System for Cross-domain Identity Management: Core Schema

Schema extensions follow an additive model analogous to LDAP auxiliary object classes, with no inheritance. This means each schema extension URI in 'schemas' adds attributes without overriding the base schema, avoiding the complexity of an inheritance hierarchy.

json, ldap

SCIM's schema is attribute-based rather than document-centric (as in XML Schema). Each attribute has independent type, mutability, cardinality, and returnability; validation is always performed by the receiver in the context of a protocol request, allowing service providers to evaluate individual attributes against their characteristics.

json

For backward compatibility, some existing schema definitions MAY list common attributes as part of the schema; in such cases, the attribute characteristics defined in Section 3.1 of RFC 7643 SHALL take precedence over older definitions.

json

Binary attribute values MUST be base64 encoded per RFC 4648 Section 4; URL-safe encoding per Section 5 MAY be specified. Complex attributes MUST NOT contain sub-attributes that themselves have sub-attributes (no nesting beyond one level).

json

DateTime values MUST be encoded as valid xsd:dateTime per XML Schema Section 3.3.7 and MUST include both a date and a time component. Integer values MUST NOT contain fractional or exponent parts.

json

Each User MUST include a non-empty 'userName' value that is unique across the service provider's entire set of Users. The 'userName' is case insensitive.

json, security

Schema extensions SHOULD avoid redefining attributes already defined in the core specification. The schema extension URI SHALL be used as a JSON container namespace to distinguish extension attributes from base schema attributes, avoiding name conflicts.

json

The cleartext value or hashed value of a 'password' SHALL NOT be returnable by a service provider (mutability is 'writeOnly', returned is 'never'). If immediately passed to another system, the value MUST be transmitted over a secured connection (e.g., TLS); if temporarily persisted, it MUST be protected by encryption.

security, crypto

The 'groups' attribute has a mutability of 'readOnly'; group membership changes MUST be applied via the 'Group' resource. When a 'Group' resource is exposed, the 'value' sub-attribute MUST be the group 'id' and '$ref' must be the URI of the corresponding Group resource.

json

The 'id' attribute MUST be unique across the entire SCIM service provider's set of resources, MUST be a stable non-reassignable identifier, and MUST NOT be specified by the client. The string 'bulkId' is a reserved keyword and MUST NOT be used as an id value.

json, security

The 'meta.location' value MUST be the same as the 'Content-Location' HTTP response header, and 'meta.version' must be the same as the entity-tag (ETag) HTTP response header. If the ETag does not satisfy all characteristics of a strong validator, the server MUST mark it as weak by prefixing with 'W/'.

http, json

The 'primary' sub-attribute value of 'true' MUST appear no more than once within a multi-valued attribute. If unspecified, 'primary' SHALL be assumed to be 'false'.

json

The 'schemas' attribute is REQUIRED on every SCIM resource and MUST be a non-empty array of unique URIs. Duplicate values MUST NOT be included, and the value order MUST NOT impact behavior.

json

The 'id' and 'externalId' attributes may expose personally identifiable information (see Section 9.3). Implementers deploying multi-hop or multi-party SCIM scenarios must carefully review service level agreements and privacy agreements before distributing or propagating personal information.

privacy, security

Common attributes present in every SCIM resource include 'id' (service-provider-assigned, readOnly, always returned, globally unique), 'externalId' (client-assigned, readWrite, OPTIONAL), and 'meta' (complex, readOnly, containing resourceType, created, lastModified, location, version).

json

Every SCIM resource is a JSON object containing a mandatory 'schemas' attribute (array of URIs), common attributes (id, externalId, meta), core attributes defined by the resource type's schema, and optional extended attributes namespaced by their schema extension URI.

json, registry

Multi-valued attributes are JSON arrays whose elements may be primitives or complex objects. The predefined sub-attributes for multi-valued complex elements are: 'type' (label), 'primary' (Boolean), 'display' (human-readable name, immutable), 'value' (significant value), and '$ref' (reference URI, OPTIONAL).

json

The Enterprise User Schema Extension (urn:ietf:params:scim:schemas:extension:enterprise:2.0:User) adds employeeNumber, costCenter, organization, division, department, and manager (complex type with value/$ref/displayName sub-attributes referencing another User's 'id').

json

The Group resource (schema URI: urn:ietf:params:scim:schemas:core:2.0:Group) defines 'displayName' (REQUIRED, human-readable) and 'members' (multi-valued, with 'value' containing a SCIM resource 'id' and '$ref' containing the URI; sub-attributes are immutable).

json

The Schema Definition resource (urn:ietf:params:scim:schemas:core:2.0:Schema) describes each attribute via sub-attributes: name, type, subAttributes, multiValued, description, required, canonicalValues, caseExact, mutability (readOnly/readWrite/immutable/writeOnly), returned (always/never/default/request), uniqueness (none/server/global), and referenceTypes.

json, registry

The ServiceProviderConfig resource (urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig) advertises support for patch, bulk (with maxOperations and maxPayloadSize), filter (with maxResults), changePassword, sort, etag, and authenticationSchemes. All attributes are readOnly.

json, http

The User resource defines multi-valued attributes: emails, phoneNumbers, ims, photos, addresses (complex with formatted/streetAddress/locality/region/postalCode/country), groups (readOnly, membership via Group resource), entitlements, roles, and x509Certificates (each value is a single DER-encoded X.509 certificate, base64-encoded).

json, pkix

The User resource (schema URI: urn:ietf:params:scim:schemas:core:2.0:User) defines singular attributes including userName (REQUIRED, unique), name (complex with formatted/familyName/givenName/middleName/honorificPrefix/honorificSuffix), displayName, nickName, profileUrl, title, userType, preferredLanguage, locale, timezone, active, and password.

json

This document establishes the SCIM Schema Registry, which records SCIM schema URIs. The initial registrations include the core User, Group, ServiceProviderConfig, ResourceType, and Schema schemas, as well as the Enterprise User extension schema. Registration requires an IETF Review or Expert Review procedure.

registry

This document registers the SCIM URN sub-namespace 'urn:ietf:params:scim' under the IETF URN sub-namespace registry, enabling stable identification of SCIM schemas and protocol elements via URNs.

registry

Passwords and other sensitive security data SHOULD be hashed when stored locally. Service providers that pass cleartext passwords immediately to another system MUST do so over a secured connection (TLS). If temporarily persisted (e.g., for workflow), the value MUST be encrypted.

security, crypto

SCIM protocol interactions MUST use appropriate authentication and authorization per RFC 7644. Service providers are advised to consider multi-hop and multi-party scenarios carefully, as personal information may be propagated to third parties acting as downstream SCIM clients or providers.

security, oauth

SCIM attribute data types map to JSON as follows: String → JSON string (UTF-8), Boolean → JSON boolean, Decimal/Integer → JSON number, DateTime → JSON string in xsd:dateTime format, Binary → JSON string (base64-encoded), Reference → JSON string (URI), Complex → JSON object.

json