You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@directory.apache.org by "ritesh (via GitHub)" <gi...@apache.org> on 2025/04/22 14:58:32 UTC
[I] Persisting data using JPA [directory-scimple]
ritesh opened a new issue, #807:
URL: https://github.com/apache/directory-scimple/issues/807
I have the Spring SCIM example working well with in-memory persistence. This is a newbie question (new to Spring boot/modern Java development). I've read through the documentation and looked around but I'm unsure on the best way to proceed here.
As I understand it, the `ScimUser` is a data transfer object (DTO). When implementing a SCIM service using SCIMple, does the service implementer (aka me) have to create and manage a distinct `@Entity` class that maps attributes back and forth from a `ScimUser/ScimGroup` resource?
What I'm trying to achieve is to be able to store `ScimUsers` in a database, but if I say do this in Spring Boot to create a repository, it does not work since ScimUser is not a managed type.
```
import org.apache.directory.scim.spec.resources.ScimUser;
/////
public interface ScimUserRepository extends JpaRepository<ScimUser, String> {}
```
I can create my own `UserEntity` but that would just hold all the data that `ScimUser` already contains and I'd have to write methods to convert to/from ScimUser for my service to work.
Is that usually the way to do it or is there a better approach?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [I] Persisting data using JPA [directory-scimple]
Posted by "bdemers (via GitHub)" <gi...@apache.org>.
bdemers commented on issue #807:
URL: https://github.com/apache/directory-scimple/issues/807#issuecomment-2825134564
Many apps that use SSO, don't actually need a user store.
A user logs in using OIDC, everything the application needs about the user is available from the IdP (either in the Id token or the user info endpoint). This user doesn't need to be persisted.
That isn't true for all apps. Take Slack for example. New user's get added to Slack before they initially log in. (That new user might have direct messages waiting for them when they sign in for the first time)
For non-SSO applications, (that fall into the first category), it's probably best to look into using something like using a gateway that can mange the OIDC dance for you.
For example:
https://developer.okta.com/blog/2020/01/08/secure-legacy-spring-cloud-gateway
The code in this post is probably a bit dated now, but the pattern that it's using should still work.
And this is really just an updated take on what was done for years using a reverse proxy (nginx, httpd, etc) and a `REMOTE_USER` header.
Hopefully this helps
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [I] Persisting data using JPA [directory-scimple]
Posted by "ritesh (via GitHub)" <gi...@apache.org>.
ritesh commented on issue #807:
URL: https://github.com/apache/directory-scimple/issues/807#issuecomment-2824954111
Thank you for the thoughtful response, @bdemers. It does help!
At this point, I'm using this as a way to learn spring boot and hopefully build a prototype that can auto-provision users in downstream services. I've not really thought about how I would bootstrap my service's user store, since I want to rely entirely on our enterprise SSO as the source of truth for identity data.
We have services that support SSO but don't implement SCIM, this service would have some "magic" glue that receives SCIM updates and auto-provisions/de-provisions permissions. I guess the way I'm thinking about this is that could potentially work as a proxy for non-SSO aware applications if I can get it to speak OIDC/SAML too.
I will give this more thought in terms of the design and what kind of user data we'll need to store. In any case - it's an exciting learning opportunity :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [I] Persisting data using JPA [directory-scimple]
Posted by "ritesh (via GitHub)" <gi...@apache.org>.
ritesh closed issue #807: Persisting data using JPA
URL: https://github.com/apache/directory-scimple/issues/807
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [I] Persisting data using JPA [directory-scimple]
Posted by "bdemers (via GitHub)" <gi...@apache.org>.
bdemers commented on issue #807:
URL: https://github.com/apache/directory-scimple/issues/807#issuecomment-2824681528
Thanks for reaching out @ritesh!
The typical answer is "it-depends".
I will say, often times folks will need to integrate SCIM into an existing user store (a database, LDAP, etc). So you would map the changes pushed to your application via SCIM to your existing store. For example, If you user store has a field for the employee's department id. And your application received a SCIM message that contained an update to the department id, you would update that user's record.
if you don't already have a user store, it might be a little too early to implement SCIM endpoints, and plan out how and why you need to store users in your system.
Does that help?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org