Overview
The SCIM standard is created to simplify user management and provisioning in the cloud by defining a schema for representing users and groups and a REST API for all the necessary CRUD operations. SCIM integrations with CAS allow deployers to auto-provision the authenticated CAS principal to a SCIM server/target with additional support to map principal attributes into the appropriate claims and properties of the user resource.
SCIM v2 is supported, thanks to the SDK provided by UnboundID.
This feature is deprecated and is scheduled to be removed in the future.
Typical use case for enabling SCIM is to synchronize and provision user accounts, just in time, to services and applications that are integrated with CAS for single sign-on. In cases where the application also has its own account store, a mapping of user accounts between the CAS canonical account store (LDAP, JDBC, etc) and the application may be required. To accommodate this issue, CAS may be allowed to provision the authenticated principal via SCIM to a provisioning/identity/entity engine which would then dynamically synchronize user profiles to target systems.
Configuration
Support is enabled by including the following dependency in the WAR overlay:
1
2
3
4
5
<dependency>
<groupId>org.apereo.cas</groupId>
<artifactId>cas-server-support-scim</artifactId>
<version>${cas.version}</version>
</dependency>
1
implementation "org.apereo.cas:cas-server-support-scim:${project.'cas.version'}"
1
2
3
4
5
6
7
8
9
dependencyManagement {
imports {
mavenBom "org.apereo.cas:cas-server-support-bom:${project.'cas.version'}"
}
}
dependencies {
implementation "org.apereo.cas:cas-server-support-scim"
}
1
2
3
4
5
6
7
8
9
10
dependencies {
/*
The following platform references should be included automatically and are listed here for reference only.
implementation enforcedPlatform("org.apereo.cas:cas-server-support-bom:${project.'cas.version'}")
implementation platform(org.springframework.boot.gradle.plugin.SpringBootPlugin.BOM_COORDINATES)
*/
implementation "org.apereo.cas:cas-server-support-scim"
}
The following settings and properties are available from the CAS configuration catalog:
cas.scim.oauth-token=
Authenticate into the SCIM server/service via a pre-generated OAuth token.
|
cas.scim.password=
Authenticate into the SCIM server with a pre-defined password.
|
cas.scim.target=
The SCIM provisioning target URI.
|
cas.scim.username=
Authenticate into the SCIM server with a pre-defined username.
|
cas.scim.enabled=true
Decide whether scim should be enabled.
|
cas.scim.version=2
Indicate what version of the scim protocol is and should be used.
|