Re: [scim] How to check isUsernameExist for Self Sign Up

["Phil Hunt (IDM)" <[e-mail]>]

There is also a scim profile in oidc. See drafts section. 

Phil

> On Feb 6, 2017, at 9:43 AM, Phil Hunt (IDM) <[e-mail]> wrote:
> 
> Dyn reg in oauth. But oidc may also apply depending on what you are doing. 
> 
> Phil
> 
>> On Feb 4, 2017, at 8:25 PM, Gayan Gunawardana <[e-mail]> wrote:
>> 
>> 
>> 
>>> On Fri, Feb 3, 2017 at 1:24 AM, Phil Hunt (IDM) <[e-mail]> wrote:
>>> Inline
>>> 
>>> Phil
>>> 
>>>> On Feb 2, 2017, at 11:27 AM, Gayan Gunawardana <[e-mail]> wrote:
>>>> 
>>>> Hi Phil,
>>>> 
>>>>> On Fri, Feb 3, 2017 at 12:19 AM, Phil Hunt <[e-mail]> wrote:
>>>>> Gayan,
>>>>> 
>>>>> Keep in mind SCIM is just a RESTful api. There are no functional methods like isUsernameExist.
>>>> Yes totally understood. 
>>>>> 
>>>>> You can…
>>>>> 
>>>>> 1.  Just try HTTP POST to create the user and if there is a conflict, it gets rejected.  This is probably easiest.
>>>>> 
>>>>> 2.  Use GET /Users?filter="(userName eq \”val\”)”&attributes=id.  If you can no records return there were no matches. If you get a return, it is in use.  Note, either way, you will get a successful response.
>>>> Yes both [1],[2] are possible but the problem is self sign up user(before self sign up) does not have valid credentials to perform above operations.
>>> 
>>> As i described an app could register as a developer or use dyn reg. 
>> I guess you are referencing to dynamic client registration in OIDC right ? 
>>>>   
>>>>> 
>>>>> Note, I suspect it is possible that despite checking with #2, you might still get a rejection when you POST. This might be due to a reserve or lock on the username or other identifier.
>>>>> 
>>>>> Your rights as an administrative client will also impact what you get back with the query in particular.  For example, if you are querying anonymously, you might get no matches because the service provider has determined it is not going to answer your and confirm presence or not of the match.
>>>> Is there any security constrains for service providers to behave like that for anonymous requests ? 
>>> 
>>> Yes DoS attacks are a concern that prevent total anonymous registration. You need some trusted broker like a web or mobile app. 
>> Yes having some trusted broker like a web or mobile app would resolve many problems. Many Thanks Phil. 
>>> 
>>> Also many IDPs likely have a vetting process to establish some assurance about claims. Eg when an enterprise calls scim the enterprise is judged authoritative over employee assertions. 
>>> 
>>> Others might do secondary validation (eg email confirmation). 
>>> 
>>> All of this is really outside the scope of provisioning protocol but part of the larger IDM services approaches. 
>>> 
>>>>> 
>>>>> Likewise, many service providers will have DoS and other security restrictions on what clients can register.  
>>>>> 
>>>>> E.g. to moderate the need for “anonymous” registration, a mobile app could register with the service provider to obtain a “public” OAuth client credential that gives the mobile client the right to register a new user profile on behalf of the user (e.g. by using profile data from the mobile phone).
>>>>> 
>>>>> Phil
>>>>> 
>>>>> Oracle Corporation, Identity Cloud Services & Identity Standards
>>>>> @independentid
>>>>> www.independentid.com
>>>>> [e-mail]
>>>>> 
>>>>> 
>>>>> 
>>>>> 
>>>>> 
>>>>> 
>>>>> 
>>>>>> On Feb 2, 2017, at 10:18 AM, Gayan Gunawardana <[e-mail]> wrote:
>>>>>> 
>>>>>> Hello,
>>>>>> 
>>>>>> According to [1] self sign up can be achieved via sending authenticated request to /Me. 
>>>>>> 
>>>>>> What is the proper way to check isUsernameExist before self sign up ?
>>>>>>   
>>>>>> [1]https://tools.ietf.org/html/rfc7644#section-3.11
>>>>>> 
>>>>>> Thanks,
>>>>>> Gayan
>>>>>> -- 
>>>>>> Gayan Gunawardana
>>>>>> Software Engineer; WSO2 Inc.; http://wso2.com/
>>>>>> Email: [e-mail] 
>>>>>> Mobile: [phone]
>>>>>> _______________________________________________
>>>>>> scim mailing list
>>>>>> [e-mail]
>>>>>> https://www.ietf.org/mailman/listinfo/scim
>>>>> 
>>>> 
>>>> 
>>>> 
>>>> -- 
>>>> Gayan Gunawardana
>>>> Software Engineer; WSO2 Inc.; http://wso2.com/
>>>> Email: [e-mail] 
>>>> Mobile: [phone]
>> 
>> 
>> 
>> -- 
>> Gayan Gunawardana
>> Software Engineer; WSO2 Inc.; http://wso2.com/
>> Email: [e-mail] 
>> Mobile: [phone]
> _______________________________________________
> scim mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/scim