Add SCIM support as service provider

Feature
1

As already mentioned here I think it would be a nice feature if Discourse would support the SCIM protocol. SCIM is a standard proposed by the IETF through RFC7644 and RFC7643 which aims to provide solution for user/group management through a simple Rest API. Our use case would be to manage user identities and group memberships via a separate service that acts as a SCIM client, Keycloak in our case. Discourse would act as a SCIM service provider. In addition to any existing SSO and centralized account creation that would have the following advantages:

  • assign users to groups;
  • change user information immediately in several apps;
  • delete the user when they are removed from the SSO;
  • get the list of users or groups in a standard way;
  • …

We received some funding from NGI via NLNet for SCIM implementations, you can read the proposal and about related work in our forum here. I would try to implement a first solution in a Discourse plugin for now, but it would be nice to integrate this into Discourse core at some point. Let me know about any thoughts and opinions!

2 Likes
2

It seems odd that their spec uses /Users and /Groups rather than something like .well-known/scim/Users. It seems assured that it will conflict with existing routes on many applications.

I’d be happy to help out with that if you’ve got some budget to spare.

I can imagine that if it were well-written and widely-used (or required by several enterprise customers) that it might become an offical plugin.

I don’t imagine that it would ever become part of core–even Oauth2 is a plugin.

3 Likes