Simulators
Bookmark applications
A bookmark application is a sign-in tile an org assigns to users and groups, and it is the application type the simulator models. Create one, assign the Design group to it, assign one user directly and deactivate the application:
curl -s -X POST "$RYSTIC_URL/_rystic/scenario" -d '{"name":"design_studio"}' -o /dev/null
api="$RYSTIC_URL/api/v1"
curl -s "$api/apps" -H 'Authorization: SSWS placeholder' -H 'Content-Type: application/json' -d '{"name":"bookmark","label":"Design Wiki","signOnMode":"BOOKMARK","settings":{"app":{"url":"https://wiki.wdcontractors.example","requestIntegration":false}}}' | jq -c '{id, label, status, signOnMode}'
# -> {"id":"0oa00000000000000001","label":"Design Wiki","status":"ACTIVE","signOnMode":"BOOKMARK"}
group=$(curl -s "$api/groups?q=Design" -H 'Authorization: SSWS placeholder' | jq -r '.[] | select(.profile.name == "Design") | .id')
curl -s -X PUT "$api/apps/0oa00000000000000001/groups/$group" -H 'Authorization: SSWS placeholder' -H 'Content-Type: application/json' -d '{"priority":0}' | jq -c '{priority}'
# -> {"priority":0}
curl -s "$api/apps/0oa00000000000000001/users" -H 'Authorization: SSWS placeholder' | jq -c 'map(.scope) | unique'
# -> ["GROUP"]
user=$(curl -s "$api/users?search=profile.department%20eq%20%22Design%22&limit=1" -H 'Authorization: SSWS placeholder' | jq -r '.[0].id')
curl -s "$api/apps/0oa00000000000000001/users" -H 'Authorization: SSWS placeholder' -H 'Content-Type: application/json' -d "{\"id\":\"$user\"}" | jq -c '{scope, status}'
# -> {"scope":"USER","status":"ACTIVE"}
curl -s -X POST "$api/apps/0oa00000000000000001/lifecycle/deactivate" -H 'Authorization: SSWS placeholder' -o /dev/null -w '%{http_code}\n'
# -> 200
curl -s "$api/apps/0oa00000000000000001" -H 'Authorization: SSWS placeholder' | jq -c '{status}'
# -> {"status":"INACTIVE"}
Assignments
An application’s users are listed at /api/v1/apps/{appId}/users and its groups at /api/v1/apps/{appId}/groups. Assigning a group gives each member a group-derived assignment (scope GROUP), and assigning a user directly gives a USER assignment. Assign a group with PUT /api/v1/apps/{appId}/groups/{groupId}, change it with PATCH and remove it with DELETE.
A user’s assignments follow its status (User lifecycle and passwords):
| The user is | What happens to its assignments |
|---|---|
| deactivated or purged | all are removed, direct and group-derived |
| activated again | the group-derived ones are restored, the direct ones aren’t |
Only bookmark applications are measured
Differs from Okta: an application with another sign-on mode is stored as you send it, without the credentials Okta would generate. It gets no OAuth client_id or secret and no SAML metadata.