osiam / scim-schema

[DEPRECATED] The scim schema as used by OSIAM

OSIAM - Open Source Identity and Access Management

Active development of this project has stopped.

OSIAM is a secure identity management solution providing REST based services for authentication and authorization. We achieve this by implementing two important open standards:

• OAuth 2.0
• SCIM 2.0

OSIAM is published under the MIT licence, giving you the greatest freedom possible to utilize OSIAM in you project or product. Watch our blog to stay informed about releases and upcoming changes.

Use cases

• Single app with OSIAM as free backing store for users and groups and local auth service.
• Distributed app with OSIAM as central identity store and auth service.
• Publish your app's API with OSIAM as auth service for 3rd-parties and allow safe access to your user's data.

Quick Start

Download the latest version of OSIAM:

curl -L https://dl.bintray.com/osiam/downloads/osiam/3.0/osiam-3.0.war -o osiam.war

Make the .war file executable:

chmod +x osiam.war

Start OSIAM:

./osiam.war

After some seconds, OSIAM should be fully running. You can now retrieve your first access token:

curl -H "Authorization: Basic ZXhhbXBsZS1jbGllbnQ6c2VjcmV0" -X POST -d "grant_type=client_credentials&scope=ADMIN" http://localhost:8080/oauth/token

You can now start to setup OSIAM, by changing the administrator's password and add your own OAuth client. Please see the Installation and Configuration Manual for details.

Documentation

Learn how to install and configure OSIAM for production in the documentation.

Components

• osiam handles the authentication and authorization based on OAuth 2.0 and holds the SCIM based user data
• addon-self-administration provides account management self-service as a web application
• addon-administration lets you administer users and groups via a web application

Easy customization

Every visual aspect of OSIAM's components can be easily customized by supplying your own templates, stylesheets and scripts to make OSIAM integrate seamlessly with your application. Read the customization guide to learn more.

Snapshots

To use the latest snapshot of OSIAM just download it from JFrog OSS: https://oss.jfrog.org/repo/org/osiam/osiam/latest-SNAPSHOT/

Scroll down to the bottom of the page and select the latest WAR file.

Issue Tracker

Please report issues, bugs and feature requests via [the issue tracker] (https://github.com/osiam/osiam/issues).

Get involved

Help is very appreciated. Please read the contributors guide to learn how to get started.

scim-schema's Issues

Most classes are not really immutable

AFAIK all SCIM-based objects should be immutable, but that's not the case. For instance, we're directly returning the backing collections for all multi-valued attributes and when setting collections via the builders, they're not copied, but used as-is. We should always return unmodifiable views of collections and make defensive copies of collection arguments fed into the builders.

new Name.Builder(name);

Hello,

it is not possible to easy change a single attribute of a Name Object.
For this is would be great if we could create a constructor that takes a Name Objects and copys the values of the old user to the new one. After this the Developer can change the single attribute bei using the setter.

Technical name for groups

At the moment the scim_group stores only "displayName". In our project we have a need for a technical name. So is it possible to add a new (optional) property "name" for each scim_group?

Remove meta package

We should get rid of org.osiam.resources.scim.meta as well as org.osiam.resources.scim.Group_, org.osiam.resources.scim.Resource_ and org.osiam.resources.scim.User_ the attempt to provide a type safe query api can surely be considered as failed. There also doesn't seem to be a demand for it and the additional classes in the scim schema are only confusing.

Re-activate JSON tests

We had to disable all tests that proof the correctness of the generated JSON, because of licensing problems with JSONAssert. The tests must be enabled again now, due to upcoming development in this project.

Migrate from wiki to markdown documentation

Extensions for groups

In our project we need to add some attributes to a scim_group. So i think we need extensions for a group.

See [https://github.com//issues/130]

User.Builder: after setExternalId() no User Attributes possible

If you want to create a User with the User.Builder you haveto watch for a order,

Because setExternalId() is not part of the User.Builder but of CoreResource.Builder you can't set any User attributes after calling setExternalId(). Same goes for Group

Example
possible
setNickName("nick").setExternalId("external").build
not possible
setExternalId("external").setNickName("nick").build

Deploy to Bintray snapshots with CircleCI

Using setSchema in Builder overwrites scim core schema

Moved from Jira:

When using Resource.Builder.setSchema() the scim core schema gets overwritten unless you specify it explicitly in the parameter Set

Email validation does not allow upper-cased TLD

If I try to create an Email object with an upper-cased top level domain, e.g. [email protected], the builder throws an exception, telling me that the email address is invalid.

Steps to reproduce

Create a new Email object via the builder:

Email email = new Email.Builder().setValue("[email protected]").build();

Expected result

A new Email object with the given email address as value

Actual result

A SCIMDataValidationException will be thrown.

org.osiam.resources.exception.SCIMDataValidationException: The value '[email protected]' is not a well-formed email.
    at org.osiam.resources.scim.Email$Builder.setValue(Email.java:179)
    ...

Remove org.osiam.resources.scim.Constants

It's not very smart to have a single pool of constants. We should remove the class and move the definitions to the respective classes.

Update urn schema URIs

The used URIs in this repo are not up to date with the specification defined URIs. This is just one task of the obvious todo of the adjustment to the scim specfication.

Resources should be Serializable

Just played a bit with the osiam docker image.

After a restart of the tomcat server I see some exceptions in the log indicating that scim Users or Resources in general cannot be serialized which makes tomcat bark when it tries to serialize HttpSession contents.

I'd suggest that you make Resources serializable to avoid such problems.

SEVERE: IOException while loading persisted sessions: java.io.WriteAbortedException: writing aborted; java.io.NotSerializableException: org.osiam.resources.scim.User
java.io.WriteAbortedException: writing aborted; java.io.NotSerializableException: org.osiam.resources.scim.User

Add a Jackson Module for use by clients

Because deserialization of Users requires a custom deserializer, one has to register a Jackson module on their ObjectMapper that contains the deserializer. Currently, the scim-schema only provides the deserializer but no Jackson module. I think we should provide a module so that people can set up their ObjectMapper more easily.