SCIM to LDAP Mapping via Subtype Attributes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud-based identity management systems face challenges in providing secure access across diverse devices and user types, with inconsistencies in security between on-premise and cloud environments leading to potential security breaches, and existing solutions often require multiple passwords and complex identity federation configurations.
Innovation Solution
A microservices-based architecture for cloud-scale identity and access management (IAM) that maps System for Cross-domain Identity Management (SCIM) resources to Lightweight Directory Access Protocol (LDAP) entries, providing a unified identity platform with single sign-on (SSO) functionality and secure access across hybrid cloud deployments, using an LDAP to SCIM proxy service for seamless integration of legacy and new applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional identity federation configurations are used to integrate legacy and cloud applications, then security can be maintained, but system complexity increases and requires multiple passwords
Solution Approach 1:
The patent introduces an LDAP-to-SCIM gateway as an intermediary component that translates between LDAP protocols used by legacy applications and SCIM protocols used by cloud applications. This gateway acts as a mediator that enables seamless integration without requiring complex identity federation configurations or multiple passwords, thereby maintaining security consistency while reducing system complexity
Solution Approach 2:
The LDAP-to-SCIM gateway provides universal functionality by supporting both LDAP and SCIM protocols through a single unified interface. This multi-functional approach allows the system to handle both legacy and modern applications through one standardized mechanism, eliminating the need for separate identity federation configurations for different application types
2Ease of manufacture
If SCIM resources are mapped to LDAP entries without using attribute subtypes, then mapping simplicity is maintained, but the ability to handle complex multi-valued attributes is limited
Solution Approach 1:
The patent applies local quality by using LDAP attribute subtypes specifically for handling complex multi-valued attributes (CMVAs) where needed, rather than applying a uniform mapping approach. The gateway detects when CMVAs are present and applies subtype-based mapping only in those specific cases, maintaining simple mapping for standard attributes while providing enhanced capability for complex attributes
3Ease of operation
If cloud-based applications are made accessible from diverse devices and user types, then accessibility and usability improve, but security risks increase
Solution Approach 1:
The LDAP-to-SCIM gateway serves as a security intermediary that enables diverse devices and user types to access cloud applications while maintaining security controls. The gateway translates authentication and authorization requests between different protocols, ensuring that security policies are consistently applied regardless of the accessing device or user type, thereby enabling accessibility without proportionally increasing security risks
Data Source
AI summary
A method for mapping SCIM resources to LDAP entries is provided. An LDAP Directory Information Tree (DIT), including a plurality of LDAP DIT entries that describe LDAP containers, users and groups, is provided. Each LDAP DIT entry includes a Distinguished Name and a plurality of LDAP attribute-value pairs, each of which include an attribute name and one or more attribute values. A SCIM directory, including a plurality of SCIM resource entries, is also provided. Each SCIM resource entry includes a plurality of SCIM attributes, each of which includes a name and one or more values. The plurality of SCIM resource entries are converted to corresponding LDAP DIT entries, and, for each SCIM resource entry that has a SCIM CMVA, the SCIM CMVA is mapped to a plurality of LDAP attributes in the corresponding LDAP DIT entry using LDAP attribute subtypes.