SCIM Client Component

SCIM (System for Cross-domain Identity Management) is an HTTP-based protocol. Arminius uses SCIM to exchange user information with an upstream identity provider (IdP). RFC 7643 specifies that the service provider (the server) “provides identity information via the SCIM protocol”, so the SCIM server is the IdP. This is further clarified by RFC 7642 where the service provider is the “authoritative identity data store”. Therefore, arminius acts as a SCIM client that connects to the IdP.

The SCIM Client Component continuously polls an upstream SCIM endpoint to synchronize users and sessions to the local database. Note that the upstream SCIM server is responsible to provide consistent data. Therefore, sessions have to reference existing users at any point in time. Consequently, an incremental response that deletes users must also explicitly delete any sessions that belong to them and still exist.

SCIM Extensions

The SCIM Client Component requires an upstream IdP that supports the custom extensions specified in this chapter.

Incremental Sync with Long Polling

On the SCIM root endpoint, these query parameters are added:

• sync: This query parameter is set to the nextSync value from a previous response. When this query parameter is specified and recognized by the server, the server SHOULD send an incremental response.
• timeout: When an incremental response would be empty, the server MUST wait up to timeout seconds until responding.

The Resources array of an incremental ListResponse only contains resources that were added or modified. These attributes are added to ListResponse:

• nextSync: Opaque String value for the next sync request. A server supporting this extension MUST set this attribute for full and incremental responses.
• Deletions: Array of String IDs of each deleted resource. The presence of this attribute indicates an incremental response (even if it is empty).

OIDC Sessions

Arminius expects the custom resource type OidcSession. The IdP must create such resources on OIDC login. The id common attribute of this resource must match OIDC’s sid (Session ID) claim. The resource uses this schema definition:

{
  "name": "OidcSession",
  "description": "A SCIM object representing an OIDC session created on the IdP",
  "attributes": [
    {
      "name": "userId",
      "type": "reference",
      "multiValued": false,
      "description": "the user associated with the OIDC session",
      "required": true,
      "mutability": "readOnly",
      "referenceTypes": ["User"],
    },
    {
      "name": "scope",
      "type": "string",
      "multiValued": false,
      "description": "the space-delimited scopes of the OIDC session",
      "required": true,
      "mutability": "readOnly",
    }
  ]
}