Скачать или смотреть Understanding SCIM Requests in WSO2: Why Creating Users Directly in LDAP Doesn't Work

Explore the reasons why creating users directly in LDAP doesn't trigger SCIM requests in WSO2 Identity Server and learn the best practices for user management to avoid issues.
---
This video is based on the question https://stackoverflow.com/q/64892013/ asked by the user 'Emroy' ( https://stackoverflow.com/u/5756227/ ) and on the answer https://stackoverflow.com/a/64894705/ provided by the user 'Nipun Thathsara' ( https://stackoverflow.com/u/3984101/ ) at 'Stack Overflow' website. Thanks to these great users and Stackexchange community for their contributions.

Visit these links for original content and any more details, such as alternate solutions, latest updates/developments on topic, comments, revision history etc. For example, the original title of the Question was: WSO2 - SCIM request not produced when creating a new object on LDAP

Also, Content (except music) licensed under CC BY-SA https://meta.stackexchange.com/help/l...
The original Question post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license, and the original Answer post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license.

If anything seems off to you, please feel free to write me at vlogize [AT] gmail [DOT] com.
---
Understanding SCIM Requests in WSO2: Why Creating Users Directly in LDAP Doesn't Work

When working with WSO2 Identity Server and LDAP, it’s essential to understand how user creation events are managed, especially when integrating with SCIM (System for Cross-domain Identity Management). Many users have encountered the perplexing issue of SCIM requests not being sent when new users are created directly in the LDAP. In this guide, we will delve into this problem and explore the best practices for managing user identities effectively.

The Problem: SCIM Requests Not Triggered

If you're using WSO2 Identity Server 5.10.0 along with an Open LDAP, you might have noticed that when you create a user via the WSO2 Management Console, everything works seamlessly. A SCIM request is dispatched as expected. However, the confusion arises when new users are created directly within the LDAP – no SCIM request is generated for these users, even though they appear in the WSO2 console.

Key Observations:

SCIM requests are triggered with WSO2 Management Console: Creating users through WSO2 triggers outbound provisioning as designed.

No SCIM requests for LDAP-created users: Directly creating user objects in LDAP does not cause WSO2 to trigger a request to provision those users further.

The Explanation: WSO2’s Awareness of User Events

The reason you're experiencing this behavior is straightforward:

Out of WSO2's Awareness: When users are created directly in the LDAP, WSO2 is not notified of these changes. The outbound provisioning in WSO2 is set up to react to user events that occur within its own ecosystem, which means it waits for changes to be made through its console or APIs.

Expected Behavior:

This is not a bug or misconfiguration; it is a fundamental aspect of how WSO2 operates.

Outbound provisioning is triggered only when WSO2 successfully creates a user.

Best Practices for User Management

Creating users directly in LDAP can lead to various issues, not just limited to lack of SCIM provisioning. For optimal user management, consider the following best practices:

Recommended Approaches:

Manage Users Through WSO2:

Create users using the WSO2 Identity Server, either through the SCIM API or the Management Console. This ensures that provisioning and all associated events are recorded correctly.

Avoid Direct Modifications in LDAP:

Bypassing WSO2 for user creation can lead to caching and data inconsistency issues. Always prefer using WSO2 for managing user identities to maintain coherence across your system.

Delegating Provisioning:

If you must create users directly in LDAP, consider setting up an alternate mechanism to manage those users or coordinate with the system responsible for the direct LDAP modifications to ensure provisioning happens as needed.

Conclusion

In summary, if you're working with WSO2 Identity Server and Open LDAP, it’s crucial to manage user identities exclusively through WSO2 to trigger SCIM provisioning properly. Direct user creation within LDAP may seem convenient but can lead to various issues down the line. By following best practices and adhering to the established user management protocols in WSO2, you can create a more stable and reliable identity management environment.

Remember to always keep WSO2 informed about user creation events to leverage the full potential of outbound provisioning!