SCIM  1.1  Interop  

Cloud  Iden1ty  Summit  2013  

example  SCIM  topology  

Externally  HostedOn-­‐Premises Create  user

(HTTP  POST)

Identity  system(SCIM  consumer)

SaaS  application(SCIM  service  provider)

example  SCIM  topology  

Externally  HostedOn-­‐Premises

Active  Directory

Create  user(HTTP  PO

ST)

Directory  syncIdentity  system(SCIM  consumer)

SaaS  application(SCIM  service  provider)

SCIM  iden1ty  bridge  

Externally  Hosted

On-­‐Premises

Active  Directory

LDAP

SCIM

SCIM  consumer

API

Partner’s  provisioning  IDaaS

Web  application

API  or  

SCIM

SCIM  consumerSCIM  providerDirectory  sync

OAuth  resource  server

IdentityBridge

Interoppers  service  provider consumercisco sailpointpi  pingfederate sailpointpi  pingfederate unboundidpi  pingone nexuspi  pingone wso2salesforce sailpointsalesforce nexussalesforce wso2salesforce pi  pingfederateunboundid pi  pingfederateunboundid pi  pingoneunboundid wso2wso2 sailpoint

Interop  tests  Category Test # Test NameUser creation 1.1 Create five users.

2.1 List one user (1.1) with attributes parameter via query to resource.2.2 List one user (1.1) with filter via query to resource endpoint.2.3 List users (1.1) with attributes parameter via query to resource endpoint.3.1 Update user (1.1) via PUT.3.2 Update user (1.1) via PATCH.3.3 Change password for user (1.1). Verify by authenticating with server natively if possible.

Group creation 4.1 Create two groups.5.1 List one group (4.1) with attributes parameter via query to resource.5.2 List one group (4.1) with filter via query to resource endpoint.5.3 List groups (4.1) with attributes parameter via query to resource endpoint.6.1 Add user (1.1 ) to group (4.1) via PUT.6.2 Remove user (1.1) from group (4.1) via PUT.6.3 Add user (1.1) to group (4.1) via PATCH.6.4 Remove user (1.1) from group (4.1) via PATCH.

User deletion 7.1 Delete user (1.1).8.1 Create two users.8.2 Update two users (8.1) via PATCH.8.3 Create two users via PUT, then create group via PUT with users' id attribute.8.4 Remove users (8.3) from group (4.1) via PATCH, then delete two users (8.3).

ServiceProviderConfig retrieval 9.1 Retrieve service provider config.Schema retrieval 10.1 Retrieve user and group schemas.

Group update

Bulk operation

User list

User update

Group list

unbound(sp)<-­‐>pingfederate  

Category Test Number Test Name unboundid pingfederateUser creation 1.1 Create five users. yes yes

2.1 List one user (1.1) with attributes parameter via query to resource. yes no2.2 List one user (1.1) with filter via query to resource endpoint. yes no2.3 List users (1.1) with attributes parameter via query to resource endpoint. yes no3.1 Update user (1.1) via PUT. yes yes3.2 Update user (1.1) via PATCH. yes no3.3 Change password for user (1.1). Verify by authenticating with server natively if possible. yes no

Group creation 4.1 Create two groups. yes no5.1 List one group (4.1) with attributes parameter via query to resource. yes no5.2 List one group (4.1) with filter via query to resource endpoint. yes no5.3 List groups (4.1) with attributes parameter via query to resource endpoint. yes no6.1 Add user (1.1 ) to group (4.1) via PUT. yes no6.2 Remove user (1.1) from group (4.1) via PUT. yes no6.3 Add user (1.1) to group (4.1) via PATCH. yes no6.4 Remove user (1.1) from group (4.1) via PATCH. yes no

User deletion 7.1 Delete user (1.1). yes yes8.1 Create two users. yes no8.2 Update two users (8.1) via PATCH. yes no8.3 Create two users via PUT, then create group via PUT with users' id attribute. yes no8.4 Remove users (8.3) from group (4.1) via PATCH, then delete two users (8.3). yes no

ServiceProviderConfig retrieval 9.1 Retrieve service provider config. yes noSchema retrieval 10.1 Retrieve user and group schemas. yes no

User list

User update

Group list

Group update

Bulk operation

unboundid(sp)<-­‐>pingone  

Category Test Number Test Name unboundid pingoneUser creation 1.1 Create five users. yes yes

2.1 List one user (1.1) with attributes parameter via query to resource. yes yes2.2 List one user (1.1) with filter via query to resource endpoint. yes2.3 List users (1.1) with attributes parameter via query to resource endpoint. yes3.1 Update user (1.1) via PUT. yes yes3.2 Update user (1.1) via PATCH. yes3.3 Change password for user (1.1). Verify by authenticating with server natively if possible.yes

Group creation 4.1 Create two groups. yes yes5.1 List one group (4.1) with attributes parameter via query to resource. yes5.2 List one group (4.1) with filter via query to resource endpoint. yes5.3 List groups (4.1) with attributes parameter via query to resource endpoint. yes6.1 Add user (1.1 ) to group (4.1) via PUT. yes yes6.2 Remove user (1.1) from group (4.1) via PUT. yes yes6.3 Add user (1.1) to group (4.1) via PATCH. yes6.4 Remove user (1.1) from group (4.1) via PATCH. yes

User deletion 7.1 Delete user (1.1). yes yes8.1 Create two users. yes8.2 Update two users (8.1) via PATCH. yes8.3 Create two users via PUT, then create group via PUT with users' id attribute. yes8.4 Remove users (8.3) from group (4.1) via PATCH, then delete two users (8.3). yes

ServiceProviderConfig retrieval 9.1 Retrieve service provider config. yes yesSchema retrieval 10.1 Retrieve user and group schemas. yes yes

User list

User update

Group list

Group update

Bulk operation

salesforce(sp)<-­‐>sailpoint  

Category Test Number Test Name salesforce sailpointUser creation 1.1 Create five users. yes yes

2.1 List one user (1.1) with attributes parameter via query to resource. yes no2.2 List one user (1.1) with filter via query to resource endpoint. no

2.3 List users (1.1) with attributes parameter via query to resource endpoint. yes yes3.1 Update user (1.1) via PUT. no

3.2 Update user (1.1) via PATCH. yes no3.3 Change password for user (1.1). Verify by authenticating with server natively if possible. no

Group creation 4.1 Create two groups. yes

5.1 List one group (4.1) with attributes parameter via query to resource. no

5.2 List one group (4.1) with filter via query to resource endpoint. no

5.3 List groups (4.1) with attributes parameter via query to resource endpoint. list only yes6.1 Add user (1.1 ) to group (4.1) via PUT. no

6.2 Remove user (1.1) from group (4.1) via PUT. no

6.3 Add user (1.1) to group (4.1) via PATCH. yes(Entitlements) no6.4 Remove user (1.1) from group (4.1) via PATCH. yes(Entitlements) no

User deletion 7.1 Delete user (1.1). yes(Deactivate) yes8.1 Create two users. no

8.2 Update two users (8.1) via PATCH. no

8.3 Create two users via PUT, then create group via PUT with users' id attribute. no

8.4 Remove users (8.3) from group (4.1) via PATCH, then delete two users (8.3). no

ServiceProviderConfig retrieval 9.1 Retrieve service provider config. yes yesSchema retrieval 10.1 Retrieve user and group schemas. user only yes

User list

User update

Group list

Group update

Bulk operation

salesforce(sp)<-­‐>wso2  

Category Test Number Test Name salesforce wso2User creation 1.1 Create five users. yes yes

2.1 List one user (1.1) with attributes parameter via query to resource. yes No

2.2 List one user (1.1) with filter via query to resource endpoint. noyes(for userNa

2.3 List users (1.1) with attributes parameter via query to resource endpoint. yes No

3.1 Update user (1.1) via PUT. no Yes

3.2 Update user (1.1) via PATCH. yes No

3.3 Change password for user (1.1). Verify by authenticating with server natively if possible. no Yes

Group creation 4.1 Create two groups. yes Yes

5.1 List one group (4.1) with attributes parameter via query to resource. no No

5.2 List one group (4.1) with filter via query to resource endpoint. no Yes

5.3 List groups (4.1) with attributes parameter via query to resource endpoint. list only No

6.1 Add user (1.1 ) to group (4.1) via PUT. no Yes

6.2 Remove user (1.1) from group (4.1) via PUT. no Yes

6.3 Add user (1.1) to group (4.1) via PATCH. yes(Entitlements) No

6.4 Remove user (1.1) from group (4.1) via PATCH. yes(Entitlements) No

User deletion 7.1 Delete user (1.1). yes(Deactivate) Yes

8.1 Create two users. no Yes

8.2 Update two users (8.1) via PATCH. no No

8.3 Create two users via PUT, then create group via PUT with users' id attribute. no No

8.4 Remove users (8.3) from group (4.1) via PATCH, then delete two users (8.3). no No

ServiceProviderConfig retrieval 9.1 Retrieve service provider config. yes No

Schema retrieval 10.1 Retrieve user and group schemas. user only No

Group update

Bulk operation

User list

User update

Group list

salesforce(sp)<-­‐>pingfederate  

Category Test Number Test Name salesforce pingfederateUser creation 1.1 Create five users. yes yes

2.1 List one user (1.1) with attributes parameter via query to resource. yes no2.2 List one user (1.1) with filter via query to resource endpoint. no no2.3 List users (1.1) with attributes parameter via query to resource endpoint. yes no3.1 Update user (1.1) via PUT. no yes3.2 Update user (1.1) via PATCH. yes no3.3 Change password for user (1.1). Verify by authenticating with server natively if possible. no no

Group creation 4.1 Create two groups. yes no5.1 List one group (4.1) with attributes parameter via query to resource. no no5.2 List one group (4.1) with filter via query to resource endpoint. no no5.3 List groups (4.1) with attributes parameter via query to resource endpoint. list only no6.1 Add user (1.1 ) to group (4.1) via PUT. no no6.2 Remove user (1.1) from group (4.1) via PUT. no no6.3 Add user (1.1) to group (4.1) via PATCH. yes(Entitlements) no6.4 Remove user (1.1) from group (4.1) via PATCH. yes(Entitlements) no

User deletion 7.1 Delete user (1.1). yes(Deactivate) yes8.1 Create two users. no no8.2 Update two users (8.1) via PATCH. no no8.3 Create two users via PUT, then create group via PUT with users' id attribute. no no8.4 Remove users (8.3) from group (4.1) via PATCH, then delete two users (8.3). no no

ServiceProviderConfig retrieval 9.1 Retrieve service provider config. yes noSchema retrieval 10.1 Retrieve user and group schemas. user only no

User list

User update

Group list

Group update

Bulk operation

pingfederate(sp)<-­‐>sailpoint  

Category Test Number Test Name pi pingfederate sailpointUser creation 1.1 Create five users. yes yes

2.1 List one user (1.1) with attributes parameter via query to resource. yes no2.2 List one user (1.1) with filter via query to resource endpoint. no2.3 List users (1.1) with attributes parameter via query to resource endpoint. no3.1 Update user (1.1) via PUT. yes yes3.2 Update user (1.1) via PATCH. no3.3 Change password for user (1.1). Verify by authenticating with server natively if possible.yes yes

Group creation 4.1 Create two groups. no5.1 List one group (4.1) with attributes parameter via query to resource. no5.2 List one group (4.1) with filter via query to resource endpoint. no5.3 List groups (4.1) with attributes parameter via query to resource endpoint. no6.1 Add user (1.1 ) to group (4.1) via PUT. no6.2 Remove user (1.1) from group (4.1) via PUT. no6.3 Add user (1.1) to group (4.1) via PATCH. no6.4 Remove user (1.1) from group (4.1) via PATCH. no

User deletion 7.1 Delete user (1.1). yes yes8.1 Create two users. no8.2 Update two users (8.1) via PATCH. no8.3 Create two users via PUT, then create group via PUT with users' id attribute. no8.4 Remove users (8.3) from group (4.1) via PATCH, then delete two users (8.3). no

ServiceProviderConfig retrieval 9.1 Retrieve service provider config. yes yes

Schema retrieval 10.1 Retrieve user and group schemas. no

User list

User update

Group list

Group update

Bulk operation

wso2(sp)<-­‐>pingone  

Category Test Number Test Name wso2 pingoneUser creation 1.1 Create five users. yes yes

2.1 List one user (1.1) with attributes parameter via query to resource. No NA2.2 List one user (1.1) with filter via query to resource endpoint. yes(for userName attribute only) yes2.3 List users (1.1) with attributes parameter via query to resource endpoint. No NA3.1 Update user (1.1) via PUT. Yes yes3.2 Update user (1.1) via PATCH. No NA3.3 Change password for user (1.1). Verify by authenticating with server natively if possible. Yes yes

Group creation 4.1 Create two groups. Yes yes5.1 List one group (4.1) with attributes parameter via query to resource. No NA5.2 List one group (4.1) with filter via query to resource endpoint. Yes yes5.3 List groups (4.1) with attributes parameter via query to resource endpoint. No NA6.1 Add user (1.1 ) to group (4.1) via PUT. Yes yes6.2 Remove user (1.1) from group (4.1) via PUT. Yes yes6.3 Add user (1.1) to group (4.1) via PATCH. No NA6.4 Remove user (1.1) from group (4.1) via PATCH. No NA

User deletion 7.1 Delete user (1.1). Yes yes8.1 Create two users. Yes yes8.2 Update two users (8.1) via PATCH. No NA8.3 Create two users via PUT, then create group via PUT with users' id attribute. No No8.4 Remove users (8.3) from group (4.1) via PATCH, then delete two users (8.3). No NA

ServiceProviderConfig retrieval 9.1 Retrieve service provider config. No NASchema retrieval 10.1 Retrieve user and group schemas. No NA

User list

User update

Group list

Group update

Bulk operation

Ac1ve  Directory  Oracle  Directory  Server  

Monitor  Directory  for  User  Changes  (Create,  Update,  Delete/Disable)  

SCIM  

SCIM  Consumer   SCIM  Service  Provider  

Create,  Update,  Delete  Users  

SaaS  Provider  

Benefits  •  Synchronize  local  corporate  directory  

accounts  with  the  UnboundID  Iden1ty  Data  PlaOorm  

 

Iden-ty  Data  Pla2orm  

Ac1ve  Directory  Oracle  Directory  Server  

Monitor  Directory  for  User  Changes  (Create,  Update,  Delete/Disable)  

SCIM  Consumer   SCIM  Service  Provider  

Benefits  •  Synchronize  local  corporate  directory  

accounts  with  Salesforce  •  Enable  Single  Sign-­‐On  between  

workforce  to  Salesforce  

SCIM  Create,  Update,  Disable  Users  

SAML  SSO  

Active  Directory

HostedOn-­‐Premises

PingFederate

IdentityIQSCIM

Service  ProviderSCIM

Consumer

SCIMService  Provider

(1)  Identity  pull  via  SCIM

(2)  Identity

 push  via  SCIM

(3)  Add/Delete/Modify

(5)  SAML  SSO

User

(4)  Kerbe

ros  SSO

Benefits

*  Authoritative  cloud  identity  store*  Workflow,  identity  and  access  governance*  SSO  from  Desktop  to  SaaSSeamless  provisioning

CRUD  users  and  access  using  SSO  

Authen1cate  

RDP  

HTTP  

SAML  

X509  

SAML   User  Storages  

User  aYributes  

User  data  

Benefits:  •   Easier  onboarding  of  new  services  •   Iden1ty  life  cycle  management    •   Easier  single  sign  on  •   Control  access  to  local  or  cloud  systems    

CRUD  users  and  access  using  SSO  

RDP  

HTTP  

HTTP  

Authen1cate  

X509  

SAML   User  Storages  

User  aYributes  

User  data  

Benefits:  •   Easier  onboarding  of  new  services  •   Iden1ty  life  cycle  management    •   Easier  single  sign  on  •   Control  access  to  local  or  cloud  systems