Subject: [scim] Fwd: [Openid-specs-ab] Profile for using SCIM with OpenID Connect

From: "Phil Hunt (IDM)" <[email-masked]>
Date: Wed, 15 Jun 2016 19:18:05 -0700

FYI. A profile of using SCIM with OpenId Connect submitted to the OIDF Connect AB WG. 

It may be worth discussing a possible spec for OAuth authorization scopes that could also be used in the OIDC/SCIM profile as well as plain old OAuth. 

I have a proposal I can write up if there is interest. 

Phil

Begin forwarded message:

> From: Phil Hunt <[email-masked]>
> Date: June 15, 2016 at 13:10:05 PDT
> To: [email-masked]
> Cc: Ian Glazer <[email-masked]>
> Subject: [Openid-specs-ab] Profile for using SCIM with OpenID Connect
> 
> Please find attached, a draft proposal from Chuck Mortimore and myself on using SCIM as an alternate endpoint for profile services in the context of Connect.
> 
> This specification defines:
> a. Discovery metadata (scim_endpoint) indicating availability of a SCIM Protocol base endpoint
> b. Dynamic registration metadata (scim_profile) used to indicate a client intends to use SCIM in addition to or instead of UserInfo
> c. An additional ID Token claim (scim_id and scim_location) which specifies the SCIM resource endpoint and identifier associated with the authenticated subject.
> 
> By doing this, clients can avoid having to do an external authorization and another round of exchanges to access User profile information with full CRUD features.
> 
> Clients can also access SCIM’s more sophisticated query system to ask questions if the authenticated user has particular conditions (e.g. querying a sub-attribute such as “country” in the “addresses” attribute).  
> 
> As an example use case: A cloud provider wants to build a user-profile self-service portal. OIDC does the authentication of the user and allows the web service to access the CRUD features of SCIM for the updates.
> 
> Phil
> 
> @independentid
> www.independentid.com
> [email-masked]
> 
> 
> 
> 
> _______________________________________________
> Openid-specs-ab mailing list
> [email-masked]
> http://lists.openid.net/mailman/listinfo/openid-specs-ab