Hey Ivan,
To enroll a user in TOTP/HOTP, they can either view the QR codes through the link you found, or perform at GET to the OTP endpoint. So it sounds like you have enrolled successfully.
The other reason that the schema may not show up is if the username does not match the SCIM username. A common cause is the user logging in with a different case compared to the SCIM request, for example they enrolled OTPs against the username `userName` but you are searching for users with `UserName`. Can you confirm if this is the case?
You can check this by doing a generic /scim/Users request, rather than a filtered request, and see if there are extra accounts being returned.
If you need the username to be treated as case insensitive, you may need to follow the instructions here:
https://community.ibm.com/community/user/security/blogs/jasmine-smith1/2019/01/08/advanced-access-control-username-case-sensitivityThe reason this may have worked in the lab is that on ISO installs of ISAM 9.0.4+, username case sensitivity is disabled by default.
------------------------------
Jasmine
------------------------------
Original Message:
Sent: Fri November 29, 2019 04:23 AM
From: Ivan Yartsev
Subject: SCIM attribute is not present in the responce
Hi Jasmine,
Thank you for your reply. The version of ISAM is 9.0.7 in both environments and I expect
urn:ietf:params:scim:schemas:extension:isam:1.0:OTP.totpEnrolled
to be set to true.
What triggers this attribute, I mean what action causes it to be set tu true? I get the codeas a picture (/mga/sps/mga/user/mgmt/otp/qr/totp) and a GET is issued to get a secret, so I expect it should be enough, is it?
------------------------------
Ivan Yartsev
Original Message:
Sent: Wed November 27, 2019 05:52 PM
From: Jasmine Smith
Subject: SCIM attribute is not present in the responce
Hi Ivan,
There are a couple of reasons the OTP schema might be missing from the customer's environment.
First reason is the user might not have TOTP or HOTP enrolled. The OTP schema will only be present in the response if at least one of the OTP methods is enrolled, i.e. at least totpEnrolled or hotpEnrolled must be true. If both are false, the schema will be omitted (this is because of ISAM's SCIM framework. Happy to go into details if so desired).
Secondly, the OTP schema was only added in ISAM 907. If the customer environment is on an earlier version of ISAM, the schema won't be present.
You can flick through the ISAM versions here to see which schemas are included in specific versions here: https://www.ibm.com/support/knowledgecenter/SSPREK_9.0.7/com.ibm.isam.doc/admin/concept/con_scim_resource_schema.html
Hope this helps
------------------------------
Jasmine Smith
Original Message:
Sent: Tue November 26, 2019 08:44 AM
From: Ivan Yartsev
Subject: SCIM attribute is not present in the responce
Hi Community,
When I perform SCIM user request
/Users?filter=userName%20eq%20UserName
in my Lab I get urn:ietf:params:scim:schemas:extension:isam:1.0:OTP.totpEnrolled attribute for a user:
"urn:ietf:params:scim:schemas:extension:isam:1.0:OTP": {
"totpEnrolled": true,
"hotpEnrolled": true
},
but in customer environment I don't get this attribute.
The Attribute is configured in Global Settings under Attribute Modes in mode "ReadWrite" with "Defaul" settings set to "yes".
What could be the reason for such behavior, what should be done to get urn:ietf:params:scim:schemas:extension:isam:1.0:OTP.totpEnrolled in the SCIM answer?
------------------------------
Best Regards
Ivan Yartsev
------------------------------