Subject: [scim] Simple Federation Deployment

From: "Hardt, Dick" <[email-masked]>
Date: Tue, 5 Apr 2016 21:59:22 +0000

Use case: An admin for an organization would like to enable her users to access a SaaS application at her IdP.

User experience:

  1.  Admin authenticates to IdP in browser
  2.  Admin selects SaaS app to federate with from list at IdP
  3.  IdP optionally presents config options
  4.  IdP redirects Admin to SaaS app
  5.  Admin authenticates to SaaS app
  6.  SaaS app optionally gathers config options
  7.  SaaS app redirects admin to IdP
  8.  IdP confirms successful federation => OIDC / SAML and SCIM are now configured and working between IdP and SaaS App

Who else is interested in solving this?

Is there interest in working on this in either SCIM or OAUTH Wgs?

Any one in BA interested in meeting on this topic this week?

— Dick

---

From: "Phil Hunt (IDM)" <[email-masked]>
Date: Tue, 5 Apr 2016 19:11:16 -0300

Is the idp the center of all things for these users?

Usually you have a provisioning system that coordinates state and uses things like scim connectors to do this. 

Another approach from today would be to pass a scim event to the remote provider which then decides what needs to be done to facilitate the thingd you describe. 

Iow. Either the idp (sender) or the sp (receiver) have a provisioning system to do this. 

The solution and the simplicity depends on where the control needs to be. 

Phil

> On Apr 5, 2016, at 18:59, Hardt, Dick <[email-masked]> wrote:
> 
> Admin authenticates to IdP in browser
> Admin selects SaaS app to federate with from list at IdP
> IdP optionally presents config options
> IdP redirects Admin to SaaS app
> Admin authenticates to SaaS app
> SaaS app optionally gathers config options
> SaaS app redirects admin to IdP
> IdP confirms successful federation => OIDC / SAML and SCIM are now configured and working between IdP and SaaS App
> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim

---

From: "Hardt, Dick" <[email-masked]>
Date: Tue, 5 Apr 2016 22:25:54 +0000

I’m talking about removing manual steps in what happens today where configuring a SaaS app at an IdP (such as Google, Azure, Ping, Octa) requires is a bunch of cutting and pasting of access tokens / keys / certs and doing a bunch of  config that is error prone and unique for each relationship.

Don’t want to solve on the thread … looking to see if there is interest!

On 4/5/16, 7:11 PM, someone claiming to be "scim on behalf of Phil Hunt (IDM)" <[email-masked]<mailto:[email-masked]> on behalf of [email-masked]<mailto:[email-masked]>> wrote:

Phil

On Apr 5, 2016, at 18:59, Hardt, Dick <[email-masked]<mailto:[email-masked]>> wrote:

User experience:

— Dick
_______________________________________________
scim mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/scim

---

From: "Phil Hunt (IDM)" <[email-masked]>
Date: Wed, 6 Apr 2016 02:07:58 -0300

There may be some similar concerns on our side. Lets talk more this week. 

Phil

> On Apr 5, 2016, at 19:25, Hardt, Dick <[email-masked]> wrote:
> 
> On 4/5/16, 7:11 PM, someone claiming to be "scim on behalf of Phil Hunt (IDM)" <[email-masked] on behalf of [email-masked]> wrote:
>

---

From: "Nat Sakimura" <[email-masked]>
Date: Wed, 6 Apr 2016 15:56:56 +0900

+1 for removing the manual cut-n-pastes!

Nat

--

PLEASE READ :This e-mail is confidential and intended for the

named recipient only. If you are not an intended recipient,

please notify the sender  and delete this e-mail.

From: scim [mailto:[email-masked]] On Behalf Of Hardt, Dick
Sent: Wednesday, April 6, 2016 7:26 AM
To: Phil Hunt (IDM) <[email-masked]>
Cc: [email-masked]; [email-masked]
Subject: Re: [scim] Simple Federation Deployment

On 4/5/16, 7:11 PM, someone claiming to be "scim on behalf of Phil Hunt (IDM)" <[email-masked] <mailto:[email-masked]>  on behalf of [email-masked] <mailto:[email-masked]> > wrote:

Phil

On Apr 5, 2016, at 18:59, Hardt, Dick <[email-masked] <mailto:[email-masked]> > wrote:

User experience: 

— Dick

_______________________________________________
scim mailing list
[email-masked] <mailto:[email-masked]> 
https://www.ietf.org/mailman/listinfo/scim

---

From: "Gil Kirkpatrick" <[email-masked]>
Date: Wed, 6 Apr 2016 17:16:16 +1000

That’s an issue we’re facing as well. Definitely interested.

-gil

From: OAuth [mailto:[email-masked]] On Behalf Of Nat Sakimura
Sent: Wednesday, April 6, 2016 4:57 PM
To: 'Hardt, Dick' <[email-masked]>; 'Phil Hunt (IDM)' <[email-masked]>
Cc: [email-masked]; [email-masked]
Subject: Re: [OAUTH-WG] [scim] Simple Federation Deployment

Nat

--

From: scim [mailto:[email-masked]] On Behalf Of Hardt, Dick
Sent: Wednesday, April 6, 2016 7:26 AM
To: Phil Hunt (IDM) <[email-masked] <mailto:[email-masked]> >
Cc: [email-masked] <mailto:[email-masked]> ; [email-masked] <mailto:[email-masked]> 
Subject: Re: [scim] Simple Federation Deployment

Phil

User experience: 

— Dick

---

From: Anthony Nadalin <[email-masked]>
Date: Wed, 6 Apr 2016 11:57:42 +0000

I would be interested also

Sent from my Windows 10 phone

From: Gil Kirkpatrick<mailto:[email-masked]>
Sent: Wednesday, April 6, 2016 4:16 AM
To: 'Nat Sakimura'<mailto:[email-masked]>; 'Hardt, Dick'<mailto:[email-masked]>; 'Phil Hunt (IDM)'<mailto:[email-masked]>
Cc: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: [scim] [OAUTH-WG] Simple Federation Deployment

That's an issue we're facing as well. Definitely interested.

-gil

Nat

From: scim [mailto:[email-masked]] On Behalf Of Hardt, Dick
Sent: Wednesday, April 6, 2016 7:26 AM
To: Phil Hunt (IDM) <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: [scim] Simple Federation Deployment

I'm talking about removing manual steps in what happens today where configuring a SaaS app at an IdP (such as Google, Azure, Ping, Octa) requires is a bunch of cutting and pasting of access tokens / keys / certs and doing a bunch of  config that is error prone and unique for each relationship.

Don't want to solve on the thread ... looking to see if there is interest!

Phil

User experience:

- Dick
_______________________________________________
scim mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/scim<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2fscim&data=01%7c01%7ctonynad%40microsoft.com%7c871da74138de485b0bb008d35deb6643%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=%2fILmgXPgRyLfCIn%2b2EbpBbIcHqKJbKZVYKJBpUL%2fKnY%3d>

---

From: "Hardt, Dick" <[email-masked]>
Date: Wed, 6 Apr 2016 12:52:15 +0000

Sounds like there is interest.

SCIM or OAUTH?

-- Dick

On Apr 6, 2016, at 8:57 AM, Anthony Nadalin <[email-masked]<mailto:[email-masked]>> wrote:

-gil

To: 'Hardt, Dick' <[email-masked]<mailto:[email-masked]>>; 'Phil Hunt (IDM)' <[email-masked]<mailto:[email-masked]>>

Nat

Phil

User experience:

- Dick

---

From: Phil Hunt <[email-masked]>
Date: Wed, 6 Apr 2016 10:01:48 -0300

I think it is worth discussing in oauth wg.

While SCIM has issues, I think it represents a broader use case that other applications have that are deployed widely.

Phil

@independentid
www.independentid.com <http://www.independentid.com/>[email-masked] <mailto:[email-masked]>

> On Apr 6, 2016, at 9:52 AM, Hardt, Dick <[email-masked]> wrote:
> 
> On Apr 6, 2016, at 8:57 AM, Anthony Nadalin <[email-masked] <mailto:[email-masked]>> wrote:
> 
>> From: Gil Kirkpatrick <mailto:[email-masked]>
>> To: 'Nat Sakimura' <mailto:[email-masked]>; 'Hardt, Dick' <mailto:[email-masked]>; 'Phil Hunt (IDM)' <mailto:[email-masked]>
>> Cc: [email-masked] <mailto:[email-masked]>; [email-masked] <mailto:[email-masked]>
>> From: OAuth [mailto:[email-masked] <mailto:[email-masked]>] On Behalf Of Nat Sakimura
>> To: 'Hardt, Dick' <[email-masked] <mailto:[email-masked]>>; 'Phil Hunt (IDM)' <[email-masked] <mailto:[email-masked]>>
>> Cc: [email-masked] <mailto:[email-masked]>; [email-masked] <mailto:[email-masked]>
>> +1 for removing the manual cut-n-pastes! <>
>>  
>> Nat
>>  
>> --
>> From: scim [mailto:[email-masked] <mailto:[email-masked]>] On Behalf Of Hardt, Dick
>> To: Phil Hunt (IDM) <[email-masked] <mailto:[email-masked]>>
>> Cc: [email-masked] <mailto:[email-masked]>; [email-masked] <mailto:[email-masked]>
>> On 4/5/16, 7:11 PM, someone claiming to be "scim on behalf of Phil Hunt (IDM)" <[email-masked] <mailto:[email-masked]> on behalf of [email-masked] <mailto:[email-masked]>> wrote:
>>  
>> On Apr 5, 2016, at 18:59, Hardt, Dick <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> https://www.ietf.org/mailman/listinfo/scim <https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2fscim&data=01%7c01%7ctonynad%40microsoft.com%7c871da74138de485b0bb008d35deb6643%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=%2fILmgXPgRyLfCIn%2b2EbpBbIcHqKJbKZVYKJBpUL%2fKnY%3d>

---

From: Ian Glazer <[email-masked]>
Date: Wed, 6 Apr 2016 17:20:22 -0400

I'd be interested too

On Tue, Apr 5, 2016 at 5:59 PM, Hardt, Dick <[email-masked]> wrote:

>    8. IdP confirms successful federation => OIDC / SAML and SCIM are now
>    configured and working between IdP and SaaS App
>

-- 
Ian Glazer
Senior Director, Identity
+1 202 255 3166
@iglazer <https://twitter.com/iglazer>

---

From: Mike Jones <[email-masked]>
Date: Wed, 6 Apr 2016 22:14:09 +0000

For the record, I’m interested.

Sent: Tuesday, April 5, 2016 7:26 PM

Phil

User experience:

— Dick

---

From: Nov Matake <[email-masked]>
Date: Thu, 7 Apr 2016 08:17:58 +0900

I'm interested in too.

nov

> On Apr 7, 2016, at 07:14, Mike Jones <[email-masked]> wrote:
> 
> ― Dick
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Roland Hedberg <[email-masked]>
Date: Thu, 7 Apr 2016 09:59:28 +0200

Count me in !

> 7 apr. 2016 kl. 01:17 skrev Nov Matake <[email-masked]>:
> 
> I'm interested in too.
> 
> nov
> 
>> On 4/5/16, 7:11 PM, someone claiming to be "scim on behalf of Phil Hunt (IDM)" <[email-masked] on behalf [email-masked]> wrote:
>>  
>> 	• Admin authenticates to IdP in browser
>> 	• Admin selects SaaS app to federate with from list at IdP
>> 	• IdP optionally presents config options
>> 	• IdP redirects Admin to SaaS app
>> 	• Admin authenticates to SaaS app
>> 	• SaaS app optionally gathers config options
>> 	• SaaS app redirects admin to IdP
>> 	• IdP confirms successful federation => OIDC / SAML and SCIM are now configured and working between IdP and SaaS App

-- Roland
"Education is the path from cocky ignorance to miserable uncertainty.” - Mark Twain