IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  SCIM search Suffix

    Posted Tue May 12, 2020 04:36 AM

    Hi All,
    we have a LDAP with several Suffixes for different Portal applications. Would it be possible to configure SCIM to support mir than one Suffix? 

    Also I wonder if I could extend the SCIM schema somehow. The Attribute mapping allows different LDAP Attributes to existing SCIM Attributes but in several cases the schema is not flexible enough to support the portal applications. 

    thanks for any hint



    ------------------------------
    Jens Petersen
    ------------------------------


  • 2.  RE: SCIM search Suffix
    Best Answer

    Posted Wed May 13, 2020 09:15 AM
    Hi Jens,

    I don't think it is possible to search multiple suffixes with SCIM.  I assume you don't have a parent suffix that would cover all of the different suffixes that you want to check?  I had a thought that maybe if you use the ISAM Runtime as the Server Connection (instead of LDAP) it might help but I have not had a chance to try it.

    I'm afraid it is NOT possible to customize the SCIM schema.  You can modify the mapping to LDAP attributes but you can't create new SCIM schema or attributes.

    Jon.

    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------

    Original Message


  • 3.  RE: SCIM search Suffix

    Posted Wed May 13, 2020 09:52 AM

    Hi Jens, Assuming several suffixes within a single LDAP repository and user already exists in LDAP,  point SCIM at the root suffix. At runtime, SCIM can retrieve and validate users from any OU under root suffix.  Once the User is retrieved, profile attributes within SCIM schema can be added/modified.

    One classic example is to authenticate user, create and update 2-factor knowledge questions for user.


    Are you intending to provision/register users via SCIM or a different service?


    Regards,
    Rama



    ------------------------------
    Rama Yenumula
    ------------------------------

    Original Message


  • 4.  RE: SCIM search Suffix

    Posted Thu May 14, 2020 08:13 AM
    Thanks Rama,
    I'm giving the root suffix a try as well. Guess that will have impact on performance. I'm trying to implement User management with the SCIM, just because using REST is less complex for developers than using LDAP ;).

    ------------------------------
    Jens Petersen
    ------------------------------

    Original Message


  • 5.  RE: SCIM search Suffix

    Posted Thu May 14, 2020 08:09 AM
    Hi John,
    thanks for that. You're right it's not possible to extend the schema and there is no option for adding more than one suffix. I've tried the Runtime but still need a user Suffix, also a new field Attribute Lookup Directory. Actually I thought I could just use the secAuthority Suffix as user suffix. Giving that a try again.

    ------------------------------
    Jens Petersen
    ------------------------------

    Original Message