Re: [scim] How to check isUsernameExist for Self Sign Up

[Gayan Gunawardana <[e-mail]>]

Hi Phil,

On Fri, Feb 3, 2017 at 12:19 AM, Phil Hunt <[e-mail]> wrote:

> Gayan,
>
> Keep in mind SCIM is just a RESTful api. There are no functional methods
> like isUsernameExist.
>
Yes totally understood.

>
> You can…
>
> 1.  Just try HTTP POST to create the user and if there is a conflict, it
> gets rejected.  This is probably easiest.
>
> 2.  Use GET /Users?filter="(userName eq \”val\”)”&attributes=id.  If you
> can no records return there were no matches. If you get a return, it is in
> use.  Note, either way, you will get a successful response.
>
Yes both [1],[2] are possible but the problem is self sign up user(before
self sign up) does not have valid credentials to perform above operations.


>
> Note, I suspect it is possible that despite checking with #2, you might
> still get a rejection when you POST. This might be due to a reserve or lock
> on the username or other identifier.
>
> Your rights as an administrative client will also impact what you get back
> with the query in particular.  For example, if you are querying
> anonymously, you might get no matches because the service provider has
> determined it is not going to answer your and confirm presence or not of
> the match.
>
Is there any security constrains for service providers to behave like that
for anonymous requests ?

>
> Likewise, many service providers will have DoS and other security
> restrictions on what clients can register.
>
> E.g. to moderate the need for “anonymous” registration, a mobile app could
> register with the service provider to obtain a “public” OAuth client
> credential that gives the mobile client the right to register a new user
> profile on behalf of the user (e.g. by using profile data from the mobile
> phone).
>
> Phil
>
> Oracle Corporation, Identity Cloud Services & Identity Standards
> @independentid
> www.independentid.com
> [e-mail]
>
>
>
>
>
>
>
> On Feb 2, 2017, at 10:18 AM, Gayan Gunawardana <[e-mail]> wrote:
>
> Hello,
>
> According to [1] self sign up can be achieved via sending authenticated
> request to /Me.
>
> What is the proper way to check isUsernameExist before self sign up ?
>
> [1]https://tools.ietf.org/html/rfc7644#section-3.11
>
> Thanks,
> Gayan
> --
> Gayan Gunawardana
> Software Engineer; WSO2 Inc.; http://wso2.com/
> Email: [e-mail]
> Mobile: [phone]
> _______________________________________________
> scim mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/scim
>
>
>


-- 
Gayan Gunawardana
Software Engineer; WSO2 Inc.; http://wso2.com/
Email: [e-mail]
Mobile: [phone]