Lion Cipher Lab
Build a SCIM 2.0 provisioning endpoint from scratch (the deprovision plane)
- Identity & Access Management
- Advanced
- ~80 min
- Free · no account required
Why it matters
The single most dangerous account in any breach report is the one that should not exist any more: the contractor who rolled off in March, the engineer who was let go on Friday but whose VPN and SaaS logins still worked on Monday. Orphaned accounts are the classic foothold — no owner watching them, no laptop that got wiped, often no MFA re-enrollment, and full access to whatever they had on their last day. The fix is not a better quarterly access review; it is AUTOMATED PROVISIONING, and the open standard the whole industry uses for it is SCIM (System for Cross-domain Identity Management).…
What you'll learn
- SCIM 2.0 service-provider endpoints (RFC 7643 schema + RFC 7644 protocol)
- the User resource: schemas / id / meta and the userName filter
- PATCH PatchOp deprovisioning (active=false) — the leaver control that matters
- the SCIM error response shape and correct 201/200/404/409 status codes
- bearer-token auth for an IdP integration and why that token is a skeleton key
- judgment: SCIM push-provisioning vs. JIT, soft-disable vs. hard delete
Steps in this lab
- What SCIM is, and who is calling whom
- The User resource — RFC 7643's required shape
- Set up the project and install Express
- Write the SCIM server — schemas, errors, and bearer auth
- Start the server
- Prove auth first — the endpoint is a directory, guard it
- Create a user (the joiner) — POST returns 201 + Location
- Read and FILTER — how the IdP looks a user up
- The security heart — PATCH active=false to DEPROVISION the leaver
- DELETE — and why you usually should NOT
- The judgment layer — SCIM vs. JIT, PATCH vs. PUT, and idempotency
- What you built — and the reflex to keep