Dex: Can the SCIM specification be supported for user provisioning?

[treilly1969]

Hi CoreOS team,

Would it be possible to include REST APIs that adhere to the SCIM specification (http://www.simplecloud.info/) for identity provisioning, fronting the persistent Postgres store and in-memory cache.

Thanks

Tommy Reilly

[bcwaldon]

We don't have any plans to support SCIM right now, but we will definitely consider it. OIDC provides enough of what dex needs for the time-being, but if the scope of dex grows into authorization, SCIM may make a lot of sense.

[juanjovazquez]

@bcwaldon you mentioned "if the scope of dex grows into authorization". I thought that authz was definitely considered in the roadmap. Is this still true?.

[bcwaldon]

I have not spent enough time with SCIM to know precisely what it provides beyond what OIDC already gives us. I want to avoid creating a custom authz solution if it can be avoided, so if we were to tackle authz in dex I would want to implement an existing spec. Without that existing spec, I am hesitant to push dex towards a full authz solution.

[juanjovazquez]

Thanks. It's this document that I thought authz was definitely in the roadmap. So, is this document still under consideration?.

[bcwaldon]

@juanjovazquez ah, that was an early attempt at a design doc. We should update it to make it clear it is a potential long-term direction for dex.

[ericchiang]

Authorization is no longer a goal of the dex project.

[juanjovazquez]

For those who are interested in a authZ solution that fits well to Dex might have a look at foulkon. Thanks.