System for Cross-domain Identity Management: Protocol

Document validation techniques (e.g., XML Schema) are not recommended for SCIM because SCIM is designed for cross-domain use where schema and implementations may vary; service providers interpret requests in the context of their own schema.

http, json

SCIM PATCH deliberately diverges from JSON Patch (RFC 6902) by not supporting array indexing or array manipulation operations like 'move', because SCIM resources use named attributes rather than positional array elements.

http, json

SCIM service providers MAY support additional query parameters not specified in the protocol and SHOULD ignore unrecognized parameters rather than rejecting the query, to preserve versioning compatibility.

http

A PATCH 'remove' operation without a 'path' attribute MUST fail with HTTP 400 and 'scimType' error code of 'noTarget'.

http

A PATCH request SHALL be treated as atomic regardless of the number of operations: if any single operation fails, the original resource MUST be restored and a failure status returned.

http

A SCIM service provider SHALL indicate supported HTTP authentication schemes via the WWW-Authenticate header, as per Section 4.1 of RFC 7235.

http, security

For immutable attributes in a PUT request, the submitted value(s) MUST match existing values, or HTTP 400 SHOULD be returned with 'scimType' of 'mutability'.

http, json

HTTP PUT MUST NOT be used to create new resources; it is reserved for replacing existing resource attributes.

http

If a creation request conflicts with an existing resource (e.g., duplicate userName), the service provider MUST return HTTP 409 (Conflict) with a 'scimType' error of 'uniqueness'.

http, json

If a service provider determines too many results would be returned (e.g., from a root query), it SHALL reject the request with HTTP 400 and 'scimType' set to 'tooMany'.

http

Implementers MUST support HTTP PUT (RFC 7231 Section 4.3) and SHOULD support HTTP PATCH (RFC 5789) for partial resource modifications; PATCH support is discoverable via service provider configuration.

http

On successful PATCH, the server MUST return 200 OK with the full resource if the 'attributes' query parameter is specified; otherwise it MAY return 200 OK with the resource or 204 No Content.

http

SCIM 'bulkId' values within a bulk request MUST be unique, and 'bulkId' references (using 'bulkId:' prefix) are substituted with the resource URI assigned after creation in circular reference resolution.

http, json

SCIM responses SHALL reflect resource state as interpreted by the service provider; clients SHOULD NOT expect a service provider to return resources with exactly the same schema and values as submitted.

http, json

Service providers MUST decline to filter results if the specified filter operation is not recognized, returning HTTP 400 with 'scimType' of 'invalidFilter'.

http

The Base URI MUST NOT contain a query string, as clients MAY append additional path information and query parameters when forming requests.

http, security

The 'meta.resourceType' attribute SHALL be set by the service provider to match the endpoint (e.g., POST to /Users sets 'resourceType' to 'User').

http, json

The SCIM service provider MUST be able to map the authenticated client to an access control policy in order to determine the client's authorization to retrieve and update SCIM resources.

security, oauth

When a 'count' pagination parameter is specified, the service provider MUST NOT return more results than specified, although it MAY return fewer.

http

When a resource is created successfully, the service SHALL return HTTP 201 (Created) with the URI of the resource in both the Location header and the body's 'meta.location' attribute.

http, json

When using OAuth authorization tokens, implementers MUST take into account the threats and countermeasures related to client authorizations documented in Section 8 of RFC 7521.

oauth, security

SCIM resources contain personal information (name, contact details, organizational data); service providers MUST implement appropriate access controls and SHOULD limit attribute visibility based on the requesting subject's authorization.

privacy, security

Sensitive data such as user identifiers and filter values included in SCIM URIs and query parameters may be logged or cached; service providers SHOULD use HTTP POST-based search (/.search) or TLS to reduce inadvertent disclosure.

privacy, security, http

Bulk operations use HTTP POST to /Bulk and support 'failOnErrors' (integer threshold) and an 'Operations' array; each operation has 'method', 'path', 'bulkId', 'version', and 'data' fields. Bulk responses return per-operation status codes.

http, json

HTTP error responses include a 'scimType' attribute for machine-readable error classification. Defined error types include: invalidFilter, tooMany, uniqueness, mutability, invalidSyntax, invalidPath, noTarget, invalidValue, invalidVers, and sensitive.

http, json

Query responses MUST be identified with URI 'urn:ietf:params:scim:api:messages:2.0:ListResponse' and include: totalResults (required), Resources (required if non-zero), startIndex, and itemsPerPage (both required when paginating).

http, json

SCIM PATCH requests use operations based on JSON Patch (RFC 6902) but without array indexing or 'move' operations. The request body MUST use schema URI 'urn:ietf:params:scim:api:messages:2.0:PatchOp' and include an 'Operations' array with 'add', 'remove', or 'replace' entries.

http, json

SCIM uses JSON payloads with media type 'application/scim+json'. Resources contain a 'schemas' attribute listing schema URIs; protocol messages use schema URNs beginning with 'urn:ietf:params:scim:api:'.

http, json

Service provider configuration is exposed via /ServiceProviderConfig (capabilities), /ResourceTypes (supported resource types), and /Schemas (attribute definitions); all are read-only GET endpoints.

http, json

The /Me endpoint is an alias for operations against the resource mapped to the authenticated subject (e.g., User), supporting GET, POST, PUT, PATCH, and DELETE.

http, security

RFC 7644 registers several SCIM protocol message URNs under the 'urn:ietf:params:scim:api:messages:2.0:' namespace, including ListResponse, SearchRequest, PatchOp, BulkRequest, BulkResponse, and Error.

registry, json

RFC 7644 registers the 'application/scim+json' media type with IANA under the application tree for use as the SCIM JSON content type in HTTP requests and responses.

registry, http, json

Anonymous (unauthenticated) SCIM requests introduce risk; service providers that accept them (e.g., for self-registration) MUST evaluate the risk of exposing resource creation to unauthenticated clients and apply appropriate controls.

security

Bearer tokens and cookies carry authentication state and MUST be protected using TLS to prevent interception; tokens issued based on weak or no authentication SHOULD NOT be used except as single-use tokens for anonymous registration.

security, oauth

SCIM service providers MUST use TLS; Section 7.2 requires TLS support, and bearer tokens SHOULD only be used when combined with TLS and a proper token framework such as OAuth 2.0.

security, oauth

SCIM filters follow a defined ABNF grammar: FILTER = attrExp / logExp / valuePath / *1'not' '(' FILTER ')'; attrExp = (attrPath SP 'pr') / (attrPath SP compareOp SP compValue); compareOp includes eq, ne, co, sw, ew, gt, lt, ge, le.

http, json