Challenges with SCIM delete implementation with Just in Time

Questions SCIM
1

Hi Okta team ,

We have a federation set up with our customer Okta Idps and have enabled provisioning of users through Just in time. We are in process of enabling only deprovisioning through SCIM. However we are observing following issue with Just in Time and SCIM delete

This outlines the issue for users who exist in customer Azure IdP but not in our Auth server before SCIM is enabled.

  1. Upon enabling SCIM in the customer’s Okta IdP it sends a GET request for each existing user to check for them in our Auth server.
  2. For the the users that have not yet been provisioned in our Auth server through JIT, our SCIM service returns a response as per the SCIM standard.
  3. Later this user logs in and has it profile created in our Auth server through Just in Time
  4. Consequently, when the user is deleted from customer Okta IdP, SCIM deactivation events are not sent.
  5. Users shadow account in our Auth server continues to exist even after user in removed from customer Idp

Ongoing Issue with New Users

This outlines the issue for users added after SCIM is enabled.

  1. When a new user is assigned to the SAML application in customer Okta idp, the customer’s Okta IdP sends a GET request to our system to fetch the user’s profile.
  2. Our application returns a response as per the SCIM standard.
  3. When the new user logs-in his shadow account gets created in our Auth server by Just in Time
  4. When the user is deleted from customer Okta IdP, it does not trigger the SCIM deactivation event.
  5. Users shadow account in our Auth server continues to exist even after user in removed from customer Idp

Can you help understand how to resolve this issue ?

2

HI, Can you help with the above query. Thanks

3

HI, Can you help us with your recommendation

4

We are in process of enabling only deprovisioning through SCIM.

In order for Okta to be able to deprovision users via SCIM, they must first be provisioned via SCIM.

Do you ever see any GETs or POSTs to your SCIM server’s User endpoint to look for this users?

5

Yes, does that mean we have to implement the entire SCIM functionality in one shot. Their is no way to break down SCIM development into different functionalities

6

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.