<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">It seems like access to this endpoint ought to be gated with a standard OAuth scope, much the same way that access to the UserInfo Endpoint is gated with the ‘openid’ scope. <div class=""><br class=""></div><div class=""> — Justin</div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Jun 15, 2016, at 4:10 PM, Phil Hunt <<a href="mailto:phil.hunt@oracle.com" class="">phil.hunt@oracle.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" class="">
<div class="">
<div class="" style="word-wrap:break-word">Please find attached, a draft proposal from Chuck Mortimore and myself on using SCIM as an alternate endpoint for profile services in the context of Connect.
<div class=""><br class="">
</div>
<div class="">This specification defines:</div>
<div class="">a. Discovery metadata (scim_endpoint) indicating availability of a SCIM Protocol base endpoint</div>
<div class="">b. Dynamic registration metadata (scim_profile) used to indicate a client intends to use SCIM in addition to or instead of UserInfo</div>
<div class="">c. An additional ID Token claim (scim_id and scim_location) which specifies the SCIM resource endpoint and identifier associated with the authenticated subject.</div>
<div class=""><br class="">
</div>
<div class="">By doing this, clients can avoid having to do an external authorization and another round of exchanges to access User profile information with full CRUD features.</div>
<div class=""><br class="">
</div>
<div class="">Clients can also access SCIM’s more sophisticated query system to ask questions if the authenticated user has particular conditions (e.g. querying a sub-attribute such as “country” in the “addresses” attribute). </div>
<div class=""><br class="">
</div>
<div class="">As an example use case: A cloud provider wants to build a user-profile self-service portal. OIDC does the authentication of the user and allows the web service to access the CRUD features of SCIM for the updates.</div>
<div class=""><br class="">
</div>
<div class="">
<div class="">
<div class="" style="letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; word-wrap: break-word;">
<div class="" style="letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; word-wrap: break-word;">
<div class=""><span class="x_Apple-style-span" style="border-collapse:separate; line-height:normal; border-spacing:0px">
<div class="" style="word-wrap:break-word">
<div class="">
<div class="">
<div class="">Phil</div>
<div class=""><br class="">
</div>
<div class="">@independentid</div>
<div class=""><a href="http://www.independentid.com/" class="">www.independentid.com</a></div>
</div>
</div>
</div>
</span><a href="mailto:phil.hunt@oracle.com" class="" style="orphans:2; widows:2">phil.hunt@oracle.com</a></div>
<div class=""></div>
</div>
</div>
</div>
</div>
</div>
<div style="word-wrap:break-word" class="">
<div class="">
<div id="x_AppleMailSignature" class="">
<div style="letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; word-wrap: break-word;" class="">
<div style="letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; word-wrap: break-word;" class="">
<div class=""></div>
</div>
</div>
</div>
</div>
</div>
<div class="" style="word-wrap:break-word">
<div class="">
<div class="">
<div class="" style="letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; word-wrap: break-word;">
<div class="" style="letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; word-wrap: break-word;">
<div class=""></div>
</div>
<br class="x_Apple-interchange-newline">
</div>
<br class="x_Apple-interchange-newline">
<br class="x_Apple-interchange-newline">
</div>
<br class="">
</div>
</div>
</div>
<span id="cid:E6D48D5EA03B664C8659C988D97B056C@exchange.mit.edu"><Draft OpenID Connect Profile for SCIM Services.html></span><span id="cid:687060F2B7356B47A99BBC1D1AA9CD0E@exchange.mit.edu"><openid-connect-scim-profile-1_0.txt></span></div></blockquote></div><br class=""></div></body></html>