Re: [scim] How to check isUsernameExist for Self Sign Up

On Mon, Feb 6, 2017 at 11:36 PM, Phil Hunt (IDM) <phil.hunt@oracle.com>
wrote:

> There is also a scim profile in oidc. See drafts section.
>
Thanks Phil. I guess this is the one [1].
[1]http://openid.net/specs/openid-connect-scim-profile-1_0.html

>
> Phil
>
> On Feb 6, 2017, at 9:43 AM, Phil Hunt (IDM) <phil.hunt@oracle.com> wrote:
>
> Dyn reg in oauth. But oidc may also apply depending on what you are doing.
>
> Phil
>
> On Feb 4, 2017, at 8:25 PM, Gayan Gunawardana <gayan@wso2.com> wrote:
>
>
>
> On Fri, Feb 3, 2017 at 1:24 AM, Phil Hunt (IDM) <phil.hunt@oracle.com>
> wrote:
>
>> Inline
>>
>> Phil
>>
>> On Feb 2, 2017, at 11:27 AM, Gayan Gunawardana <gayan@wso2.com> wrote:
>>
>> Hi Phil,
>>
>> On Fri, Feb 3, 2017 at 12:19 AM, Phil Hunt <phil.hunt@oracle.com> wrote:
>>
>>> Gayan,
>>>
>>> Keep in mind SCIM is just a RESTful api. There are no functional methods
>>> like isUsernameExist.
>>>
>> Yes totally understood.
>>
>>>
>>> You can…
>>>
>>> 1.  Just try HTTP POST to create the user and if there is a conflict, it
>>> gets rejected.  This is probably easiest.
>>>
>>> 2.  Use GET /Users?filter="(userName eq \”val\”)”&attributes=id.  If you
>>> can no records return there were no matches. If you get a return, it is in
>>> use.  Note, either way, you will get a successful response.
>>>
>> Yes both [1],[2] are possible but the problem is self sign up user(before
>> self sign up) does not have valid credentials to perform above operations.
>>
>>
>> As i described an app could register as a developer or use dyn reg.
>>
> I guess you are referencing to dynamic client registration in OIDC right ?
>
>>
>>
>>>
>>> Note, I suspect it is possible that despite checking with #2, you might
>>> still get a rejection when you POST. This might be due to a reserve or lock
>>> on the username or other identifier.
>>>
>>> Your rights as an administrative client will also impact what you get
>>> back with the query in particular.  For example, if you are querying
>>> anonymously, you might get no matches because the service provider has
>>> determined it is not going to answer your and confirm presence or not of
>>> the match.
>>>
>> Is there any security constrains for service providers to behave like
>> that for anonymous requests ?
>>
>>
>> Yes DoS attacks are a concern that prevent total anonymous registration.
>> You need some trusted broker like a web or mobile app.
>>
> Yes having some trusted broker like a web or mobile app would resolve many
> problems. Many Thanks Phil.
>
>>
>> Also many IDPs likely have a vetting process to establish some assurance
>> about claims. Eg when an enterprise calls scim the enterprise is judged
>> authoritative over employee assertions.
>>
>> Others might do secondary validation (eg email confirmation).
>>
>> All of this is really outside the scope of provisioning protocol but part
>> of the larger IDM services approaches.
>>
>>
>>> Likewise, many service providers will have DoS and other security
>>> restrictions on what clients can register.
>>>
>>> E.g. to moderate the need for “anonymous” registration, a mobile app
>>> could register with the service provider to obtain a “public” OAuth client
>>> credential that gives the mobile client the right to register a new user
>>> profile on behalf of the user (e.g. by using profile data from the mobile
>>> phone).
>>>
>>> Phil
>>>
>>> Oracle Corporation, Identity Cloud Services & Identity Standards
>>> @independentid
>>> www.independentid.com
>>> phil.hunt@oracle.com
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>> On Feb 2, 2017, at 10:18 AM, Gayan Gunawardana <gayan@wso2.com> wrote:
>>>
>>> Hello,
>>>
>>> According to [1] self sign up can be achieved via sending authenticated
>>> request to /Me.
>>>
>>> What is the proper way to check isUsernameExist before self sign up ?
>>>
>>> [1]https://tools.ietf.org/html/rfc7644#section-3.11
>>>
>>> Thanks,
>>> Gayan
>>> --
>>> Gayan Gunawardana
>>> Software Engineer; WSO2 Inc.; http://wso2.com/
>>> Email: gayan@wso2.com
>>> Mobile: +94 (71) 8020933
>>> _______________________________________________
>>> scim mailing list
>>> scim@ietf.org
>>> https://www.ietf.org/mailman/listinfo/scim
>>>
>>>
>>>
>>
>>
>> --
>> Gayan Gunawardana
>> Software Engineer; WSO2 Inc.; http://wso2.com/
>> Email: gayan@wso2.com
>> Mobile: +94 (71) 8020933
>>
>>
>
>
> --
> Gayan Gunawardana
> Software Engineer; WSO2 Inc.; http://wso2.com/
> Email: gayan@wso2.com
> Mobile: +94 (71) 8020933
>
> _______________________________________________
> scim mailing list
> scim@ietf.org
> https://www.ietf.org/mailman/listinfo/scim
>
>

-- 
Gayan Gunawardana
Software Engineer; WSO2 Inc.; http://wso2.com/
Email: gayan@wso2.com
Mobile: +94 (71) 8020933