SCIM – As An ATTRUBUTE Provider?
Session Topic: SCIM as User Attribute Provider
Convener: J. Richer
Notes-taker(s): Trey Drake
Goal: Shared, externalizable profile enabling RPs to both consume and augment the same user against different personas
IS SCIM a sensible solution for enabling RPs to get a holistic view of the user. Convenience.
Use case: Col Joe with CAC……notion is sharing of persona/identity across IDPs and RPs
• SCIM box "Dick" gets data from RPs
- Q: does the box need the data or does it just need to know where the data is.
- Where does authorization happen? When data is provisioned.
- Lots of authorization issues - broker has knowledge of all user accounts
o you can do this today by bouncing around to various user IDPs and collecting data, correlate. Problem with this lots of data leakage.
o Why isn't the answer to just use OAuth2 to front end SCIM and do this with standard scopes
o Who's job is this? IDP or RP? RP of RPs? Who should be weighted more?
• RP>broker IDP (get user profile)->if not login to broker then establish a profile->RP broker pulls profile info from IDP->next time user logs into different IDP the RP can then ask the broker RP to correlate
• 1 login for each IDP relationship and 2 for the broker
• In this model each RP has lost control of its data.
• Sure SCIM can model complex user relationships
• How to do this w/o driving users crazy and being blacklisted by IDPs