SCIM Connector Platform

Problem

Enterprises using Okta, Entra ID, or Auth0 need reliable automated provisioning to downstream SaaS and internal platforms. Manual provisioning creates stale accounts, audit gaps, and inconsistent access states across systems.

What Was Built

A multi-tenant SCIM v2 connector platform. Customers self-service create tenants and connectors. Each connector receives a unique Bearer token used by the IdP to authenticate SCIM requests. Bearer tokens are hashed with PBKDF2-SHA256 using 600,000 iterations and a random per-token salt. Plaintext tokens are displayed only once and never stored.

Architecture Diagram

Request Flow

• 1IdP sends SCIM request: Authorization: Bearer <token> header
• 2Token Validator computes PBKDF2-SHA256 hash (600k iterations), looks up tenant store — plaintext never stored
• 3Tenant Router directs request to correct tenant namespace
• 4SCIM v2 Handler processes operation (create / update / delete / patch)
• 5Audit event written: actor=connector_id, resource=user|group, action, outcome, timestamp
• 6HTTP 200/201/204 returned to IdP; failures return RFC 7643 / RFC 7644-compliant error body

SCIM Endpoints Implemented

Security Controls

• ▸Bearer token protection: PBKDF2-SHA256 hashing with 600,000 iterations, random per-token salt, display-once plaintext handling, and timing-safe verification.
• ▸Plaintext never stored — display-once at creation
• ▸Tenant isolation: token scoped to exactly one tenant namespace
• ▸Admin MFA enforced on dashboard
• ▸Rate limiting per connector

Operational Controls

• ▸Health check endpoint — liveness probe
• ▸Readiness check endpoint — verifies DB connectivity and downstream dependencies
• ▸Metrics endpoint — Prometheus-compatible counters for provisioned count, error rate, and latency
• ▸Structured JSON audit log per event
• ▸Admin/operator dashboard: tenant list, connector status, recent events

Failure Handling

• ▸Token not found → 401 Unauthorized + failed_auth audit event
• ▸User already exists → 409 Conflict (RFC 7643 / RFC 7644)
• ▸Malformed payload → 400 Bad Request with detail
• ▸Downstream unavailable → 503 with retry guidance
• ▸All failures logged with request ID

Design Trade-offs

• 1.Stateless token validation chosen over session auth for IdP compatibility
• 2.DB-level tenant namespacing rather than separate DB per tenant — cost vs isolation trade-off
• 3.Display-once token pattern prioritises security over operator convenience

Platform Views

⚠Sanitized demo views — production data redacted. Real screenshots will replace these when live deployment is available.

# HELP scim_requests_total Total SCIM requests by tenant and status
# TYPE scim_requests_total counter
scim_requests_total{tenant="[redacted]",method="POST",status="201"} 1423
scim_requests_total{tenant="[redacted]",method="GET",status="200"}  8891
scim_requests_total{tenant="[redacted]",method="PATCH",status="204"} 346
scim_requests_total{tenant="[redacted]",method="POST",status="409"}   12

# HELP scim_request_duration_seconds Request latency histogram
# TYPE scim_request_duration_seconds histogram
scim_request_duration_seconds{quantile="0.5",tenant="[redacted]"}  0.021
scim_request_duration_seconds{quantile="0.99",tenant="[redacted]"} 0.187

# HELP scim_health_status Liveness probe result (1 = healthy)
# TYPE scim_health_status gauge
scim_health_status 1