IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  SCIM attribute Active and externalId

    Posted 03/25/21 05:59 AM
    I have some issues regarding these 2 attributes.
    Let's start with Active:
    • When I create a use using SCIM, and in the json file I add the attribute "active", it will return that it is not a valid attribute.
      • According the IETF RFC 7643, this attribute is: "A Boolean value indicating the user's administrative status. The definitive meaning of this attribute is determined by the service provider. As a typical example, a value of true implies that the user is able to log in, while a value of false implies that the user's account has been suspended."
    • I believe the reason to return an error, is not being mapped to an LDAP attribute by default.
    • Now comes the issue: active attribute is a boolean value, and I would like to map it to the inetOrgPerson attribute that will prevent the user from login in. but there is no such attribute. There is a workaround to achieve this, but I may need to map the active (which is a boolean) to a status which is an integer (0 would be disable) and (1 would be enable). How can I map the "active" boolean to a string or integer in an LDAP objectclass?

    Second issue which is related to externalId:
    • Unlike active, if I use externalId in the json used to create the user, it will allow me, and returns no error!
    • But when I need to retrieve this value, I will not be able to find it! If I use GET /scim/Users/{id}, the externalId will not show up!


    ------------------------------
    Joao Goncalves
    Pyxis, Lda.
    Sintra
    +351 91 721 4994
    ------------------------------


  • 2.  RE: SCIM attribute Active and externalId

    Posted 03/26/21 05:10 AM
    Hi Joao,

    The LDAP attribute controlling whether a user is active is "secAcctValid" of "secUser" objectclass. It is set on the entry "principalName=xxx,cn=Users,SECAUTHORITY=DEFAULT"

    ------------------------------
    Laurent LA Asselborn
    ------------------------------



  • 3.  RE: SCIM attribute Active and externalId

    Posted 03/29/21 04:08 AM
    But does this apply to both full and basic users?

    ------------------------------
    Joao Goncalves
    Pyxis, Lda.
    Sintra
    +351 91 721 4994
    ------------------------------

    Original Message


  • 4.  RE: SCIM attribute Active and externalId

    Posted 03/29/21 04:16 AM
    I don't have much experience with basic users, but it is my understanding that basic users don't have an entry in the secauthority=default subtree. So no, this attribute does probably not apply to basic users.

    ------------------------------
    Laurent LA Asselborn
    ------------------------------

    Original Message


Related Content