[go: up one dir, main page]
CommunityGraviteeFeedbackBook a demoStart your free trial
Edit

SCIM 2.0

Overview of SCIM.

The System for Cross-domain Identity Management (SCIM) 2.0 is a standard for automating the exchange of user identity information between identity domains, or IT systems.

Since it is a standard, SCIM ensures interoperability and user data consistency that can be communicated across similar applications. SCIM enables to automate the provisioning/de-provisioning process and manage users and groups.

SCIM protocol endpoints are exposed by the AM Gateway following the OpenAPI specification.

Protocol

SCIM is a standard that defines schema and protocols for identity management.

It relies on REST APIs with endpoints exposing CRUD (Create, Read, Update, Delete) functionality for users and groups as well as search, discovery, and bulk features.

Groups are currently not manageable using Bulk operations.

Custom attributes

Gravitee AM supports a custom System for Cross-Domain Identity Management (SCIM) User extension. With this extension, you can define extended attributes for your users.

Custom attributes are stored in the additionalInformation map of the user.

The custom User extension is identified using the following schema URI: urn:ietf:params:scim:schemas:extension:custom:2.0:User

For users migrations from an alternative OIDC provider to Access Management, you can define the lastPasswordReset attribute. This attribute ensures that a password policy with password expiry requests a password reset according to the value provided during the migration. This attribute is accepted only during user creation.

In the SCIM request, the lastPasswordReset attribute is expected to be a String using ISO-8601 representation to be aligned with other date attributes defined by the SCIM specification.

As it is specific information,you must use the following Gravitee schema extension "urn:ietf:params:scim:schemas:extension:custom:2.0:User" . Here is an example: "urn:ietf:params:scim:schemas:extension:custom:2.0:User": { "lastPasswordReset": "2024-10-27T04:56:22Z" }

You can also define two boolean parameters: preRegistration and forceResetPassword. When preRegistration is set to true, the user receives an email prompting them to confirm their profile and set a password. When forceResetPassword is set to true, the user is required to reset their password following their next successful login.

The following non-normative example shows how to create, update, and patch users by using the custom User extension in JSON format.

PreviousUMA 2.0NextOpen Banking

Was this helpful?