| name | scim-provisioning-security |
| description | Authorized assessment and hardening of SCIM 2.0 user/group provisioning: token auth, endpoint exposure, filter/PATCH abuse, privilege via attributes, deprovisioning gaps, and cross-tenant isolation. Use when SCIM, /Users, /Groups, ServiceProviderConfig, bulk provisioning, IdP-to-app sync, or automated account lifecycle appears in scope for owned or authorized apps.
|
SCIM Provisioning Security
Methodology for SCIM 2.0 (RFC 7643/7644) provisioning APIs that IdPs use to
create, update, disable, and delete users and groups in a service provider (SP).
Focus: trust boundary, authZ, attribute safety, and lifecycle.
Scope And Authorization
- Authorized only: owned apps, labs, CTFs, or written scope naming the SCIM
base URL, tenant, and IdP connector you may exercise.
- Prefer staging and disposable canary users. No mass-create/delete or
production workforce corruption outside approved change windows.
- Treat SCIM bearer tokens, Basic credentials, client secrets, and full
User/Group payloads as secrets — redact in tickets and reports.
- Do not use discovered tokens against third-party SaaS tenants you do not
own. Cross-tenant probes need explicit multi-tenant scope.
- Destructive tests (DELETE, hard wipe, Bulk) need prior approval; prefer
active:false and reversible PATCH on canaries.
- Assessment and defensive design only — not persistent backdoors or shadow admins.
When To Use
| Situation | Direction |
|---|
App exposes SCIM /Users, /Groups, /Schemas, /ServiceProviderConfig, /Bulk | This skill |
| IdP auto-provisions accounts into the app | This skill |
| Orphan accounts, delayed deprovision, or role-sync bugs | This skill |
| SCIM token weak, leaked, or SCIM base missing auth | This skill |
| SAML/OIDC login only (no provisioning API) | saml-sso-basics / oauth-oidc-misconfiguration |
| End-user object access (not IdP SCIM principal) | idor-broken-object-authorization |
| ATO where SCIM is one path | account-takeover-methodology + this skill |
| Token vault/rotation only | secrets-management-hygiene |
Keywords: SCIM 2.0, externalId, userName, active, PATCH, filter, Bulk, provisioning token, deprovision, IdP sync.
Workflow
1. Map the surface
- Find base URL (
/scim/v2, /api/scim/v2) via docs, IdP connector, or api-recon-and-docs.
- GET
ServiceProviderConfig, Schemas, ResourceTypes — note patch, filter, bulk, auth schemes.
- Record auth (Bearer, OAuth client credentials, Basic, mTLS) and tenant routing (path/host/token).
- List which IdP attributes map to roles/groups/custom extensions.
2. Authentication and transport
| Check | Secure expectation | Probe (authorized) |
|---|
| Auth required | All routes 401/403 without creds | Strip Authorization on GET/POST/PATCH/DELETE |
| Token strength | High entropy; not in JS/mobile/public git | Search assets and configs for leaked tokens |
| Scope | One tenant + SCIM only | Reuse token on other tenants if multi-tenant in scope |
| TLS | HTTPS only | Confirm no cleartext SCIM |
| Rotation | Revoke path works | Old token fails after rotate |
| Audit | Writes attributed to connector | Create canary; verify audit entry |
Findings: unauthenticated SCIM, global multi-tenant token, client-exposed secret, or public SCIM when policy requires private access.
3. Authorization and isolation
- Token for tenant A must not read/write tenant B (cross-tenant IDOR).
- Predictable
/Users/{id} must not leak other customers under a mis-scoped token.
- End-user sessions must not reach SCIM admin APIs.
- Group membership changes must stay inside tenant and mapped roles.
Hand residual end-user BOLA to idor-broken-object-authorization.
4. Create / PUT / PATCH attribute safety
On canaries only:
| Risk | Test idea | Secure behavior |
|---|
| Privilege attrs | Set roles, admin, entitlements, custom flags | Allowlisted IdP mapping; server-side authZ |
| Schema extensions | Unexpected urn:... attrs | Ignore/reject; no silent superuser |
| userName / externalId clash | Victim identifiers on create | Unique constraints; no silent merge ATO |
| Email linking | Provision email of existing local user | Explicit link policy |
| Immutable fields | Mutate id / externalId | Reject |
| PATCH ops | add/replace/remove on members, active, nested paths | No illegal privilege strip/add |
5. Filter, list, deprovision, bulk
- List/filter: pagination; PII minimization; multi-tenant filters return empty/403; rate limits on full directory dump.
- Filter input: quotes/parens/
or as validation tests only — document errors vs leaks; no out-of-scope DB attacks.
- Deprovision:
active:false and (if approved) DELETE must block app login and revoke sessions/refresh tokens/PATs within SLA; group removal drops privileges; rehire same externalId has no leftover admin.
- Bulk: auth on
/Bulk; partial failure behavior; no cross-tenant side effects.
- Errors: no stack traces, other-tenant ids, or secrets in bodies.
- Idempotency: repeated POST same
externalId must not fork divergent privileges.
6. Remediation (report-ready)
- Tenant-scoped, rotatable SCIM credentials in vault (
secrets-management-hygiene); mTLS or short-lived OAuth when available.
- Network-restrict SCIM (private link / IdP egress allowlist) when feasible.
- Allowlist provisioned attributes; explicit group→role maps; no free-form admin from optional schemas.
- Unique
userName/externalId; documented account-link rules for matching emails.
- Deprovision = disable plus revoke sessions/tokens; audit every SCIM write.
- Paginate/rate-limit list/filter; minimize PII in responses.
- Maintained SCIM libraries +
code-quality-standards for auth middleware.
Routing
| Need | Skill |
|---|
| SCIM auth, attrs, deprovision, filter/bulk | This skill |
| SAML SSO assertion/ACS | saml-sso-basics |
| OAuth/OIDC interactive login | oauth-oidc-misconfiguration |
| App user JWTs after provision | api-auth-and-jwt-abuse |
| End-user object IDOR | idor-broken-object-authorization |
| API discovery | api-recon-and-docs |
| SCIM token storage/rotation | secrets-management-hygiene |
| ATO chaining incl. rogue provision | account-takeover-methodology |
| Implementation baseline | code-quality-standards |
Output Checklist
