SCIM – As An ATTRUBUTE Provider?

Session Topic: SCIM as User Attribute Provider

Wednesday 4H

Convener: J. Richer

Notes-taker(s): Trey Drake

Goal: Shared, externalizable profile enabling RPs to both consume and augment the same user against different personas

IS SCIM a sensible solution for enabling RPs to get a holistic view of the user. Convenience.

Use case: Col Joe with CAC……notion is sharing of persona/identity across IDPs and RPs

• SCIM box "Dick" gets data from RPs

- Q: does the box need the data or does it just need to know where the data is.

- Where does authorization happen? When data is provisioned.

- Lots of authorization issues - broker has knowledge of all user accounts

o you can do this today by bouncing around to various user IDPs and collecting data, correlate. Problem with this lots of data leakage.

o Why isn't the answer to just use OAuth2 to front end SCIM and do this with standard scopes

o Who's job is this? IDP or RP? RP of RPs? Who should be weighted more?

• RP>broker IDP (get user profile)->if not login to broker then establish a profile->RP broker pulls profile info from IDP->next time user logs into different IDP the RP can then ask the broker RP to correlate

• 1 login for each IDP relationship and 2 for the broker

• In this model each RP has lost control of its data.

• Sure SCIM can model complex user relationships

• How to do this w/o driving users crazy and being blacklisted by IDPs