Subject: [scim] Testing Scim Configuration

From: Melvin Laguren <[email-masked]>
Date: Thu, 3 Apr 2014 16:34:43 -0700

Hi,

At OneLogin, we are working to make SCIM the standard for provisioning
users to apps.  It has been working out great for us, as providers are
building scim servers and then once the server is added to our catalog, it
does exactly what we want it to do.

The interesting thing we are seeing now, is that in our case we give the
user the option to test the connection.  In doing so, we make a call to
/Users and if we get a 200, we let them know that the app has been set up.
 Unfortunately one of our newest apps using scim returns back over 1000
users and took some time before the customer new it was configured properly.

My question is, how do other implementors handle this?  Not all of the
providers create all the other points.  So calling another endpoint may not
exist.  What if we authenticate against the base url?

Looking forward to your thoughts and suggestions.

Thanks,

Melvin

Melvin Laguren | Lead QA Automation Engineer | [email-masked] |

---

From: Jacob Childress <[email-masked]>
Date: Thu, 3 Apr 2014 19:08:50 -0500

Hi Melvin,

If /Users and only /Users is guaranteed to exist, I’d suggest performing a search that you know won’t be expensive (e.g., one that uses an attribute that’s likely to be indexed by the backing data store). For example:

GET /Users?filter=userName%20eq%20%22bjensen%22 
HTTP/1.1
Accept: application/json
Accept-Encoding: gzip, deflate, compress
Authorization: Basic aGV5LCBicmlhbiwgaG93J3MgaXQgZ29pbmc=
Content-Type: application/json; charset=utf-8
Host: example.com:443
User-Agent: HTTPie/0.7.2

HTTP/1.1 200 OK
Content-Length: 78
Content-Type: application/json
Server: Jetty(8.1.12.v20130726)

{
    "Resources": [], 
    "itemsPerPage": 0, 
    "schemas": [], 
    "startIndex": 1, 
    "totalResults": 0
}

Jacob

On Apr 3, 2014, at 6:34 PM, Melvin Laguren <[email-masked]> wrote:

> Hi,
> 
> At OneLogin, we are working to make SCIM the standard for provisioning users to apps.  It has been working out great for us, as providers are building scim servers and then once the server is added to our catalog, it does exactly what we want it to do.
> 
> The interesting thing we are seeing now, is that in our case we give the user the option to test the connection.  In doing so, we make a call to /Users and if we get a 200, we let them know that the app has been set up.  Unfortunately one of our newest apps using scim returns back over 1000 users and took some time before the customer new it was configured properly.
> 
> My question is, how do other implementors handle this?  Not all of the providers create all the other points.  So calling another endpoint may not exist.  What if we authenticate against the base url?
> 
> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim

---

From: Phil Hunt <[email-masked]>
Date: Thu, 3 Apr 2014 17:41:31 -0700

You could also query /ServiceProviderConfig and even limit the attributes returned to a single attribute.

Phil

@independentid
www.independentid.com
[email-masked]

---

From: Kelly Grizzle <[email-masked]>
Date: Fri, 4 Apr 2014 13:02:50 +0000

+1

This is what we do in our implementation.

From: scim [mailto:[email-masked]] On Behalf Of Phil Hunt
Sent: Thursday, April 03, 2014 7:42 PM
To: Jacob Childress
Cc: [email-masked]; Melvin Laguren
Subject: Re: [scim] Testing Scim Configuration

Phil

@independentid
www.independentid.com<http://www.independentid.com>
[email-masked]<mailto:[email-masked]>

On Apr 3, 2014, at 5:08 PM, Jacob Childress <[email-masked]<mailto:[email-masked]>> wrote:

Hi Melvin,

If /Users and only /Users is guaranteed to exist, I'd suggest performing a search that you know won't be expensive (e.g., one that uses an attribute that's likely to be indexed by the backing data store). For example:

Host: example.com<http://example.com/>:443
User-Agent: HTTPie/0.7.2

HTTP/1.1 200 OK
Content-Length: 78

{
    "Resources": [],
    "itemsPerPage": 0,
    "schemas": [],
    "startIndex": 1,
    "totalResults": 0
}

Jacob

On Apr 3, 2014, at 6:34 PM, Melvin Laguren <[email-masked]<mailto:[email-masked]>> wrote:

Hi,

Thanks,

Melvin

Melvin Laguren | Lead QA Automation Engineer | [email-masked]<mailto:[email-masked]> |
_______________________________________________
scim mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/scim

_______________________________________________
scim mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/scim

---

From: Madhu M <[email-masked]>
Date: Fri, 4 Apr 2014 09:49:45 -0400

The Okta implementation also checks the /ServiceProviderConfigs during the
connection testing.

On Fri, Apr 4, 2014 at 9:02 AM, Kelly Grizzle
<[email-masked]>wrote:

> *From:* scim [mailto:[email-masked]] *On Behalf Of *Phil Hunt
> *Sent:* Thursday, April 03, 2014 7:42 PM
> *To:* Jacob Childress
> *Cc:* [email-masked]; Melvin Laguren
> *Subject:* Re: [scim] Testing Scim Configuration
>
>
>
> If /Users and only /Users is guaranteed to exist, I'd suggest performing a
> search that you know won't be expensive (e.g., one that uses an attribute
> that's likely to be indexed by the backing data store). For example:
>
>
>

-- 
Madhu Mahadevan
Sr. Technical Consultant @ okta.com  ;  t: @mmaha <http://twitter.com/mmaha>
c: +1 (416) 451-4611 ;  o: +1 (415) 578-5176 ;  b: +1 (877)
273-4202,,1083942