Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Isn’t this also what federation is for? And managing those „relationships“ on only one domain. I struggle to see what SCIM brings additionally?


It matters if 1) you have long-lived sessions on the application (RP) or 2) the application (RP) does something on behalf of the users and you need to stop that.

For example, say I leave the company. My account in SSO (IdP) gets deactivated, so I can no longer use SSO to log in to the company GitLab. However, without some way to let GitLab know that I'm gone, I might still be able to access repos with my SSH keys or access tokens, and scheduled jobs in my account will still run. Deprovisioning not only lets GitLab know I won't be logging in through SSO again, but also that it should stop the scheduled jobs in my account, and block other access methods.

You're right that depending on what your application does, you might not need it at all.


The main benefit IMHO is deprovisioning.

With straight up fed you can autocreate users etc but as the relying party you don't know when their access has been revoked. Sometimes this doesn't matter, but... often it does. People come and go all the time in enterprise. You can more accurately show user state in your UI and (crucially) accurately adjust license seats. You can also de-activate API tokens or alternative auth methods the user might have configured to close the loop on security.

Big orgs will pay more for SCIM to avoid having to do user access reviews in the UIs of individual products they have bought. It directly translates to person-hours of busywork and admin burden of executing / tracking that work.

SCIM is much cleaner.


Deprovisioning is huge. Provisioning is also awfully nice. For example:

1. New employee joins the team.

2. SCIM creates their account in the ticket tracking system.

3. Employee's boss can create onboarding tickets and assign them to the new person before they've even logged into the system.

That's not such a big deal for small companies that don't use a gazillion services. It's huge for large companies with hundreds of vendors where you want everyone in an employee group ("engineering", "sales", "everyone") to have an account in some of those services.


I wrote an article about this for my employer[0]. There's also a nice list of use cases in the RFC[1], including (text in parens mine):

* Migration of the Identities

* Single Sign-On (SSO) Service (allowing provisioning instead of JIT)

* Provisioning of the User Accounts for a Community of Interest (with complex infra)

* Transfer of Attributes to a Relying Party's Website (so profile data)

* Change Notification (of profile data and access)

0: https://fusionauth.io/articles/identity-basics/what-is-scim

1: https://datatracker.ietf.org/doc/html/rfc7642#section-3




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: