IPSIE AL1 SCIM 2.0 Profile

3.2.2.1. Create User (POST /Users)

User creation is performed by the SCIM operation POST /Users.¶

In addition to the user attributes required by [RFC7643], the following attributes are required to be part of the User schema:¶

// TODO: Should we keep this vauge or refer be explicit with attributes we are requiring? email vs emails?¶

• An attribute which contains a unique identifier used by the enterprise to distinguish the owner of the account, such as "externalId."¶

• An attribute which contains the primary email address of the user, such as "email"¶

3.2.2.2. Update User (PATCH /Users/{id})

User updates are performed by the SCIM operation PATCH /Users/{id}¶

3.2.2.3. Deactivate or Reactivate User (PATCH /Users/{id})

Changes to the user activation status, such deactivation and reactivation, are performed by the SCIM operation PATCH /Users/{id}¶

The Identity Service SHOULD propagate user deactivation events to the Application within 5 minutes of the user being deactivated.¶

The Application SHOULD respond to user deactivation events by revoking the ability for the user to continue accessing the Application, including the revocation of currently active sessions. The revocation mechanism outside the scope of this profile. Revocation SHOULD occur within 5 minutes of receiving the deactivation request.¶

When a user account is deactivated, all access mechanisms and authorizations associated with that account MUST also be deactivated. This includes, but is not limited to:¶

• Web sessions¶

• API tokens¶

• Refresh tokens¶

• Personal access tokens¶

• SSH keys associated with the user¶

• Device-based authentication credentials¶

The Application MUST allow reactivation of a deactivated user.¶

3.2.2.4. Delete User (DELETE /Users/{id})

User deletions are performed by the SCIM operation DELETE /Users/{id}¶

After a user is deleted, the Application MUST allow the creation of a new user with the same username.¶

// TODO: this could be tricky RE: maintianing the user's data¶

3.2.2.5. Get All Users (GET /Users)

Get all users in the system is performed by the SCIM operation GET /Users¶

This endpoint ensures that all users are managed by the Identity Service.¶

To ensure that large amounts of data can be read from the Application, the application must support with index-based or cursor-based pagination for the GET /Users request. To ensure system stability and prevent abuse, the Application SHALL enforce rate limits on this endpoint and must respond with appropriate headers, such as "429 Too Many Requests" and "Retry-After," when limits are exceeded.¶

3.2.2.6. Get User By ID (GET /Users/{id})

User searches by id are performed by the SCIM operation GET /Users/{id}¶

3.2.2.7. List Users By Alternate Identifier (GET /Users?)

User searches by alternate identifier are performed via the SCIM operation: GET /Users?filter={filterExpression}¶

Application Providers MUST support the following filter expressions:¶

• username eq {username}¶

• externalId eq {externalId}¶

• emails[value eq {email}]¶

3.2.3.1. Create Group (POST /Groups)

Group creation is performed by the SCIM operation POST /Group.¶

// TODO: Add more details¶

3.2.3.2. Get All Groups (GET /Groups)

A search for all groups in the system is performed by the SCIM operation GET /Groups¶

This endpoint ensures that all groups are managed by the Identity Service.¶

To ensure that large amounts of data can be read from the Application, the application MUST support with index-based or cursor-based pagination for the GET /Groups request. To ensure system stability and prevent abuse, the Application SHALL enforce rate limits on this endpoint and MUST respond with appropriate headers, such as "429 Too Many Requests" and "Retry-After," when limits are exceeded.¶

3.2.3.3. Get Group By ID (GET /Group/{id})

Group searches by id are performed by the SCIM operation GET /Group/{id}?excludedAttributes=members¶

3.2.3.4. List Groups By Alternate Identifier (GET /Groups?)

User lookups by alternate identifier are performed by the SCIM operation GET /Groups?filter={filterExpression}&excludedAttributes=members¶

Application Providers MUST support the following filter expressions:¶

// TODO: Add what filters are required to be supported¶

3.2.3.5. Add or Remove Group Members (PATCH /Group/{id})

Members are added or removed from Groups via the SCIM operation PATCH /Groups/{id}¶

For each Operation in the PATCH:¶

The op attribute MUST contain either "add" or "remove".¶

• When the op is "add":¶

  • The path attribute MUST be "members".¶

  • The value attribute MUST be an array of Group member elements, as defined in Section 4.2 of the SCIM Core Schema [RFC7643]. Each member MUST contain a value subattribute with the id of the resource being added to the group.¶

• When the op is "remove":¶

  • The path attribute MUST be either:¶

    • "members" (to remove all members)¶

    • "members[value eq {id}]" (to remove a single member)¶

  • The value attribute MUST be unspecified.¶