<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">On today’s call we talked about <div class=""><br class=""></div><div class="">a: how and where attribute mapping should occur<br class=""><div class="">b: using SCIM to do ongoing provisioning and updating</div><div class=""><br class=""></div><div class="">A couple of comments:</div><div class=""><br class=""></div><div class="">* While SCIM has standardized attributes(claims), the values for entitlements (something a user has/is given), roles (something a user is), and groups often tend to be problematic. We talked about some of these cases. I think “who” does the mapping of these types of claims will depend largely on “b”.</div><div class=""><br class=""></div><div class="">* There are actually several different types of relationships that could be established. Broadly speaking I would break them down into directory vs. provisioning centric:</div><div class=""><br class=""></div><div class="">Directory Centric</div><div class=""><br class=""></div><div class="">Where the application uses the OpenID Connect/SCIM profile and obtains an access token to the SCIM endpoint. That access token can be used in two ways:</div><div class="">i) Just-in-time - the token is short lived and the app grabs what it needs every time the user logs into the app via connect</div><div class=""><br class=""></div><div class="">ii) Ongoing / delegated - the app polls the SCIM repository independently based on some other event criteria (eg. the SCIM provider issues an event saying the record has changed)</div><div class=""><br class="webkit-block-placeholder"></div><div class="">Provisioning Centric:</div><div class=""><br class=""></div><div class="">i) One-time: As part of fast fed, the application is provisioned with the first “copy” of the user. No further updates are needed</div><div class="">ii) On-going provisioning system: A provisioning system at the IDP is set up to send SCIM commands to each application based on changes at the IDP</div><div class="">iii) On-going event system (loose-coupled): The provisioning system sends events to the application. The applications reconcile and take appropriate action</div><div class=""><br class="webkit-block-placeholder"></div><div class="">There may be more variations here.</div><div class=""><br class=""></div><div class="">My gut feeling is that the directory method that will be easiest to standardize across all scenarios would be Directory-centric “ii” where the app either polls or uses SCIM events to trigger apps doing occasional reconciliation. This might be easier to use at it has the fewest missing pieces and has a certain amount of adaptability to it. For example, an app could get data only once, it could update every time the user accesses, it could poll, or it could use events to “poll” only when a change notice has been delivered.</div><div class=""><br class=""></div><div class=""><br class="webkit-block-placeholder"></div><div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><span class="Apple-style-span" style="border-collapse: separate; line-height: normal; border-spacing: 0px;"><div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div class=""><div class=""><div class="">Phil</div><div class=""><br class=""></div><div class="">@independentid</div><div class=""><a href="http://www.independentid.com" class="">www.independentid.com</a></div></div></div></div></span><a href="mailto:phil.hunt@oracle.com" class="" style="orphans: 2; widows: 2;">phil.hunt@oracle.com</a></div><div class=""><br class=""></div></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">
</div>
<br class=""></div></body></html>