Forest Global Training Partners

Cyber Risks · PortSwigger Research

Managing SCIM users and groups - Port Swigger

Summary: PortSwigger's documentation states that users and groups pushed to Burp Suite DAST via SCIM are labeled as such in the web UI and are managed differently from local users created directly in the product. SCIM group membership and user removal cannot be changed inside Burp Suite DAST - those changes must be made in the identity provider's admin console, and a user deleted in Okta is disabled but still visible in Burp Suite DAST until the SCIM integration is removed from settings.

What's compelling: A user deleted in Okta remains visible in Burp Suite DAST as a disabled account, so offboarding is not complete until someone removes the SCIM integration itself - a step that lives outside the identity provider your team already trusts to handle deprovisioning.

Read the original at PortSwigger Research ↗

Topics
Identity & Access Management
Related