SCIM best practices

Address data fragmentation

Address data fragmentation deserves its own treatment. Treat anything the other side sends as untrusted input until it has been through validation you wrote. Signature checks, issuer checks, audience checks and expiry checks are four separate decisions, and skipping any one of them is a real vulnerability rather than a theoretical one.

Normalization is the whole job. Two providers can be perfectly compliant and still disagree about what a group membership is, whether a logout is meaningful, and which attribute carries the email address.

Handle inactive users

Consider handle inactive users. Version the assumption, not just the code. Write down what you expect from the peer, and make the failure loud when it stops being true, because the alternative is a connection that half works for six weeks.

Normalization is the whole job. Two providers can be perfectly compliant and still disagree about what a group membership is, whether a logout is meaningful, and which attribute carries the email address.

• Validate signature, issuer, audience and expiry as four separate checks
• Normalize provider attributes into one internal shape
• Fail loudly when a peer stops meeting a documented assumption
• Keep a fixture per provider so regressions surface in CI

Make sure it scales

That brings us to make sure it scales. Normalization is the whole job. Two providers can be perfectly compliant and still disagree about what a group membership is, whether a logout is meaningful, and which attribute carries the email address.

Treat anything the other side sends as untrusted input until it has been through validation you wrote. Signature checks, issuer checks, audience checks and expiry checks are four separate decisions, and skipping any one of them is a real vulnerability rather than a theoretical one.

Handle out-of-sync events

Consider handle out-of-sync events. Version the assumption, not just the code. Write down what you expect from the peer, and make the failure loud when it stops being true, because the alternative is a connection that half works for six weeks.

Version the assumption, not just the code. Write down what you expect from the peer, and make the failure loud when it stops being true, because the alternative is a connection that half works for six weeks.

Treat anything the other side sends as untrusted input until it has been through validation you wrote.

Handle concurrent requests

Consider handle concurrent requests. Version the assumption, not just the code. Write down what you expect from the peer, and make the failure loud when it stops being true, because the alternative is a connection that half works for six weeks.

Normalization is the whole job. Two providers can be perfectly compliant and still disagree about what a group membership is, whether a logout is meaningful, and which attribute carries the email address.

Use TLS 1.2

That brings us to use tls 1.2. Version the assumption, not just the code. Write down what you expect from the peer, and make the failure loud when it stops being true, because the alternative is a connection that half works for six weeks.

Normalization is the whole job. Two providers can be perfectly compliant and still disagree about what a group membership is, whether a logout is meaningful, and which attribute carries the email address.

Secure authentication and authorization

Consider secure authentication and authorization. Treat anything the other side sends as untrusted input until it has been through validation you wrote. Signature checks, issuer checks, audience checks and expiry checks are four separate decisions, and skipping any one of them is a real vulnerability rather than a theoretical one.

Treat anything the other side sends as untrusted input until it has been through validation you wrote. Signature checks, issuer checks, audience checks and expiry checks are four separate decisions, and skipping any one of them is a real vulnerability rather than a theoretical one.

Where this leaves us

None of this is exotic. It is the ordinary discipline of deciding what you own, writing down what you assume, and making the failures loud enough to notice.

If you are working through the same problem and want to compare notes, the docs cover the mechanics and the console shows the behaviour on your own data.