Skip to lesson
Exit
Identity & Access Deep Dive1 / 2

1 min lesson

When SCIM isn't available

Describe the practical point in "Provisioning that's a day late is an inconvenience", then say what it changes.

Step 1 of 2

When SCIM isn't availableown the gap with code

Plenty of apps in a real stack have no SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. support or only support it on a tier the company doesn't pay for. This is where the engineer-not-help-desk mindset shows: you don't shrug and offboard by hand, you write the provisioning yourself.

Idempotent fallback deprovision - webhook-triggered on a leaver event
def deprovision(email: str) -> None:
    for app in NO_SCIM_APPS:
        user = app.find_user(email)
        if user is None:          # already gone -> safe to re-run
            log.info("%s absent in %s", email, app.name)
            continue
        app.deactivate(user.id)   # disable, don't delete
        log.info("deactivated %s in %s", email, app.name)
Deprovisioning is the security-critical half

Provisioning that's a day late is an inconvenience. Deprovisioning that's a day late is a live credential in the hands of someone who no longer works here. Treat offboarding as a same-second event with an audit record and be visibly obsessive about it in the interview - it's the instinct Security wants to hear.

Interview move

When SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. comes up, volunteer the drift problem before they ask: "SCIM handles the happy path, but I'd run a reconciliation job that diffs each app against the IdP, because manual grants and silent webhook failures are how access leaks accumulate." That moves you from configuring a feature to owning a system.