[scim] Storing "federated" user identifiers using SCIM

[Matt Randall <[e-mail]>]

Our company has an interesting use case - I was curious if any members of
the group had encountered it when developing their own SaaS platform, if
there were perhaps an existing schema / schema attribute that I had
overlooked, or if there is some sort of existing convention for the
following use case?

For our SaaS platform, we want to enable our customers to push users to our
platform and enable those users to log in with a potential multiplicity of
identity providers (1:M relationship between a user and their individual
identities at different identity provider(s)).  This would require the
storage of both the "issuer" (SAML entity ID, OIDC Issuer) and principal
(and, in the case of SAML, potentially the NameID type.)

I'd imagine this type of data would be modeled as a multi-valued attribute
of user whose values are complex attributes, containing the 2-3
prerequisite data points mentioned above.

To date, we had always aligned SCIM as a 1:1 feed with an identity
provider, requiring the IdP's asserted principal to match the SCIM
username.  We're encountering scenarios where it would be useful for
customers to have a single feed where users use potentially different
identity providers, and where a single user might be serviced by
multiples.  Does anyone else share our use case in this community, or
perhaps encountered an existing pattern for this?

Thank you,

- Matt Randall