System for Cross-domain Identity Management

From HandWiki
Short description: Application Programming Interface for user provisioning
System for Cross-domain Identity Management
StatusActive
First published2011 (2011)
Latest version2.0
September 2015 (2015-09)
OrganizationIETF
Base standardsJSON, XML
DomainIdentity management
AbbreviationSCIM
Websitetools.ietf.org/wg/scim/

System for Cross-domain Identity Management (SCIM) is a standard for automating the exchange of user identity information between identity domains, or IT systems.

One example might be that as a company onboards new employees and separates from existing employees, they are added and removed from the company's electronic employee directory. SCIM could be used to automatically add/delete (or, provision/de-provision) accounts for those users in external systems such as Google Workspace, Office 365, or Salesforce.com. Then, a new user account would exist in the external systems for each new employee, and the user accounts for former employees might no longer exist in those systems.

In addition to simple user-record management (creating and deleting), SCIM can also be used to share information about user attributes, attribute schema, and group membership. Attributes could range from user contact information to group membership. Group membership or other attribute values are generally used to manage user permissions. Attribute values and group assignments can change, adding to the challenge of maintaining the relevant data across multiple identity domains.[1]

The SCIM standard has grown in popularity and importance, as organizations use more SaaS tools.[2][3] A large organization can have hundreds or thousands of hosted applications (internal and external) and related servers, databases and file shares that require user provisioning. Without a standard connection method, companies must write custom software connectors to join these systems and their Identity Management (IdM) system.[4]

SCIM uses a standardised API through REST with data formatted in JSON or XML.[1]

History

The first version, SCIM 1.0, was released in 2011 by a SCIM standard working group organized under the Open Web Foundation.[5] In 2011, it was transferred to the IETF, and the current standard, SCIM 2.0 was released as IETF RFC in 2015.[2][6]

SCIM 2.0 was completed in September 2015 and is published as IETF RFCs 7643[7] and 7644.[8] A use-case document is also available as RFC 7642.[9]

The standard has been implemented in various IdM software.[10]

The standard was initially called Simple Cloud Identity Management (and is still called this in some places), but the name was officially changed to System for Cross-domain Identity Management (SCIM) when the IETF adopted it.[11]

Interoperability was demonstrated in October, 2011, at the Cloud Identity Summit, an IAM industry conference. There, user accounts were provisioned and de-provisioned across separate systems using SCIM standards, by a collection of IdM software vendors: Okta, CyberArk, Ping Identity, SailPoint, Technology Nexus and UnboundID.[3] In March 2012, at IETF 83 in Paris, interoperability tests continued by the same vendors, joined by Salesforce.com, BCPSoft, WSO2, Gluu, and Courion (now SecureAuth) nine companies in total.[12]

SCIM is the second standard for exchanging user data, but it builds on prior standards (e.g. SPML, PortableContacts, vCards, and LDAP directory services) in an attempt to be a simpler and more widely adopted solution for cloud services providers.[13][14]

The SCIM standard is growing in popularity and has been adopted by numerous identity providers (e.g. Azure Active Directory,[15] Okta[16]) as well as applications (e.g. Dynamic Signal,[17] Zscaler,[18] Dropbox,[19] and Perimeter81[20]). As adoption of the standard grows, so do the number of tools available. The standard leverages a number of open-source libraries[21] to facilitate development and testing frameworks[22] ensure that endpoint's compliance with the SCIM standard.

References

  1. ↑ 1.0 1.1 Internet Engineering Task Force, Network Working Group (May 11, 2015). System for Cross-Domain Identity Management: Core Schema. http://tools.ietf.org/html/draft-ietf-scim-core-schema-19. Retrieved 2015-05-17. 
  2. ↑ 2.0 2.1 Wilson, Neil (June 22, 2011). "SCIMming along...". UnboundID blog. https://www.unboundid.com/blog/2011/06/22/scimming-along. Retrieved May 11, 2015. 
  3. ↑ 3.0 3.1 "Identity Management Companies To Demonstrate Simple Cloud Identity Management (SCIM) Specification at Internet Identity Workshop (IIW)" (Press release). SailPoint. October 18, 2011. Archived from the original on 2016-03-04. Retrieved May 11, 2015.
  4. ↑ Grizzle, Kelly (March 10, 2014). "SCIM: Provisioning users, killing connectors". SecureID News (SecureID). http://www.secureidnews.com/news-item/scim-provisioning-users-killing-connectors/. Retrieved May 17, 2015. 
  5. ↑ "SCIM Overview". Simple Cloud Identity Management. https://scim.cloud/#overview. Retrieved May 17, 2015. 
  6. ↑ Internet Engineering Task Force, Network Working Group (August 2, 2012). System for Cross-Domain Identity Management: Core Schema 1.1. https://tools.ietf.org/html/draft-scim-core-schema-01. Retrieved 2015-05-11. 
  7. ↑ Hunt, Phil; Grizzle, Kelly; Wahlstroem, Erik; Mortimore, Chuck (September 2015). RFC 7643: System for Cross-domain Identity Management: Core Schema. Internet Engineering Task Force. http://tools.ietf.org/html/rfc7643. 
  8. ↑ Hunt, Phil; Grizzle, Kelly; Ansari, Morteza; Wahlstroem, Erik; Mortimore, Chuck (September 2015). RFC 7644: System for Cross-domain Identity Management: Protocol. Internet Engineering Task Force. http://tools.ietf.org/html/rfc7644. 
  9. ↑ Li, Kepeng; Hunt, Phil; Khasnabish, Bhumip; Nadalin, Anthony; Zeltsan, Zachary (September 2015). RFC 7642: System for Cross-domain Identity Management: Definitions, Overview, Concepts, and Requirements. Internet Engineering Task Force. http://tools.ietf.org/html/rfc7642. 
  10. ↑ "Known SCIM implementations". Simple Cloud Identity Management. https://scim.cloud/#implementations. 
  11. ↑ Hunt, Phil (February 27, 2014). "Standards Corner: SCIM and the Shifting Enterprise Identity Center of Gravity". Oracle. https://blogs.oracle.com/fusionmiddleware/entry/standards_corner_scim_and_the. Retrieved May 17, 2015. 
  12. ↑ "Logistics and attendee info for the March 2012 SCIM interop event". April 26, 2012. https://code.google.com/p/scim/wiki/FirstInteropEvent. Retrieved May 11, 2015. 
  13. ↑ "SCIM: How It Works" (Article). https://www.pingidentity.com/en/resources/client-library/articles/scim.html. Retrieved July 28, 2020. 
  14. ↑ Internet Engineering Task Force, Network Working Group (September 2015). System for Cross-Domain Identity Management: Core Schema. https://datatracker.ietf.org/doc/html/rfc7643#section-1. Retrieved 2023-05-19. 
  15. ↑ "Tutorial - Develop a SCIM endpoint for user provisioning to apps from Azure Active Directory". https://docs.microsoft.com/azure/active-directory/manage-apps/use-scim-to-provision-users-and-groups. 
  16. ↑ "SCIM Protocol". https://developer.okta.com/docs/reference/scim/. 
  17. ↑ "Connect Dynamic Signal to Azure Active Directory for User Provisioning – Dynamic Signal". https://support.dynamicsignal.com/hc/en-us/articles/360030415372-Connect-Dynamic-Signal-to-Azure-Active-Directory-for-User-Provisioning. 
  18. ↑ "SAML & SCIM Configuration Guide for Azure Active Directory | Zscaler". https://help.zscaler.com/zia/saml-scim-configuration-guide-azure-active-directory. 
  19. ↑ "Update to the newest Dropbox for Business application using Azure AD". https://help.dropbox.com/installs-integrations/third-party/update-dropbox-azure-ad-connector. 
  20. ↑ "Azure Active Directory (SCIM)". https://support.perimeter81.com/docs/azure-active-directory. 
  21. ↑ "Provisioning with SCIM – design, build, and test your SCIM endpoint". 2 March 2020. https://techcommunity.microsoft.com/t5/identity-standards-blog/provisioning-with-scim-design-build-and-test-your-scim-endpoint/ba-p/1204883. 
  22. ↑ "Test Your SCIM Endpoint · AzureAD/SCIMReferenceCode Wiki". https://github.com/AzureAD/SCIMReferenceCode/wiki/Test-Your-SCIM-Endpoint. 

External links



Retrieved from "https://handwiki.org/wiki/index.php?title=System_for_Cross-domain_Identity_Management&oldid=3375450"