auditing-scim-provisioning-trust

Auditing SCIM provisioning trust: the provisioning token creates admins, so guard it like one

SCIM lets an identity provider create, update, and delete accounts in a service provider automatically, and that means the SCIM endpoint is an account-and-group factory reachable over the network. Whoever can call it with a valid credential can mint users, add them to privileged groups, and change who an existing account belongs to, so the provisioning credential is effectively an admin credential and the trust in the calling identity provider is the whole boundary. The failures follow. A provisioning endpoint authenticated by a weak, shared, or never-expiring bearer token hands account creation to anyone who obtains it. A handler that does not scope requests to the calling tenant lets one customer's provisioning client touch another customer's users. A group or role pushed over SCIM that maps to more privilege than the source attribute warrants is a quiet escalation. A deprovisioning event that does not actually disable the account leaves a departed user with standing access. And attribute updates, email, external id, an admin flag, trusted without validation let an attacker reassign or elevate an account. The audit treats the SCIM endpoint as privileged, checks its authentication and tenant scoping, and follows each lifecycle event to what it actually grants or revokes. You audit this by calling the SCIM API as the identity provider would and as an attacker who stole its token would.

When to use

• An identity provider provisions accounts and groups into a service provider over SCIM 2.0 (create, update, deactivate, delete).
• The SCIM endpoint may be authenticated by a shared, weak, or long-lived bearer token.
• Provisioning may not be scoped per tenant, deprovisioning may not revoke access, or attribute mappings may over-grant.

Scope check

Test SCIM provisioning only against services and directories you own or are authorized to assess, on non-production tenants. Creating, modifying, and deleting accounts over SCIM changes real identity state, so use test tenants and never provision, elevate, or delete accounts that are not yours. If you can't name the authorization, stop.