SCIM - System for Cross-Domain Identity Management¶
SCIM is a specification created to easily manage users and groups between different services and applications. A common schema is used for a User or a Group, which allows services to pass their data without having to think about how the information is stored in your own service. By provisioning with SCIM, you can simply set up the mapping of your attributes to SCIM-attributes, which then will be mapped to attributes in the IFS database, and also create new Usersand Groups if they do not already exist.
Purpose¶
SCIM in IFS Cloud uses one-way communication. This means that only the external Identity provider sends information that creates, updates or deletes user and group information. Changes made to users within IFS Cloud will not trigger an update to the external Identity provider. The purpose of SCIM in IFS cloud is simple user management.
IMPORTANT: As described above, if a user is synced with an external Identity Provider, their details should only be updated through the external Identity Provider, not on IFS Cloud Web. If changes are made on IFS Cloud Web, they will be overwritten by the user details from the external Identity provider during the next synchronization.
SCIM Standard¶
For updated and detailed information about the SCIM standard please visit this page.
Usage¶
SCIM 2.0 uses REST API for all operations.
User Operations¶
- Read: GET https://example.com/ifsapplications/SCIM/{v}/Users/{id}
- Create: POST https://example.com/ifsapplications/SCIM/{v}/Users/
- Update: PUT https://example.com/ifsapplications/SCIM/{v}/Users/{id}
- Patch: PATCH https://example.com/ifsapplications/SCIM/{v}/Users/{id}
- Delete: DELETE https://example.com/ifsapplications/SCIM/{v}/Users/{id}
Group Operations¶
- Read: GET https://example.com/ifsapplications/SCIM/{v}/Groups/{id}
- Create: POST https://example.com/ifsapplications/SCIM/{v}/Groups/
- Update: PUT https://example.com/ifsapplications/SCIM/{v}/Groups/{id}
- Patch: PATCH https://example.com/ifsapplications/SCIM/{v}/Groups/{id}
- Delete: DELETE https://example.com/ifsapplications/SCIM/{v}/Groups/{id}
All data passed to the Create and Update endpoints must be encoded as a SCIM object in JSON. Resources stored in attributes that are not mapped to an IFS attribute will not be stored.
Attribute Mapping¶
This mapping table is to be used by Administrators when configuring a new Provisioning Service. The SCIM Attribute maps to certain fields of the IFS Cloud database. When first creating a new User through provisioning, a unique Identity will be created. This Id is used as a unique identified for the new User, and will be generated based on the values of the SCIM attributes name.givenName and name.familyName. Some Identity Managers will have all of these attributes by default, but in some cases a manual attribute mapper will need to be added. As an example, which can be seen in the configuration example for Okta, a attribute mapper for name.formatted has to be added.
The SCIM Attributes username, name.formatted, and displayName are mandatory, must be mapped, and have a value set from the external Identity Manager to successfully sync new users.
User Attribute Mapping¶
| SCIM Attribute | IFS DB Attribute | IFS DB Character Limit |
|---|---|---|
| userName | fnd_user.web_user | 2000 |
| name.formatted | person_info.name | 100 |
| name.familyName | person_info.last_name | 100 |
| name.givenName | person_info.first_name | 100 |
| name.middleName | person_info.middle_name | 100 |
| displayName | fnd_user.description | 2000 |
| title | person_info.title | 100 |
| addresses[type eq "work"].formatted | person_info_address.address | N/A (default 'work') |
| addresses[type eq "work"].streetAddress | person_info_address.address1 | 35 |
| addresses[type eq "work"].locality | person_info_address.city | 35 |
| addresses[type eq "work"].region | person_info_address.state | 35 |
| addresses[type eq "work"].postalCode | person_info_address.zip_code | 35 |
| addresses[type eq "work"].country | person_info_address.country | 35 (ISO-3166 / Country) |
| emails[type eq "work"].value | comm_method.value, fnd_user_property.value | 200 |
| emails.type | comm_method.method_id_db, fnd_user_property.name | N/A (default 'work') |
| phoneNumbers[type eq "work"].value | comm_method.value | 200 |
| phoneNumbers.type | comm_method.method_id_db | N/A (default 'work') |
Note: Addresses, emails and phonenumbers will have the default type 'work' when syncing a new User. The type provided will have to be 'work'.
Handling Addresses¶
Previously, address mappings were in the format of addresses.formatted. If a user's person address is provisioned from the external Identity Provider, the mapping should now follow the new format as above (e.g., addresses[type eq "work"].formatted).
If an address mapping is created on the external Identity Provider side, another work type address should not be added from IFS Cloud Web. If done, the address type added on IFS Cloud Web will be replaced by the existing address on the external Identity Provider side.
Group Attribute Mapping¶
This table shows the mapping of SCIM attributes and how they map to the IFS Cloud Database. When first creating a new Group through provisioning, a unique UserGroupId will be created which is used to identify and map the provisioned Groups from the Identity Management Service to IFS. The SCIM attribute displayName also needs to be unique and duplicates are not allowed. When provisioning a group with a name that already exists, IFS will return that group as part of the SCIM-response to the Identity Management Service.
| SCIM Attribute | IFS DB Attribute | IFS DB Character Limit |
|---|---|---|
| displayName | user_group.name | 200 |