SCIM Connector

The Java-based SCIM connector runs inside the Identity Java Connector Integration Framework. It communicates with target systems that provide a System for Cross-domain Identity Management (SCIM) REST API, using JSON over HTTP or HTTPS.

The connector is implemented by the class siemens.dxm.connector.framework.rest.scim.BasicScimConnector. It translates DirX Identity connector requests to SCIM REST requests and translates the responses back to SPMLv1.

Capabilities

The connector implements a basic subset of SCIM v2 for user and group resources:

  • Add, modify, delete, and search users and groups.

  • Add and remove users from groups by updating the group membership.

  • Search with SCIM filters, requested attributes, sorting, and pagination.

  • Authenticate to the SCIM service with an OAuth 2.0 bearer token. The connector obtains and refreshes tokens using the password grant.

The connector implements basic SCIM features. The SCIM service must support the operations and request formats used by the connector; support for other SCIM features is not implied.

Configuration

DirX Identity Manager normally supplies the endpoint and bind credentials from the selected connected directory and bind profile. In the connector configuration XML, these values are specified as standard attributes of <connection>. Additional options are specified as <property> elements.

Property Type Description

server

String

Required. Host name or IP address of the SCIM service.

port

String

Port of the SCIM service.

ssl

Boolean

Enables HTTPS for the SCIM service.

user

String

Required. User name sent to the OAuth service for the password grant.

password

String

Required. Password sent to the OAuth service for the password grant.

path

String

Path to the SCIM API. Defaults to scim/v2.

authorizationServerUrl

String

Required. Full URL of the OAuth token endpoint.

clientId

String

Required. OAuth client ID used to authenticate the client to the token service.

clientSecret

String

Required. OAuth client secret used to authenticate the client to the token service.

oauthScope

String

Optional. Scope requested from the OAuth service.

proxyHost, proxyPort

String

Optional. Host and port of an HTTP proxy.

proxyUser, proxyPassword

String

Optional. Credentials for proxy authentication.

debugMode

Boolean

Enables debug logging. Defaults to false.

Example configuration:

<connector className="siemens.dxm.connector.framework.rest.scim.BasicScimConnector"
           name="SCIM" role="connector">
    <connection type="SCIMv2" server="scim.example.com" port="443"
                ssl="true" user="service-user">
        <property name="path" value="scim/v2"/>
        <property name="authorizationServerUrl"
                  value="https://auth.example.com/oauth/token"/>
        <property name="clientId" value="client-id"/>
        <property name="clientSecret" value="client-secret"/>
        <property name="oauthScope" value="userManagement"/>
    </connection>
</connector>

The SCIM API endpoint is formed from the protocol, server, port, and path. User and group resources are addressed under the Users and Groups paths, respectively.