SCIM Proxy Identity Synchronization for Faster SaaS Provisioning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing identity management systems across multiple domains are cumbersome, prone to errors, and inefficient, particularly when integrating external parties or remote applications, leading to increased complexity and overhead in user provisioning and access control.
Innovation Solution
A SCIM proxy service that transforms and synchronizes user identity information across multiple identity providers and SaaS applications, enabling centralized management and enforcing access rules based on identity and non-identity criteria, while ensuring compatibility and reducing duplication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the internal organization onboards the external party to their own identity provider, then the internal organization gains control of identity, but it adds overhead in terms of time and cost
Solution Approach 1:
The patent introduces an identity federation service as an intermediary between the internal organization's identity provider and the external party's identity provider. This mediator enables automatic identity verification and federation without requiring manual onboarding steps, thus maintaining identity control while eliminating the time overhead associated with traditional onboarding processes
2Reliability
If the internal organization onboards the external party to their own identity provider, then the internal organization gains control of identity, but it increases cost for additional seat licenses
Solution Approach 1:
The identity federation service acts as a mediator that enables external parties to authenticate using their own identity providers without requiring the internal organization to provision additional seat licenses. The federation service handles the identity verification and translation, allowing controlled access without the cost of additional licenses
3Reliability
If the internal organization federates the identity by connecting their directory service to the external party's service, then both organizations can trust each other, but both organizations must dedicate time integrating their identity providers
Solution Approach 1:
The patent introduces a centralized identity federation service as a mediator between multiple identity providers. Instead of requiring direct integration between each organization's directory services, the federation service handles the trust relationships and identity translation, establishing mutual trust while eliminating the time-consuming direct integration process
Solution Approach 2:
The identity federation service provides universal functionality by supporting multiple identity providers and external parties through a single platform. This multi-functional service handles authentication, authorization, and trust establishment for various organizations without requiring custom integration for each pair, significantly reducing integration time
4Ease of manufacture
If manual provisioning is used for users in applications, then users can be added to applications, but the process is error prone and cumbersome
Solution Approach 1:
The patent implements automated user provisioning where the identity federation service automatically creates user accounts, assigns roles, and configures access rights based on the user's identity information from their identity provider. This self-service automation eliminates manual provisioning errors while maintaining accuracy through systematic, rule-based account creation
5Productivity
If just-in-time provisioning is used, then users are provisioned when needed, but it can lead to too many seats and overprovisioning users
Solution Approach 1:
The identity federation service implements feedback mechanisms that continuously monitor user activity, application usage, and access patterns. Based on this feedback, the system dynamically adjusts user provisioning, deprovisions inactive accounts, and optimizes seat allocation to match actual usage needs, preventing overprovisioning while maintaining necessary access
Data Source
AI summary
A system for cross-domain identity management (SCIM) proxy service is described. A first SCIM endpoint receives, from a first SCIM client, a first message that includes a SCIM resource. The first SCIM endpoint is associated with a customer of the SCIM proxy service. The SCIM proxy service is configured as a first SCIM service provider for the first SCIM client. The first message is validated. The first SCIM proxy service determines that a third-party application is in scope for the SCIM resource, where the SCIM proxy service is configured as a second SCIM client for the third-party application. The SCIM proxy service transmits a second message to a second SCIM endpoint of the third-party application, the second message including the SCIM resource.