4 ms·

SCIM is great, if your expectations are sufficiently low. Mostly for the fact that it’s a de-facto industry standard. Have a large stable of software products t

SCIM is great, if your expectations are sufficiently low. Mostly for the fact that it’s a de-facto industry standard. Have a large stable of software products that your employees use? SCIM lets you provision and, importantly, de-provision users and assign them “groups” (roles) from your centralized Identity Management system. Most IdP’s and software will support SCIM, so it’s just wiring things up. The biggest oversight when SCIM was designed was the expectation of an inbound connection from the provisioning software (e.g. Azure) to the SAAS or similar. This means that in hybrid environments (e.g. most large enterprises), you are having to whitelist umpteen different ip ranges from the Cloud Provider. Some IdP’s have solved this with a local agent you install on-premise to reverse the connection, but Azure is not one of these.

prng2021 2y ago
I thought IPs are trivial for hackers to spoof. Given that and the fact that providers like AWS publicly publish their IP ranges, I don’t understand why IP filtering is so common.
- lll-o-lll 2y ago
  I don’t know, but I think it isn’t trivial to spoof public IP addresses owned by organisations. However, it’s trivial to host something in Azure/AWS, so this whitelist would have to somehow distinguish between “MS/Amazon things” and “MS/Amazon customer things”. Probably that’s possible, but the lists are large and the potential for human error is always there. But this is beside the point. IP whitelisting is problematic for many reasons, and big enterprise sometimes simply refuses to do it. That’s not to say that SCIM is reliant on whitelisting for authentication, it isn’t. However, any modern design of this would have made the connection outbound from the thing being provisioned.
  - woleium 2y ago
    as i understand it, it is trivial to make it look like traffic came from an ip by spoofing the reply address. It is much harder to capture return traffic over the internet. (you have to either compromise every router between you and them, or announce new bgp routes) in this case, as the value is in the reply data it’s not really feasible (unless you are a three letter agency)

prng2021 2y ago

I thought IPs are trivial for hackers to spoof. Given that and the fact that providers like AWS publicly publish their IP ranges, I don’t understand why IP filtering is so common.

lll-o-lll 2y ago
I don’t know, but I think it isn’t trivial to spoof public IP addresses owned by organisations. However, it’s trivial to host something in Azure/AWS, so this whitelist would have to somehow distinguish between “MS/Amazon things” and “MS/Amazon customer things”. Probably that’s possible, but the lists are large and the potential for human error is always there. But this is beside the point. IP whitelisting is problematic for many reasons, and big enterprise sometimes simply refuses to do it. That’s not to say that SCIM is reliant on whitelisting for authentication, it isn’t. However, any modern design of this would have made the connection outbound from the thing being provisioned.
- woleium 2y ago
  as i understand it, it is trivial to make it look like traffic came from an ip by spoofing the reply address. It is much harder to capture return traffic over the internet. (you have to either compromise every router between you and them, or announce new bgp routes) in this case, as the value is in the reply data it’s not really feasible (unless you are a three letter agency)