Initial commit - 611 cybersecurity skills across all subdomains

skills/implementing-scim-provisioning-with-okta/references/standards.md

@@ -0,0 +1,60 @@
+# SCIM Provisioning Standards Reference
+
+## Protocol Standards
+
+### RFC 7644 - SCIM Protocol
+- Defines the RESTful API for managing identity resources
+- Specifies HTTP methods, headers, and response formats
+- Mandates JSON as the data interchange format
+- Requires TLS for all communications
+
+### RFC 7643 - SCIM Core Schema
+- Defines User, Group, and EnterpriseUser schemas
+- Specifies attribute types: string, boolean, decimal, integer, dateTime, reference, complex, binary
+- Defines mutability: readOnly, readWrite, immutable, writeOnly
+- Specifies attribute uniqueness: none, server, global
+
+### RFC 7642 - SCIM Definitions, Overview, Concepts, and Requirements
+- Provides context for the SCIM specification
+- Defines terminology and use cases
+- Outlines design requirements for cross-domain provisioning
+
+## Okta SCIM Requirements
+
+### Mandatory Endpoints
+| Endpoint | Methods | Purpose |
+|----------|---------|---------|
+| /Users | GET, POST | User listing and creation |
+| /Users/{id} | GET, PUT, PATCH, DELETE | Individual user operations |
+| /Groups | GET, POST | Group listing and creation |
+| /Groups/{id} | GET, PATCH, DELETE | Individual group operations |
+
+### Required Filter Support
+- `userName eq "value"` - Exact match on userName
+- `id eq "value"` - Exact match on user ID
+- `displayName eq "value"` - Exact match for groups
+
+### Pagination Requirements
+- Support `startIndex` and `count` query parameters
+- Return `totalResults` in ListResponse
+- Default `startIndex` is 1 (1-based indexing)
+- Maximum `count` should be configurable
+
+## Compliance Standards
+
+### SOC 2 Type II
+- Automated provisioning demonstrates access control effectiveness
+- Deprovisioning within defined SLA shows timely access removal
+- Audit logs of SCIM operations provide evidence for access reviews
+
+### ISO 27001 - A.9.2 User Access Management
+- A.9.2.1: User registration and deregistration (automated via SCIM)
+- A.9.2.2: User access provisioning (role-based assignment)
+- A.9.2.5: Review of user access rights (SCIM audit logs)
+- A.9.2.6: Removal of access rights (automated deprovisioning)
+
+### NIST SP 800-53 - AC (Access Control)
+- AC-2: Account Management (automated lifecycle)
+- AC-2(1): Automated System Account Management
+- AC-2(4): Automated Audit Actions
+- AC-6: Least Privilege (role-based provisioning)

skills/implementing-scim-provisioning-with-okta/references/workflows.md

@@ -0,0 +1,96 @@
+# SCIM Provisioning Workflows
+
+## User Provisioning Workflow
+
+```
+1. Admin assigns user to Okta application
+       │
+2. Okta checks if user exists (GET /Users?filter=userName eq "user@domain.com")
+       │
+       ├── User NOT found → Okta sends POST /Users with user attributes
+       │       │
+       │       └── SCIM server creates user → Returns 201 Created
+       │
+       └── User found → Okta sends PUT /Users/{id} to update attributes
+               │
+               └── SCIM server updates user → Returns 200 OK
+```
+
+## User Deprovisioning Workflow
+
+```
+1. Admin unassigns user from Okta application (or user deactivated in Okta)
+       │
+2. Okta sends PATCH /Users/{id}
+       Body: {"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
+              "Operations":[{"op":"replace","value":{"active":false}}]}
+       │
+3. SCIM server deactivates user (sets active=false, revokes sessions)
+       │
+4. Returns 200 OK with updated user object
+```
+
+## Group Push Workflow
+
+```
+1. Admin enables Group Push for Okta group
+       │
+2. Okta sends POST /Groups with group name and initial members
+       │
+3. When group membership changes in Okta:
+       │
+       ├── Member added → PATCH /Groups/{id}
+       │     Op: add, path: members, value: [{value: userId}]
+       │
+       └── Member removed → PATCH /Groups/{id}
+             Op: remove, path: members[value eq "userId"]
+```
+
+## Profile Sync Workflow
+
+```
+1. User profile updated in Okta (e.g., department change)
+       │
+2. Okta sends PUT /Users/{id} or PATCH /Users/{id}
+       Body includes updated attributes
+       │
+3. SCIM server updates user attributes in local database
+       │
+4. Returns 200 OK with full updated user representation
+```
+
+## Error Recovery Workflow
+
+```
+1. SCIM operation fails (network timeout, server error)
+       │
+2. Okta logs failed task in Provisioning > Tasks
+       │
+3. Admin can retry individual failed tasks
+       │
+4. For persistent failures:
+       ├── Check SCIM server logs for error details
+       ├── Verify network connectivity and TLS certificate
+       ├── Validate bearer token has not expired
+       └── Review attribute mapping for data format issues
+```
+
+## Implementation Testing Workflow
+
+```
+1. Deploy SCIM server to staging environment
+       │
+2. Configure Okta SCIM integration with staging URL
+       │
+3. Run Okta SCIM validator test suite
+       │
+4. Test manual operations:
+       ├── Assign test user → verify account created
+       ├── Update user profile → verify attributes synced
+       ├── Unassign user → verify account deactivated
+       └── Push group → verify group and members created
+       │
+5. Review provisioning logs in Okta Admin Console
+       │
+6. Promote to production with production SCIM URL
+```