Subject: [scim] How to check isUsernameExist for Self Sign Up

From: Gayan Gunawardana <[email-masked]>
Date: Thu, 2 Feb 2017 23:48:14 +0530

Hello,

According to [1] self sign up can be achieved via sending authenticated
request to /Me.

What is the proper way to check isUsernameExist before self sign up ?

[1]https://tools.ietf.org/html/rfc7644#section-3.11

Thanks,
Gayan
-- 
Gayan Gunawardana
Software Engineer; WSO2 Inc.; http://wso2.com/
Email: [email-masked]
Mobile: +94 (71) 8020933

---

From: Phil Hunt <[email-masked]>
Date: Thu, 2 Feb 2017 10:49:38 -0800

Gayan,

Keep in mind SCIM is just a RESTful api. There are no functional methods like isUsernameExist.

You can…

1.  Just try HTTP POST to create the user and if there is a conflict, it gets rejected.  This is probably easiest.

2.  Use GET /Users?filter="(userName eq \”val\”)”&attributes=id.  If you can no records return there were no matches. If you get a return, it is in use.  Note, either way, you will get a successful response.

Note, I suspect it is possible that despite checking with #2, you might still get a rejection when you POST. This might be due to a reserve or lock on the username or other identifier.

Your rights as an administrative client will also impact what you get back with the query in particular.  For example, if you are querying anonymously, you might get no matches because the service provider has determined it is not going to answer your and confirm presence or not of the match.

Likewise, many service providers will have DoS and other security restrictions on what clients can register.  

E.g. to moderate the need for “anonymous” registration, a mobile app could register with the service provider to obtain a “public” OAuth client credential that gives the mobile client the right to register a new user profile on behalf of the user (e.g. by using profile data from the mobile phone).

Phil

Oracle Corporation, Identity Cloud Services & Identity Standards
@independentid
www.independentid.com <http://www.independentid.com/>[email-masked] <mailto:[email-masked]>

> On Feb 2, 2017, at 10:18 AM, Gayan Gunawardana <[email-masked]> wrote:
> 
> Hello,
> 
> According to [1] self sign up can be achieved via sending authenticated request to /Me. 
> 
> [1]https://tools.ietf.org/html/rfc7644#section-3.11 <https://tools.ietf.org/html/rfc7644#section-3.11>
> 
> Thanks,
> Gayan
> -- 
> Gayan Gunawardana
> Software Engineer; WSO2 Inc.; http://wso2.com/ <http://wso2.com/>
> Email: [email-masked] <mailto:[email-masked]> 
> Mobile: +94 (71) 8020933
>  <>_______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim

---

From: Gayan Gunawardana <[email-masked]>
Date: Fri, 3 Feb 2017 00:57:10 +0530

Hi Phil,

> Keep in mind SCIM is just a RESTful api. There are no functional methods
Yes totally understood.

> 2.  Use GET /Users?filter="(userName eq \”val\”)”&attributes=id.  If you
> can no records return there were no matches. If you get a return, it is in
> use.  Note, either way, you will get a successful response.
>
Yes both [1],[2] are possible but the problem is self sign up user(before
self sign up) does not have valid credentials to perform above operations.

>
> Note, I suspect it is possible that despite checking with #2, you might
> still get a rejection when you POST. This might be due to a reserve or lock
> on the username or other identifier.
>
> Your rights as an administrative client will also impact what you get back
> with the query in particular.  For example, if you are querying
> anonymously, you might get no matches because the service provider has
> determined it is not going to answer your and confirm presence or not of
> the match.
>
Is there any security constrains for service providers to behave like that
for anonymous requests ?

>
> Likewise, many service providers will have DoS and other security
> restrictions on what clients can register.
>
> E.g. to moderate the need for “anonymous” registration, a mobile app could
> register with the service provider to obtain a “public” OAuth client
> credential that gives the mobile client the right to register a new user
> profile on behalf of the user (e.g. by using profile data from the mobile
> phone).
>
> Phil
>
> www.independentid.com
> [email-masked]
> _______________________________________________
> scim mailing list
> [email-masked]

---

From: "Phil Hunt (IDM)" <[email-masked]>
Date: Thu, 2 Feb 2017 11:54:23 -0800

Inline

Phil

> On Feb 2, 2017, at 11:27 AM, Gayan Gunawardana <[email-masked]> wrote:
> 
> Hi Phil,
> 
> Yes both [1],[2] are possible but the problem is self sign up user(before self sign up) does not have valid credentials to perform above operations.

As i described an app could register as a developer or use dyn reg. 
> Is there any security constrains for service providers to behave like that for anonymous requests ? 

Yes DoS attacks are a concern that prevent total anonymous registration. You need some trusted broker like a web or mobile app. 

Also many IDPs likely have a vetting process to establish some assurance about claims. Eg when an enterprise calls scim the enterprise is judged authoritative over employee assertions. 

Others might do secondary validation (eg email confirmation). 

All of this is really outside the scope of provisioning protocol but part of the larger IDM services approaches.

---

From: Gayan Gunawardana <[email-masked]>
Date: Sun, 5 Feb 2017 09:55:23 +0530

> As i described an app could register as a developer or use dyn reg.
I guess you are referencing to dynamic client registration in OIDC right ?

>> Your rights as an administrative client will also impact what you get
>> back with the query in particular.  For example, if you are querying
> Yes DoS attacks are a concern that prevent total anonymous registration.
> You need some trusted broker like a web or mobile app.
>
Yes having some trusted broker like a web or mobile app would resolve many
problems. Many Thanks Phil.

>
> Also many IDPs likely have a vetting process to establish some assurance
> about claims. Eg when an enterprise calls scim the enterprise is judged
> authoritative over employee assertions.
>
>> E.g. to moderate the need for “anonymous” registration, a mobile app
>> could register with the service provider to obtain a “public” OAuth client

---

From: "Phil Hunt (IDM)" <[email-masked]>
Date: Mon, 6 Feb 2017 09:43:11 -0800

Dyn reg in oauth. But oidc may also apply depending on what you are doing. 

Phil

> On Feb 4, 2017, at 8:25 PM, Gayan Gunawardana <[email-masked]> wrote:
> 
> 
> 
>> On Fri, Feb 3, 2017 at 1:24 AM, Phil Hunt (IDM) <[email-masked]> wrote:
>> Inline
>> 
>> Phil
>> 
> Yes having some trusted broker like a web or mobile app would resolve many problems. Many Thanks Phil. 
>>

---

From: "Phil Hunt (IDM)" <[email-masked]>
Date: Mon, 6 Feb 2017 10:06:53 -0800

There is also a scim profile in oidc. See drafts section. 

Phil

> On Feb 6, 2017, at 9:43 AM, Phil Hunt (IDM) <[email-masked]> wrote:
>

---

From: Gayan Gunawardana <[email-masked]>
Date: Mon, 6 Feb 2017 23:52:54 +0530

> There is also a scim profile in oidc. See drafts section.
Thanks Phil. I guess this is the one [1].
[1]http://openid.net/specs/openid-connect-scim-profile-1_0.html