[jamamp]

Another point: the SCIM schema can be confusing. The RFCs make it seem like you can define your schema however you like, and it provides a default schema with which it bases examples in other parts of the RFC.

In reality, most systems expect you to have the full default schema present without modifications and might complain when items are missing. Do you provide scim support without passwords (only SSO)? Okta will send a password anyway (random and unused). Does your application not differentiate between username and email? IdPs will complain if they can't set them separately. Do you not store the user's `costCenter`? IdPs will get mad and keep trying to set it because it never sticks.

Some of the time, you'll have to store SCIM attributes on your user objects which have no effect on your system at all.

The other side is making custom schema items. SCIM has you present these in the `/Schema` endpoints. But, no system (that I know of) actually looks at your schema to autopopulate items for mapping. Entra and Okta are great at letting your provide mapping from an IdP user to a SCIM user, and then you map SCIM users back to your app's users. But you typically have to follow app documentation to map things properly if it's not using the default schema entirely.

[ucarion]

To really support Entra in particular, you must have to reference Entra's implicit spec, which is roughly documented here:

https://github.com/AzureAD/SCIMReferenceCode/tree/master/Mic...

One way this comes up is that the way those C# objects serialize, there are properties that Microsoft will send you in form `"key": { "value": "xxx" }`, but which they expect that you read back to them of the form `"key": "xxx"`.

It's best to not take the SCIM RFCs too literally.

[brabel]

The RFC is very clear about how extensions are supposed to be registered with IANA, which is always how RFC extensions in general work. You cannot have interoperability without a central registry.

https://datatracker.ietf.org/doc/html/rfc7643#section-10.3

[mooreds]

There's the RFC way and then there's the real way.

IMO, many folks want SCIM with to support only two providers: Azure AD/Entra and Okta.

I guess there's a third: a homegrown system an enterprise has that "supports SCIM". That one is always going to be weird.

So in reality those two vendors get to determine acceptable behavior for SCIM servers (the data stores that push data into SCIM clients like Tesseral).

[brabel]

Completely disagree. I work in the field and in my experience people use lots of SCIM servers, many of which home-grown since it’s not that hard to implement only the bits of the specs you need. And interoperability is quite good, better than with OAuth. The two vendors you mentioned are almost never mentioned by our customers in relation to SCIM.

[jamamp]

You're right. Section 10.4 does make that more clear as well for the default schemas.