For the purpose of modern identity management and centralized operations at the Cloud era, organization needs to use a unique Identity Provider (DIP) such as Bravas, Okta, JumpCloud, OneLogin, Google Cloud Identity, Entra ID, and others. Those IDP are here to provide two distinct set of services: the federated authentication (incorrectly called SSO sometime) that Hudu currently support with SAML (which is not perfectly implemented as configuration should be done via SAML metadata URL and not attribute copying) and that can also be supported via OIDC the user provisioning that Hudu does not support at that time, and should be offered via SCIM to allow immediate compatibility with any IDP on the market. SCIM is an industry standard allowing a synchronization client on the IDP side to connect to many identity server on Service Provider side such as Hudu. This outgoing communication from IDP to SP will allow IDP to know all SP users and groups to maintain them in sync with source of truth that the IDP is. This is a mandatory feature to ensure correct Role Based Access Control operation as all Service Provider in the organization can be in synced of any evolution of role for any users in the organization, and so, using group based RBAC or ACL assignment, the SP can react to all changes in the user role in the organization thanks to SCIM. This could also be done using custom CRUD API but will require that every single IDP on the market make specific effort to support Hudu. SCIM seems more strategic here.