You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/app-provisioning/use-scim-to-provision-users-and-groups.md
+16-11Lines changed: 16 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -761,13 +761,13 @@ The open source .NET Core [reference code](https://aka.ms/SCIMReferenceCode) pub
761
761
> [!Note]
762
762
> The reference code is intended to help you get started building your SCIM endpoint and is provided "AS IS." Contributions from the community are welcome to help build and maintain the code.
763
763
764
-
The solution is composed of two projects, Microsoft.SCIM and Microsoft.SCIM.WebHostSample.
764
+
The solution is composed of two projects, _Microsoft.SCIM_ and _Microsoft.SCIM.WebHostSample_.
765
765
766
-
The Microsoft.SCIM project is the library that defines the components of the web service that conforms to the SCIM specification. It declares the interface Microsoft.SCIM.IProvider, requests are translated into calls to the provider’s methods, which would be programmed to operate on an identity store.
766
+
The _Microsoft.SCIM_ project is the library that defines the components of the web service that conforms to the SCIM specification. It declares the interface _Microsoft.SCIM.IProvider_, requests are translated into calls to the provider’s methods, which would be programmed to operate on an identity store.
767
767
768
768

769
769
770
-
The Microsoft.SCIM.WebHostSample project is a Visual Studio ASP.NET Core Web Application, based on the ***Empty*** template. This allows the sample code to be deployed as standalone, hosted in containers or within Internet Information Services. It also implements the Microsoft.SCIM.IProvider interface using in memory classes as the sample identity store.
770
+
The _Microsoft.SCIM.WebHostSample_ project is a Visual Studio ASP.NET Core Web Application, based on the _Empty_ template. This allows the sample code to be deployed as standalone, hosted in containers or within Internet Information Services. It also implements the _Microsoft.SCIM.IProvider_ interface keeping classes in memory as a sample identity store.
771
771
772
772
```csharp
773
773
public class Startup
@@ -787,7 +787,8 @@ The Microsoft.SCIM.WebHostSample project is a Visual Studio ASP.NET Core Web App
787
787
788
788
### Building a custom SCIM endpoint
789
789
790
-
The service must have an HTTP address and server authentication certificate of which the root certification authority is one of the following names:
790
+
The SCIM service must have an HTTP address and server authentication certificate of which the root certification authority is one of the following names:
791
+
791
792
* CNNIC
792
793
* Comodo
793
794
* CyberTrust
@@ -803,14 +804,16 @@ The .NET Core SDK includes an HTTPS development certificate that can be used dur
For more information on HTTPS in ASP.NET Core use the following link: [Enforce HTTPS in ASP.NET Core](https://docs.microsoft.com/en-us/aspnet/core/security/enforcing-ssl?view=aspnetcore-3.1&tabs=visual-studio)
807
+
For more information on HTTPS in ASP.NET Core use the following link:
808
+
[Enforce HTTPS in ASP.NET Core](https://docs.microsoft.com/aspnet/core/security/enforcing-ssl)
807
809
808
810
### Handling endpoint authentication
809
811
810
-
Requests from Azure Active Directory include an OAuth 2.0 bearer token. Any service receiving the request should authenticate the issuer as being Azure Active Directory for the expected Azure Active Directory tenant.
811
-
In the token, the issuer is identified by an iss claim, like "iss":"https://sts.windows.net/cbb1a5ac-f33b-45fa-9bf5-f37db0fed422/". In this example, the base address of the claim value, https://sts.windows.net, identifies Azure Active Directory as the issuer, while the relative address segment, ***cbb1a5ac-f33b-45fa-9bf5-f37db0fed422***, is a unique identifier of the Azure Active Directory tenant for which the token was issued.
812
+
Requests from Azure Active Directory include an OAuth 2.0 bearer token. Any service receiving the request should authenticate the issuer as being Azure Active Directory for the expected Azure Active Directory tenant.
813
+
814
+
In the token, the issuer is identified by an iss claim, like `"iss":"https://sts.windows.net/cbb1a5ac-f33b-45fa-9bf5-f37db0fed422/"`. In this example, the base address of the claim value, `https://sts.windows.net`, identifies Azure Active Directory as the issuer, while the relative address segment, _cbb1a5ac-f33b-45fa-9bf5-f37db0fed422_, is a unique identifier of the Azure Active Directory tenant for which the token was issued.
812
815
813
-
The audience for the token will be the application template ID for the application in the gallery, each of the applications registered in a single tenant may receive the same `iss` claim with SCIM requests. The application template ID for each application in the gallery varies, please contact [email protected] for questions around the application template ID for a gallery application. The application template ID for all custom apps is ***8adf8e6e-67b2-4cf2-a259-e3dc5476c621***.
816
+
The audience for the token will be the application template ID for the application in the gallery, each of the applications registered in a single tenant may receive the same `iss` claim with SCIM requests. The application template ID for each application in the gallery varies, please contact [[email protected]](mailto:[email protected]) for questions around the application template ID for a gallery application. The application template ID for all custom apps is _8adf8e6e-67b2-4cf2-a259-e3dc5476c621_.
814
817
815
818
In the sample code, requests are authenticated using the Microsoft.AspNetCore.Authentication.JwtBearer package. The following code enforces that requests to any of the service’s endpoints are authenticated using the bearer token issued by Azure Active Directory for a specified tenant:
816
819
@@ -850,8 +853,9 @@ In the sample code, requests are authenticated using the Microsoft.AspNetCore.Au
850
853
851
854
A bearer token is also required to use of the provided [postman tests](https://github.com/AzureAD/SCIMReferenceCode/wiki/Test-Your-SCIM-Endpoint) and perform local debugging using localhost. The sample code uses ASP.NET Core environments to change the authentication options during development stage and enable the use a self-signed token.
852
855
853
-
For more information on multiple environments in ASP.NET Core use the following link: [Use multiple environments in ASP.NET Core](
0 commit comments