Re: [scim] How to check isUsernameExist for Self Sign Up

[Gayan Gunawardana <[e-mail]>]

On Fri, Feb 3, 2017 at 1:24 AM, Phil Hunt (IDM) <[e-mail]>
wrote:

> Inline
>
> Phil
>
> On Feb 2, 2017, at 11:27 AM, Gayan Gunawardana <[e-mail]> wrote:
>
> Hi Phil,
>
> On Fri, Feb 3, 2017 at 12:19 AM, Phil Hunt <[e-mail]> wrote:
>
>> Gayan,
>>
>> Keep in mind SCIM is just a RESTful api. There are no functional methods
>> like isUsernameExist.
>>
> Yes totally understood.
>
>>
>> You can…
>>
>> 1.  Just try HTTP POST to create the user and if there is a conflict, it
>> gets rejected.  This is probably easiest.
>>
>> 2.  Use GET /Users?filter="(userName eq \”val\”)”&attributes=id.  If you
>> can no records return there were no matches. If you get a return, it is in
>> use.  Note, either way, you will get a successful response.
>>
> Yes both [1],[2] are possible but the problem is self sign up user(before
> self sign up) does not have valid credentials to perform above operations.
>
>
> As i described an app could register as a developer or use dyn reg.
>
I guess you are referencing to dynamic client registration in OIDC right ?

>
>
>>
>> Note, I suspect it is possible that despite checking with #2, you might
>> still get a rejection when you POST. This might be due to a reserve or lock
>> on the username or other identifier.
>>
>> Your rights as an administrative client will also impact what you get
>> back with the query in particular.  For example, if you are querying
>> anonymously, you might get no matches because the service provider has
>> determined it is not going to answer your and confirm presence or not of
>> the match.
>>
> Is there any security constrains for service providers to behave like that
> for anonymous requests ?
>
>
> Yes DoS attacks are a concern that prevent total anonymous registration.
> You need some trusted broker like a web or mobile app.
>
Yes having some trusted broker like a web or mobile app would resolve many
problems. Many Thanks Phil.

>
> Also many IDPs likely have a vetting process to establish some assurance
> about claims. Eg when an enterprise calls scim the enterprise is judged
> authoritative over employee assertions.
>
> Others might do secondary validation (eg email confirmation).
>
> All of this is really outside the scope of provisioning protocol but part
> of the larger IDM services approaches.
>
>
>> Likewise, many service providers will have DoS and other security
>> restrictions on what clients can register.
>>
>> E.g. to moderate the need for “anonymous” registration, a mobile app
>> could register with the service provider to obtain a “public” OAuth client
>> credential that gives the mobile client the right to register a new user
>> profile on behalf of the user (e.g. by using profile data from the mobile
>> phone).
>>
>> Phil
>>
>> Oracle Corporation, Identity Cloud Services & Identity Standards
>> @independentid
>> www.independentid.com
>> [e-mail]
>>
>>
>>
>>
>>
>>
>>
>> On Feb 2, 2017, at 10:18 AM, Gayan Gunawardana <[e-mail]> wrote:
>>
>> Hello,
>>
>> According to [1] self sign up can be achieved via sending authenticated
>> request to /Me.
>>
>> What is the proper way to check isUsernameExist before self sign up ?
>>
>> [1]https://tools.ietf.org/html/rfc7644#section-3.11
>>
>> Thanks,
>> Gayan
>> --
>> Gayan Gunawardana
>> Software Engineer; WSO2 Inc.; http://wso2.com/
>> Email: [e-mail]
>> Mobile: [phone]
>> _______________________________________________
>> scim mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/scim
>>
>>
>>
>
>
> --
> Gayan Gunawardana
> Software Engineer; WSO2 Inc.; http://wso2.com/
> Email: [e-mail]
> Mobile: [phone]
>
>


-- 
Gayan Gunawardana
Software Engineer; WSO2 Inc.; http://wso2.com/
Email: [e-mail]
Mobile: [phone]