SCIM vs SAML

Both SCIM (System for Cross-domain Identity Management) and SAML (Security Assertion Markup Language) are useful protocols in the identity management ecosystem. SCIM and SAML share the common goals of enhancing security and streamlining the management of user access and privileges. However, the protocols differ in their applications. SCIM is primarily focused on managing and governing user identity information across different systems, whereas SAML is designed to facilitate authentication and single sign-on (SSO) across various domains. Together, they create a secure and efficient online identity management system that enforces least privileged access rights.

What is SCIM?

SCIM is an open-standard specification developed to streamline the management of user identity information. SCIM is a schema for representing users and groups and simplifying user provisioning and management. SCIM also provides a RESTful API to automate CRUD (create, read, update, and delete) operations for user and group resources. SCIM is designed to automate and sync the exchange of user identity data between an enterprise's cloud applications and providers, such as enterprise SaaS apps. SCIM helps provide users with a unified experience across all SCIM-supported apps.

What is SAML?

SAML — also an open standard — is an XML-based authentication protocol that handles cross-domain sign-in. The SAML protocol handles the exchange of digitally signed and encrypted attributes that make up user identities. Identity attributes are exchanged as a SAML XML document and are contained within an assertion. Attributes are identity information, such as email address, name, mailing address, and so on. Service providers request these attributes to allow access to a service and its resources. SAML supports single sign-on (SSO), allowing users to sign into multiple applications using a single set of login credentials.

Are SCIM and SAML complementary?

SCIM and SAML can be used as complementary protocols to achieve holistic identity and access management (IAM): SAML authenticates users, and SCIM provides user provisioning and deprovisioning. They work together to complement each other in an identity and access management system. Whereas SAML authenticates users, SCIM ensures that those users are current employees and that their privileges properly reflect their roles and departments.

What is user provisioning and deprovisioning?

User accounts within a system can be created, updated, and deleted. This process is known as provisioning. When provisioning events happen, they must be synced across multiple applications and systems. Often, account provisioning impacts user entitlements and group memberships. Auto-provisioning involves automating the provisioning and deprovisioning process. However, provisioning may also be performed manually. Ideally, provisioning and deprovisioning should be automated to ensure employee authentication and privileges are quickly and accurately reflected in the workplace.

Benefits of automated provisioning and deprovisioning:

1. Employee onboarding and offboarding: quickly assign or revoke user accounts and access rights based on roles.

2. User management across applications and services: automated provisioning streamlines user management.

3. Security: automation of provisioning ensures that least privilege access is enforced and eliminates zombie accounts by offboarding departing employees.

Demystifying User Provisioning: A Complete Guide

What’s the difference between SAML auto-provisioning and SCIM auto-provisioning

SAML can be configured to handle auto-provisioning. The SAML service can be used to retrieve information for users or groups from a SAML response; this information is then added to the identity database. This process is also used to update a user's group membership. SAML user deprovisioning is typically manual.

SCIM, on the other hand, is designed to fully automate user account provisioning and deprovisioning. This automation streamlines the onboarding of employees and non-employees, vastly improving security.

Some challenges of SCIM and SAML

SSO tax

Single sign-on (SSO) is a practice that makes employee access across multiple apps and domains seamless. SSO improves security and productivity and is beneficial to companies of all sizes. SSO tax is a term used to describe a practice whereby SaaS vendors charge companies more to access SSO capabilities. Likewise, vendors offering identity management tools often provide SSO only in higher-tier, much more expensive versions of their products. This “tax” especially burdens smaller organizations that require SSO.

SCIM is also subject to the same unfair tax, as its capabilities are often available only in higher-tier versions and require SSO to work. The result is that some smaller organizations pay two to four times the base product price for access to an "enterprise plan" simply to use SCIM and SAML SSO.

 Read Your Guide to the SSO Tax

Implementation challenges

SAML SSO and SLO (single-log-out) can be complex to implement and require specialized knowledge to optimize the use of the protocol. SAML is not compatible with all services or applications and was not designed for mobile apps. 

SCIM also has implementation challenges, despite being a standard. This is due to providers varying in their interpretation and implementation of the protocol. This can cause interoperability issues between applications, varying interpretations of data, or data duplication.

 Read more on the pros and cons of SCIM.

How SCIM and SAML address security

SCIM and SAML are complementary when it comes to security, as they address different aspects of securing data.

SCIM

SCIM handles secure user management through the automation of user provisioning and deprovisioning. By automatically changing a user's profiles and privileges to reflect status changes, SCIM ensures data is protected and least privilege access is enforced. For example, if an employee leaves a company, SCIM is used to auto-deprovision that user so they no longer have rights to access apps and data. SCIM is also important for access governance.

SAML

SAML manages user authentication (and sometimes authorization). SAML allows access to an application only if the user correctly authenticates themselves. SAML also handles SSO, allowing a user to securely access multiple applications once they enter a single set of credentials.

Using SCIM and SAML together

Companies that need to ensure that access control is enforced and least privileged access rights are applied may want to implement both SCIM and SAML. However, a smaller organization may choose to initially implement SAML SSO to optimize productivity and secure access. 

 SAML, however, often requires manually managing user permissions and offboarding/deleting user accounts as employees leave or move to different departments. Later, the addition of SCIM provisioning provides full automation and visibility of everyone's access and permissions.

SCIM alternatives

AccessOwl is an alternative to SCIM implementation for user account provisioning and deprovisioning. It facilitates provisioning/deprovisioning for several hundred applications.

AccessOwl also handles CRUD requests — access requests and approvals for SaaS apps — using the Slack interface. AccessOwl is API agnostic; SaaS apps can easily be added as needed. It also integrates with IdPs such as Google Workspace, Microsoft 365, and Okta.

AccessOwl is accessible to non-enterprise organizations that use a wide variety of SaaS applications. It’s also useful for larger enterprises that rely on SCIM, but struggle with large numbers of applications that don't support SCIM.

How does SCIM and SAML help with SOC2/ ISO27001 compliance?

ISO27001 is an internationally recognized information security standard, and SOC2 is a framework that guides companies in implementing a robust security posture. SCIM and SAML help enhance IAM, optimize authentication, and enforce user-privileged access rights. In providing these capabilities, SCIM and SAML help companies comply with SOC2 and ISO27001. 

 Here are a few examples where SCIM and SAML help with SOC2 and ISO27001 compliance:

• ISO27001 identity and access management (IAM) is a critical function of ISO27001. SCIM ensures the confidentiality and privacy of sensitive data by enforcing least privileged access.

• SCIM helps with auditability and visibility, providing evidence of compliance with access to sensitive data. 

• ISO27001 requires that only authorized personnel can access sensitive information. SAML enforces access controls using robust authentication and authorization.

• SOC2 requires that data and systems be protected against unauthorized access. SAML enforces robust authentication to ensure access is authorized. SCIM provisioning ensures that the right people access the right data from the right device.

Top 5 Access Controls for Obtaining and Retaining SOC 2 and ISO 27001 Certifications