obacht
Menu

obacht is in early development and not ready for families yet. Follow along on GitHub

Accounts from your login provider (SCIM)

When parents log in to obacht through a login provider (see Running obacht at home), children can have an account there too and log in to obacht with it (see A login for your child). Usually a parent then gives the child a login in obacht and creates the account at the provider with the same username. With SCIM the provider, or an account portal in front of it, does both: it creates the child's account and tells obacht, and the child can log in.

It can do the same for parents: it creates a parent in obacht when someone joins the parent group, and removes them when they leave. Removing a parent this way ends their sessions and API tokens at once, without waiting for their next login.

SCIM (System for Cross-domain Identity Management, RFC 7643 and RFC 7644) is the standard way identity systems provision accounts into apps. Microsoft Entra ID, Okta, authentik and others speak it.

What it does

  • An account is a parent or a child's login. SCIM's userType says which: parent, or child (the default, so a provider that only sends children's accounts needs not set it).
  • A parent has no password in obacht and logs in through the provider; they still have to be in the parent group there. A parent obacht already has with the same username (any case) is taken over. Deleting a parent's account removes the parent, their sessions and their API tokens; the children and their rules stay.
  • An account is a child's login, not the child. Children without an account are added in obacht as always; an account is optional.
  • A new account finds its child. obacht gives it to the child with no login yet whose name is the account's first name. If a parent already gave a child a login with this username in obacht, the account takes that login over. Otherwise obacht adds a new child with the account's first name and age-appropriate starter rules (10 to 13 years) that parents then adjust.
  • Removing an account removes the login. The child stays, with their rules, devices and history; a parent removes the child in obacht if that is wanted. So when a child grows up, the provider can remove the child's account here and keep the person's account as a parent's (in the parent group).
  • Nothing about the child goes back. obacht answers with the login's id, its username, the provider's id for it and the child's id: no names, rules or usage.
  • Only logins through the provider. Provisioned logins have no password in obacht, so SCIM needs a login provider.
  • The provider decides. While SCIM is on, parents see each child's login in obacht but create, rename and remove logins at the provider (or its account portal), not in obacht, so the two never disagree. Logins parents made in obacht before stay until the provider takes them over or removes them.

Turning it on

Choose a long random token (at least 32 characters) and give it to obacht and to the provider.

services.obacht.scim.tokenFile = "/run/secrets/obacht-scim"; # outside the Nix store

Helm: scim.existingSecret (and scim.secretKey). Elsewhere: OBACHT_SCIM_TOKEN, or OBACHT_SCIM_TOKEN_FILE for a file with it.

At the provider, add obacht as a SCIM app:

  • Base address: https://obacht.example.org/scim/v2
  • Authentication: bearer token, the token above
  • Users only, no groups. Provision the children's accounts, and the parents' too if you like, with userType set to parent (Keycloak, Entra and others can map a group to it).
  • userName is what the child logs in with at the provider (the same username obacht's login through the provider sees); name.givenName is the child's first name.

userType can't change: to turn a grown-up child's login into a parent, delete it and create the account again as a parent.

obacht supports creating, reading, finding (filter=userName eq "..." or externalId eq "..."), replacing (PUT, for a new username) and deleting users. It doesn't support PATCH, groups or bulk requests, and it refuses to make an account inactive: delete it instead.

To give a login to one particular child, a provisioning tool can name them in obacht's extension, urn:ietf:params:scim:schemas:extension:obacht:2.0:User with childId; it can also choose the starter rules for a new child there (ageGroup: under10, from10_to13 or from14_to17, and timeZone).

The API reference lists the endpoints under "scim" (/api/v1/openapi.json).

This page is part of obacht's documentation, licensed under CC BY 4.0. Source on GitHub · CC BY 4.0 · Version: main (2ab2740)