Protocol practice · Automation & Engineering

SCIM 2.0: joiner, mover and leaver

Objective: Harbor’s identity platform provisions accounts into the wiki. Create Rui Okafor’s account on day one, move them from Support to Engineering, and switch their access off on their last day.

About 12 minutes · simulated, no real servers

1Joiner
2Retry
3Mover: add
4Mover: remove
5Leaver
6Confirm

Where SCIM fits

Sign-inWho is this?

OpenID Connectbuilt on OAuth SAMLenterprise single sign-on KerberosWindows domains

AccessWhat may this app do?

OAuthaccess for an app

AccountsDoes the account exist?

SCIMYou are here

Not sure? Which protocol?

SCIM at work, every day

Each of these happens without anyone filing a ticket.

A new hire has accounts on day oneChat, wiki and email, created from HR’s record.
A move swaps group accessInto the new team’s groups, out of the old.
A leaver is switched off the same afternoonIn every connected app, not just the directory.

Step 1 of 6

Joiner: create the account

HR has a new hire, Rui Okafor, starting in Support. Your platform creates their wiki account before their first morning.

______ https://wiki.example/scim/v2/Users
Authorization: ______
Content-Type: application/scim+json
{
  "schemas": ["______"],
  "userName": "r.okafor@harbor.example",
  "externalId": "HR-104882",
  "name": { "givenName": "Rui", "familyName": "Okafor" },
  "active": ______
}

Fill in the four blanks, then send the request.

Method: creating something new

Authorization: how the wiki knows it’s you

schemas: what kind of resource this is

active: on day one

Pick an answer for each blank to continue.

This step

SCIM: System for Cross-domain Identity Management: a standard REST API for creating, changing and removing accounts in other systems.
SCIM client: The system pushing the changes: here, the identity platform.
Service provider: In SCIM, the application receiving the changes and holding the accounts: here, the wiki.
Resource: A thing SCIM manages, at its own URL. Mostly Users and Groups.
Schema: Says which attributes a resource has. The core User schema covers names, emails and active.
id and externalId: id is assigned by the application and used in every URL. externalId is your own identifier, like the HR number.

Earlier steps (0)

All terms (15)

SCIM: System for Cross-domain Identity Management: a standard REST API for creating, changing and removing accounts in other systems.
SCIM client: The system pushing the changes: here, the identity platform.
Service provider: In SCIM, the application receiving the changes and holding the accounts: here, the wiki.
Resource: A thing SCIM manages, at its own URL. Mostly Users and Groups.
Schema: Says which attributes a resource has. The core User schema covers names, emails and active.
id and externalId: id is assigned by the application and used in every URL. externalId is your own identifier, like the HR number.
409 Conflict: The resource already exists. After a retry, it usually means the first request worked.
Filter: A query on a collection: userName eq "…". Use exact operators when you want one match.
Group membership: Changed on the Group, through its members. A user’s groups attribute is read-only.
PATCH operations: add, replace or remove, each with a path. Change only what changed.
Path filter: Brackets in a path pick out which values to touch: members[value eq "…"].
Mover: A change of role: grant the new access and remove the old. Most leftover access comes from moves only half done.
Deactivation: active=false. The account stays, unusable, so its history survives and a mistake can be undone.
Read back: Fetch the resource after a change. The response to a write says the request was accepted, not that it took effect.
Live sessions: Outside SCIM’s reach. Ending them takes the application’s own revocation or a shared signal.