

• Create account• Add or remove access to a user• Read a user’s current access so that it can be certified• Terminate a user• Provide user information for a corporate directory• Synchronize user information from one application to another

Is your identity management API a special snowflake?


It seemed like such a good idea … until…It looks so beautiful … until …you have to integrate with it.


And you end up with something like this…

OR

Differences between SCIM v1.1 and v2.0


EXTENSIBILITY=


SCIM 2.0 is much more extensible

• The BIGGEST and BEST change since SCIM 1.1• A server can define

- Extensions to core objects (users and groups)• Need to store your users’ favorite tattoo parlors? No problem!

- Completely new types of objects• Roles, profiles, oauth clients, toasters, whatever the heck you want!

- Relationships between objects• This toaster belongs to this user

• A client can ask the server to describe itself


Other goodies

• Simplified PATCH (partial update of objects)• Secure searching (POST to /.search endpoint)

- In case this bothers you - GET /Users?filter=ssn eq “379-941-9832”• Add /Me endpoint to retrieve authenticated user’s information• Reference data type to describe relationships• General hardening of the slushy spots in the spec


Is 2.0 Backwards Compatible?

Short answer – No … but it’s not that different.

• Things to look out for…- New /ResourceTypes endpoint and changes to /Schemas- Addition of meta.resourceType to each resource- References (eg – manager) now use $ref syntax- PATCH syntax was reworked

What’s new with SCIM?Cha…cha…cha…cha…changes!


What’s new?

• Polling- Ability to ask for recent changes

• Events- Clients can subscribe to a server to be notified about changes

• Discovery- Use /.well-known/scim to get basic information about a SCIM

server• TIER (Trust & Identity in Education & Research)

- Internet2 group is creating standardized EduUser and EduGroup extensions

SCIM AdoptionWho is using it?


Also … within organizations

• Many organizations are using SCIM as their internal identity management API

• Often use a “SCIM Gateway” at the center of their infrastructure• Benefits

- Simplifies adding new systems into the environment- Isolates disruptions from change (eg – changing ERP vendor)- Prevents reinventing the wheel- Ease of implementation by using existing libraries

• The spec is also relatively straight-forward and easy to implement


SCIM 2.0 is the way to go!

Questions?@[email protected]

http://simplecloud.info

SCIM Master Class

Wednesday2:30 – 3:20: User Provisioning 1013:30 – 4:20: SCIM 2 in Depth4:30 – 5:20: SCIM 2 Interop Report