<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yui_3_16_0_1_1436821921932_27401"><font face="times new roman, new york, times, serif">Hello,</font></div><div dir="ltr" id="yui_3_16_0_1_1436821921932_27432"><font id="yui_3_16_0_1_1436821921932_28205" face="times new roman, new york, times, serif"> I would like to know how De-provisioning of user in Federated IDP case being handled in Keycloak.</font></div><div id="yui_3_16_0_1_1436821921932_27599" dir="ltr"><font id="yui_3_16_0_1_1436821921932_28203" face="times new roman, new york, times, serif">How frequently Keycloak validates the federated user status before reissuing the new access token to the already authenticated user.</font></div><div id="yui_3_16_0_1_1436821921932_27636" dir="ltr"><font id="yui_3_16_0_1_1436821921932_28201" face="times new roman, new york, times, serif">Is there plans to support SCIM (System for Cross-domain Identity Management) in Keycloak roadmap?</font></div><div id="yui_3_16_0_1_1436821921932_27666" dir="ltr"><font face="times new roman, new york, times, serif"><br></font></div><div id="yui_3_16_0_1_1436821921932_27795" dir="ltr"><font id="yui_3_16_0_1_1436821921932_28200" face="times new roman, new york, times, serif"><u id="yui_3_16_0_1_1436821921932_27940">Following is our use case<br></u></font></div><div id="yui_3_16_0_1_1436821921932_27760" dir="ltr"><font id="yui_3_16_0_1_1436821921932_27934" face="times new roman, new york, times, serif" size="2">1. There are few processes that will be authenticated with Federated IDP using SAML just after <b id="yui_3_16_0_1_1436821921932_27938">user</b><b id="yui_3_16_0_1_1436821921932_27936">(A)</b> registration is complete (one time login manually).</font></div><div id="yui_3_16_0_1_1436821921932_27762" dir="ltr"><font id="yui_3_16_0_1_1436821921932_27930" face="times new roman, new york, times, serif" size="2">2. Subsequently SP will issue the token pair to these processes to use as long as Refresh token lifetime is valid.</font></div><div id="yui_3_16_0_1_1436821921932_27782" dir="ltr"><font id="yui_3_16_0_1_1436821921932_27932" face="times new roman, new york, times, serif" size="2">3. Within this refresh token lifetime (if it too long) and in the case <b id="yui_3_16_0_1_1436821921932_27809">user(A)</b> is de-provisioned/removed, how would <b id="yui_3_16_0_1_1436821921932_28109"><font id="yui_3_16_0_1_1436821921932_28108" color="#9d1811"><span id="yui_3_16_0_1_1436821921932_28107" style="background-color: rgb(253, 239, 43);"><span id="yui_3_16_0_1_1436821921932_28086"><u id="yui_3_16_0_1_1436821921932_27964">SP be aware to block this token renewal</u></span></span></font></b>.</font></div><div id="yui_3_16_0_1_1436821921932_27837" dir="ltr"><font face="times new roman, new york, times, serif"><br></font></div><div id="yui_3_16_0_1_1436821921932_28125" dir="ltr"><font face="times new roman, new york, times, serif"><br></font></div><div id="yui_3_16_0_1_1436821921932_28127" dir="ltr"><font id="yui_3_16_0_1_1436821921932_28181" face="times new roman, new york, times, serif">Please share your thoughts.</font></div><div id="yui_3_16_0_1_1436821921932_28184" dir="ltr"><br></div><div id="yui_3_16_0_1_1436821921932_28186" dir="ltr"><font id="yui_3_16_0_1_1436821921932_28181" face="times new roman, new york, times, serif">Best</font></div><div id="yui_3_16_0_1_1436821921932_28220" dir="ltr"><font id="yui_3_16_0_1_1436821921932_28181" face="times new roman, new york, times, serif">Kamal<br></font></div><div id="yui_3_16_0_1_1436821921932_27840" dir="ltr"><br></div><div id="yui_3_16_0_1_1436821921932_28183" dir="ltr"><br></div><div id="yui_3_16_0_1_1436821921932_27781" dir="ltr"><br></div><div id="yui_3_16_0_1_1436821921932_27638" dir="ltr"><br></div></div></body></html>