Geek Answers Handbook

SSO: How do I synchronize user accounts between a service provider and an identity provider?

In a single sign-on environment, although user accounts are supported in IdP, some service providers maintain a database with active user accounts. Now, if the user is disconnected in IdP, what is the best way to pass this information to the appropriate SPs that still have this user as the active user in their database?

After going through the SAML profile documentation, I found a name identifier management profile where IdP can inform the SP about the completion of a specific identifier / user.

Is this the right profile that SP and IDP should implement (is it easy to implement?), Or is there another easy way to achieve this? Any suggestions are welcome.

Thanks,

Abhilash

+8
single-sign-on
source share
2 answers

In most cases, users are created in local databases on the SP side at the moment when the user first logs in through the IDP. And since the user always has to authenticate through the IDP to access the SP, it is safe (from a security point of view) to support users who have been deactivated in the IDP as active on the SP side (since they will not be able to log into the SP anyway).

One approach to providing a clean SP database is to automatically remove or deactivate users who are not logged in for a specific time. Then the user will be recreated or reactivated as soon as he joins the IDP again and tries to access the SP again.

Another approach is to create a custom synchronization process between IDP and SP (for example, dump CSV from IDP and periodically import into SP).

The name identifier management profile with the request "Complete" can be used for this purpose, with a synchronous binding to it only a SOAP call of the web service from IDP to SP. But most SP implementations do not support this profile, and most (if not all) IDPs will require a certain amount of configuration to make the call at the right time.

+8
source share

SAML is not really suitable for this. I would recommend taking a look at a new standard called SCIM (System for Cross-domain Identity Management), which is designed to handle this particular type of use to use a user ID using the RESTful API. Here are some resources to check out -

HTH - Ian

+3
source share

More articles:


All Articles