SCIM 2.0 API Questions

[randall_holt]

I am looking for some assistance with SCIM 2.0 APIs. See below.

1. Can someone confirm which of the below SCIM 2.0 end points are supported by Identity Now SCIM 2.0 connectors.

SCIM: System for Cross-domain Identity Management (simplecloud.info)

• Create: POST https://example.com/{v}/{resource}
• Read: GET https://example.com/{v}/{resource}/{id}
• Replace: PUT https://example.com/{v}/{resource}/{id}
• Delete: DELETE https://example.com/{v}/{resource}/{id}
• Update: PATCH https://example.com/{v}/{resource}/{id}
• Search: GET https://example.com/{v}/{resource}?filter={attribute}{op}{value}&sortBy={attributeName}&sortOrder={ascending|descending}
• Bulk: POST https://example.com/{v}/Bulk

Have been referring below documentation, but couldn’t find the above info. Please share if there’s any more documentation providing the above details ?

Integrating SailPoint with SCIM 2.0…

2. Are Replace and Update both Supported by SCIM 2.0 Connector. If yes, then what will be the difference between the two from Identity Now perspective.

Thanks in advance.

[yannick_beot]

Hi,

SCIM 2.0 supports basic operations:

• Create
• Read
• Replace/Update
• Search
• Delete
  I do not think Bulk is supported.
  Whether the connector is supporting Replace or Update (Patch) depends on the configuration: see usePatch parameter (cf. Additional Settings)

Filtering is supported (cf
Aggregation Settings to define filters and attribute list)

[mandeepsingh (Mandeep Singh Gujral)]

Thanks , Please also see additional queries below:

1. The Documentation below states that
   “CAUTION: SCIM 2.0 source doesn’t have the default Create Profile. However, SailPoint recommends that you work with Services to define a Create Profile specific to your company’s needs.”

https://documentation.sailpoint.com/connectors/scim_2_0/help/integrating_scim2/provisioning_policy.htmlhttps://documentation.sailpoint.com/connectors/scim_2_0/help/integrating_scim2/provisioning_policy.html

Does this means that only SailPoint Services can create the “Create Profile” ?
Can’t we create the profile using APIs ?

2. **Group update from Create User Request:
   **Refer additional settings documentation: Additional Settings
   It states that " The SCIM 2.0 source now supports modification of groups’ information through the Users endpoint. Add the updateGroupsViaUsers attribute with true as a value to the source XML file using IdentityNow REST API (For example, ). "

Does this means that Identity Now can add or remove members within the create request, and /Groups need not be called seperately ?

[mandeepsingh (Mandeep Singh Gujral)]

3. Additionally, Please confirm if ETag and Version attributes are optional in the response send by SCIM API to Identity Now SCIM 2.0 Connector ? We do have have this clarity in the documentation.

[yannick_beot]

1. You can create the provisioning policy through the API (cf. create-provisioning-policy | SailPoint Developer Community). If you do not know how to do it, you may need to engage PS
2. As explained in the documentation, by default, to update group members, you use the /groups endpoint. Groups are also part of the User object. So if you want to update the groups of a user through the /Users endpoint, you can.
3. If these headers are not mention, it is probably because they are not used.

[mandeepsingh (Mandeep Singh Gujral)]

Thanks Yannick, Will the group update from /Users be enabled by making updateGroupsViaUsers attribute as true. Can you please confirm ?

In case we keep updateGroupsViaUsers****strong text as false, do we need any additional configurations for updating group using /Groups ?

[thymmen (Thijmen Duijve)]

Hi @mandeepsingh,

My answers:

1. Yes, setting updateGroupsViaUsers to “true” will force the connector to create an update call to the /Users endpoint that contains the group membership that needs to be added or removed (patch operation I believe).
2. You don’t need to do additional configurations to update groups via the /Groups endpoint. By default, the connector send a patch operation that updates the /members/value attribute on the group with the users that need to be added/removed.

I do have a follow-up question that I’m still trying to get my head around. Perhaps someone knows the answers: how do I aggregate group memberships from the /groups-endpoint? In my case, our SCIM-server does not save group memberships on the user-object (so the groups-attribute on the user object is empty). The memberships are only stored on the groups-object. I don’t know if this is per SCIM-specification as I couldn’t find it in the specs. But I do know that SailPoint only aggregates the /Users-endpoint during an account aggregation, so how do I retrieve the group memberships? Perhaps @yannick_beot has the answer?

[mandeepsingh (Mandeep Singh Gujral)]

Hi @yannick_beot , @randall_holt

1. we are unable to grab the HTTP requests (generated by SCIM API Connector), even after following all the steps given in below documentation:

CCG Enable Debug Log by Connector - Compass (sailpoint.com)

2. After implementing above steps, The logs generated become much more detailed and show logging level as Debug, but HTTP requests generated by SCIM 2.0 connector are simply not there. These are vital for us to troubleshoot issues and integrate faster with other systems, so that we can meet timelines in a fast paced environment.

3. Below are the current configurations done to grab HTTP requests:

   Enabled Development Mode on SCIM2 Connector
   Updated log4j2.properties with below changes :

•   **Enabled Debug Mode** on ***openconnector.connector.scim2*** Connector
  

•   **Enabled Debug mode on openconnector.connector.scim2.SCIM2Connector**
  

[chirag_patel]

@mandeepsingh

Development Mode on SCIM2 Connector
Updated log4j2.properties with below changes :

Try below loggers , they should work. Executionmediator should give you api calls being made.

logger.sailpoint.name = connector.common.http
logger.sailpoint.level = debug
logger.sailpoint.additivity = false
logger.sailpoint.appenderRef.rolling.ref = STDOUT


logger.sailpoint.name = connector.sdk.webservices
logger.sailpoint.level = debug
logger.sailpoint.additivity = false
logger.sailpoint.appenderRef.rolling.ref = STDOUT

logger.sailpoint.name = connector.sdk.webservices.ExecutionMediator
logger.sailpoint.level = trace
logger.sailpoint.additivity = false
logger.sailpoint.appenderRef.rolling.ref = STDOUT

logger.sailpoint.name = sailpoint.connector.webservices.v2
logger.sailpoint.level = debug
logger.sailpoint.additivity = false
logger.sailpoint.appenderRef.rolling.ref = STDOUT

[mandeepsingh (Mandeep Singh Gujral)]

Please can someone clarify few queries below Regarding Pagination on Identity now
SCIM 2.0 Connector’s Additional Settings Page:

1. Suppose “Account Size” is specified to be 50, Does that mean that only max. 50 accounts will be accepted by IdentityNow during aggregation even if number of accounts returned by the downstream SCIM application are more than 50 ?

2. Alternatively, For a single aggregation request, Does the downstream SCIM application needs to break the aggregation result set into mutiple batches , where each batch size must match the Account Size ?

[mandeepsingh (Mandeep Singh Gujral)]

3. Additionally, Is there a way to not use pagination. The current “Account Size” and “Group Size” fields do not allow a value below 1.

4. If we do not use Pagination, What would be the impact ? Will it degrade the performance of SCIM 2.0 Client and Server ?

[mandeepsingh (Mandeep Singh Gujral)]

During user aggregation with Pagination, Does the Identity Now SCIM 2.0 connector expects the total Results value returned (for each page) to be always equal to the total users matching the search query OR it will be a reducing number indicating the remaining results of the search query.

e.g. If “Account Size” is specified to be 50, and total number of search query results are 1000, then for the first page, the totalResults will be set to 1000, and for second page, it will be 950 and then 900 , 850 … for the subsequent pages, OR it will always be 1000 ?

[guduru510 (Sravan Kumar guduru)]

@mandeepsingh @thymmen
@mandeepsingh @thymmen
I have question on update our scim xml file with to make use
of our PUT /Users instead of PUT /Groups.

1. Add entitlement: When i tried adding entitlement for an user, PUT /users is getting called but the required group is not been send as part of the PUT request.

ex: I am trying to add group_1 for an account abc, and abc is already part of group_2 and group_3. Below is how the put request looks like
“members”:[
{
“value”:“group_2”,
},
{
“value”:“group_3”,
}
],

I don’t see group_1 is coming as part of the request.

Can some one help why is it happening like this ? what would be wrong

2. Remove Entitlement: When i tried removing entitlement for an user, instead of PUT /Users getting called it is calling PUT /Groups. I already updated to use GroupsViaUsers as true, not sure why is it calling PUT /Groups instead of PUT /Users. Any thoughts or suggestions on this ?