Download as PDF, PPTX
![@briandemers / @mraible
User Object
{ "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
"id":"2819c223-7f76-453a-919d-413861904646",
"externalId":"dschrute",
"userName":"dschrute",
"name":{
"formatted": "Mr. Dwight K Schrute, III",
"familyName": "Schrute",
"givenName": "Dwight",
"middleName": "Kurt",
"honorificPrefix": "Mr.",
"honorificSuffix": "III"
},
"phoneNumbers":[{
"value":"555-555-8377", "type": "work"}],
"emails":[{
"value":"dschrute@example.com", "type":"work", "primary": true}],
"meta":{
"resourceType": "User",
"created":"2011-08-01T18:29:49.793Z",
"lastModified":"2011-08-01T18:29:49.793Z",
"location":"https:./example.com/v2/Users/2819c223..."}}
application/scim+json](https://cdn.statically.io/img/image.slidesharecdn.com/keepidentitiesinsyncthescimpleway-221003225630-7f1f4f9f/75/Keep-Identities-in-Sync-the-SCIMple-Way-ApacheCon-NA-2022-8-2048.jpg)
![@briandemers / @mraible
SCIM Extensions
"schemas": [
"urn:ietf:params:scim:schemas:core:2.0:User",
"urn:scim:schemas:extension:srd:1.0:ability"],
"urn:scim:schemas:extension:srd:1.0:ability": {
"charisma": 14,
"constitution": 12,
"dexterity": 15,
"intelligence": 8,
"strength": 10,
"wisdom": 13}](https://cdn.statically.io/img/image.slidesharecdn.com/keepidentitiesinsyncthescimpleway-221003225630-7f1f4f9f/75/Keep-Identities-in-Sync-the-SCIMple-Way-ApacheCon-NA-2022-10-2048.jpg)
![@briandemers / @mraible
SCIM Endpoints
/Users[/{id}]
/Groups[/{id}]
/Schemas[/{id}]
/ResourceTypes[/{id}]
/Bulk
/ServiceProviderConfig](https://cdn.statically.io/img/image.slidesharecdn.com/keepidentitiesinsyncthescimpleway-221003225630-7f1f4f9f/75/Keep-Identities-in-Sync-the-SCIMple-Way-ApacheCon-NA-2022-12-2048.jpg)
Uploaded byMatt Raible
Keep Identities in Sync the SCIMple Way - ApacheCon NA 2022
What if keeping your user stores in sync across domains was as simple as running "java -jar"? With Apache SCIMPle, it is! Apache SCIMple is a SCIM 2.0-compliant server powered by Spring Boot 3. You can run it standalone or embedded in your existing app. It exposes user management REST endpoints and handles the hassle of user synchronization for you. If your identity provider supports SCIM, use the simple way! GitHub example: https://github.com/mraible/okta-scim-spring-boot-example Demo script: https://github.com/mraible/okta-scim-spring-boot-example/blob/main/demo.adoc
Keep Identities in Sync the SCIMple Way - ApacheCon NA 2022
- 1. Keep Identities inSync The SCIMple Way Brian Demers and Matt Raible @briandemers / @mraible October 3, 2022
- 2. @briandemers / @mraible Whoare we? Brian Demers Open Source Developer and Java Champion Fun facts: likes to snowboard; into 🐝 @bdemers Matt Raible Open Source Developer and Java Champion Fun facts: likes to ski; into classic VWs ✌ @mraible
- 3. @briandemers / @mraible Today'sAgenda What is SCIM? 01 Best Practices 02 Apache SCIMple 03 Demo Apache SCIMple + Spring Boot 04 Action! How to get involved! 05 @briandemers / @mraible
- 4. @briandemers / @mraible 01 Whatis SCIM? @briandemers / @mraible
- 5. @briandemers / @mraible Systemfor Cross-domain Identity Management
- 6. @briandemers / @mraible TL;DR StandardizedUser & Groups REST API
- 7. @briandemers / @mraible RESTEndpoints https://example.com/api/v1/Parts https://example.com/api/v1/Orders https://example.com/api/v1/Users https://example.com/api/v1/Groups https://example.com/api/v1/Users https://example.com/api/v1/Groups Imagine you are building an API for an auto parts store:
- 8. @briandemers / @mraible UserObject { "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"], "id":"2819c223-7f76-453a-919d-413861904646", "externalId":"dschrute", "userName":"dschrute", "name":{ "formatted": "Mr. Dwight K Schrute, III", "familyName": "Schrute", "givenName": "Dwight", "middleName": "Kurt", "honorificPrefix": "Mr.", "honorificSuffix": "III" }, "phoneNumbers":[{ "value":"555-555-8377", "type": "work"}], "emails":[{ "value":"dschrute@example.com", "type":"work", "primary": true}], "meta":{ "resourceType": "User", "created":"2011-08-01T18:29:49.793Z", "lastModified":"2011-08-01T18:29:49.793Z", "location":"https:./example.com/v2/Users/2819c223..."}} application/scim+json
- 9. @briandemers / @mraible Whatabout other attributes?
- 10. @briandemers / @mraible SCIMExtensions "schemas": [ "urn:ietf:params:scim:schemas:core:2.0:User", "urn:scim:schemas:extension:srd:1.0:ability"], "urn:scim:schemas:extension:srd:1.0:ability": { "charisma": 14, "constitution": 12, "dexterity": 15, "intelligence": 8, "strength": 10, "wisdom": 13}
- 11. @briandemers / @mraible SCIMSchemas Endpoint-/Schemas { "id": "urn:scim:schemas:extension:srd:1.0:ability", "name": "SDR-OGL", "description": "Systems Reference Document - Ability Scores", "attributes": [{ "name": "charisma", "description": "Charisma, measuring force of personality", "required": true, "type": "integer", "uniqueness": "none", "caseExact": false, "multiValued": false, "mutability": "readWrite", "returned": "default"} ...
- 12. @briandemers / @mraible SCIMEndpoints /Users[/{id}] /Groups[/{id}] /Schemas[/{id}] /ResourceTypes[/{id}] /Bulk /ServiceProviderConfig
- 13. @briandemers / @mraible Whyuse SCIM?
- 14. @briandemers / @mraible Whyshould you use SCIM? ● Standardized RESTful API ● Covers >90% of use cases ● Integrate with other services
- 15. @briandemers / @mraible Whento avoid SCIM?
- 16. @briandemers / @mraible 02 BestPractices
- 17. @briandemers / @mraible ●Store the "source" of the user ● Store the "ID" of the user's source ● Emails are not good IDs ● The status of a user is a boolean. ● SCIM supports a SQL like expression language User Model Best Practices /Users?filter=emails.value EQ "bob@example.com" /Users?filter=userName EQ "bob"
- 18. @briandemers / @mraible Userdata is sensitive! I Am Not A Lawyer!
- 19.
- 20. @briandemers / @mraible ApacheDS ApacheDirectory Studio Apache LDAP API Apache Fortress Apache Kerby Apache SCIMple
- 21. Apache SCIMple History @briandemers/ @mraible 2013: Started at PennState 2018: Moved to Apache Directory 2015: SCIM RFCs 2020: Something happened 2022: Jakarta APIs
- 22. @briandemers / @mraible 04 Demo @briandemers/ @mraible github.com/mraible/okta-scim-spring-boot-example
- 23.
- 24. @briandemers / @mraible Action GetInvolved with Apache SCIMple @briandemers / @mraible { } YOUR LOGO HERE
- 25. @briandemers / @mraible Action GetInvolved with SCIMple @briandemers / @mraible directory.apache.org/scimple apache/directory-scimple scimple@directory.apache.org
- 26. @briandemers / @mraible Thanks! BrianDemers @briandemers @bdemers @bdemers brian.demers@okta.com Matt Raible @mraible @mraible @mraible matt.raible@okta.com https://speakerdeck.com/mraible
- 27.