Pass Okta SCIM 2.0 SPEC Test

backend/src/@types/fastify.d.ts

@@ -6,6 +6,7 @@ import { TCreateAuditLogDTO } from "@app/ee/services/audit-log/audit-log-types";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { TSamlConfigServiceFactory } from "@app/ee/services/saml-config/saml-config-service";
+import { TScimServiceFactory } from "@app/ee/services/scim/scim-service";
 import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-service";
 import { TSecretApprovalRequestServiceFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-service";
 import { TSecretRotationServiceFactory } from "@app/ee/services/secret-rotation/secret-rotation-service";
@@ -105,6 +106,7 @@ declare module "fastify" {
       secretRotation: TSecretRotationServiceFactory;
       snapshot: TSecretSnapshotServiceFactory;
       saml: TSamlConfigServiceFactory;
+      scim: TScimServiceFactory;
       auditLog: TAuditLogServiceFactory;
       secretScanning: TSecretScanningServiceFactory;
       license: TLicenseServiceFactory;

backend/src/@types/knex.d.ts

@@ -83,6 +83,9 @@ import {
   TSamlConfigs,
   TSamlConfigsInsert,
   TSamlConfigsUpdate,
+  TScimTokens,
+  TScimTokensInsert,
+  TScimTokensUpdate,
   TSecretApprovalPolicies,
   TSecretApprovalPoliciesApprovers,
   TSecretApprovalPoliciesApproversInsert,
@@ -262,6 +265,11 @@ declare module "knex/types/tables" {
       TIdentityProjectMembershipsInsert,
       TIdentityProjectMembershipsUpdate
     >;
+    [TableName.ScimToken]: Knex.CompositeTableType<
+      TScimTokens,
+      TScimTokensInsert,
+      TScimTokensUpdate
+    >;
     [TableName.SecretApprovalPolicy]: Knex.CompositeTableType<
       TSecretApprovalPolicies,
       TSecretApprovalPoliciesInsert,

backend/src/db/migrations/20240208234120_scim-token.ts

@@ -7,15 +7,15 @@ export async function up(knex: Knex): Promise<void> {
   if (!(await knex.schema.hasTable(TableName.ScimToken))) {
     await knex.schema.createTable(TableName.ScimToken, (t) => {
       t.string("id", 36).primary().defaultTo(knex.fn.uuid());
-      t.bigInteger("tokenTTL").defaultTo(15552000).notNullable(); // 180 days second
-      t.datetime("tokenLastUsedAt");
+      t.bigInteger("ttl").defaultTo(15552000).notNullable(); // 180 days second
+      t.string("description").notNullable();
       t.uuid("orgId").notNullable();
       t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
       t.timestamps(true, true, true);
     });
   }
 
-  await createOnUpdateTrigger(knex, TableName.IdentityAccessToken);
+  await createOnUpdateTrigger(knex, TableName.ScimToken);
 }
 
 export async function down(knex: Knex): Promise<void> {

backend/src/db/schemas/index.ts

@@ -26,6 +26,7 @@ export * from "./project-memberships";
 export * from "./project-roles";
 export * from "./projects";
 export * from "./saml-configs";
+export * from "./scim-tokens";
 export * from "./secret-approval-policies";
 export * from "./secret-approval-policies-approvers";
 export * from "./secret-approval-request-secret-tags";

backend/src/db/schemas/scim-tokens.ts

@@ -0,0 +1,21 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const ScimTokensSchema = z.object({
+  id: z.string(),
+  ttl: z.coerce.number().default(15552000),
+  description: z.string(),
+  orgId: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+});
+
+export type TScimTokens = z.infer<typeof ScimTokensSchema>;
+export type TScimTokensInsert = Omit<TScimTokens, TImmutableDBKeys>;
+export type TScimTokensUpdate = Partial<Omit<TScimTokens, TImmutableDBKeys>>;

backend/src/ee/routes/v1/scim-router.ts

@@ -1,10 +1,13 @@
 import jwt from "jsonwebtoken";
 import { z } from "zod";
+import { ScimTokensSchema } from "@app/db/schemas";
 
 import { getConfig } from "@app/lib/config/env";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode, AuthTokenType } from "@app/services/auth/auth-type";
 
+
+
 export const registerScimRouter = async (server: FastifyZodProvider) => {
   server.route({
     url: "/",
@@ -27,29 +30,177 @@ export const registerScimRouter = async (server: FastifyZodProvider) => {
     url: "/Users",
     method: "GET",
     schema: {
-      params: z.object({}),
+      querystring: z.object({
+        startIndex: z.coerce.number().default(1),
+        count: z.coerce.number().default(20),
+        filter: z.string().trim().optional()
+      }),
       response: {
-        200: z.object({})
+        200: z.object({ // TODO: audit the response
+          Resources: z.array(z.object({
+            id: z.string().trim(),
+            userName: z.string().trim(),
+            name: z.object({
+              familyName: z.string().trim(),
+              givenName: z.string().trim()
+            }),
+            emails: z.array(z.object({
+              primary: z.boolean(),
+              value: z.string().email(),
+              type: z.string().trim()
+            })),
+            displayName: z.string().trim(),
+            active: z.boolean()
+          })),
+          itemsPerPage: z.number(),
+          schemas: z.array(z.string()),
+          startIndex: z.number(),
+          totalResults: z.number(),
+        })
       }
     },
-    // onRequest: verifyAuth([]),
-    handler: async () => {
-      return {
-        hello: "world"
-      };
+    onRequest: verifyAuth([AuthMode.SCIM_TOKEN]),
+    handler: async (req) => {
+      const res = await req.server.services.scim.listUsers({
+        offset: req.query.startIndex,
+        limit: req.query.count,
+        filter: req.query.filter
+      });
+      return res;
     }
   });
 
   server.route({
-    url: "/tokens/organizations/:organizationId", // api/v1/scim/token/organizations/:organizationId
+    url: "/Users/:userId",
+    method: "GET",
+    schema: {
+      params: z.object({
+        userId: z.string().trim()
+      }),
+      response: {
+        201: z.object({
+          schemas: z.array(z.string()),
+          id: z.string().trim(),
+          userName: z.string().trim(),
+          name: z.object({
+            familyName: z.string().trim(),
+            givenName: z.string().trim()
+          }),
+          emails: z.array(z.object({
+            primary: z.boolean(),
+            value: z.string().email(),
+            type: z.string().trim()
+          })),
+          displayName: z.string().trim(),
+          active: z.boolean()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.SCIM_TOKEN]),
+    handler: async (req) => {
+      const res = await req.server.services.scim.getUser(req.params.userId);
+      return res;
+    }
+  });
+
+  server.route({
+    url: "/Users",
+    method: "POST",
+    schema: {
+      body: z.object({
+        schemas: z.array(z.string()),
+        userName: z.string().trim(),
+        name: z.object({
+          familyName: z.string().trim(),
+          givenName: z.string().trim()
+        }),
+        emails: z.array(z.object({
+          primary: z.boolean(),
+          value: z.string().email(),
+          type: z.string().trim()
+        })),
+        displayName: z.string().trim(),
+        // locale: z.string().trim(),
+        // externalId: z.string().trim(),
+        // groups: z.array(z.object({
+        //   value: z.string().trim()
+        // })),
+        // password: z.string().trim(),
+        active: z.boolean()
+      }),
+      response: {
+        200: z.object({
+          schemas: z.array(z.string()),
+          id: z.string().trim(),
+          userName: z.string().trim(),
+          name: z.object({
+            familyName: z.string().trim(),
+            givenName: z.string().trim()
+          }),
+          emails: z.array(z.object({
+            primary: z.boolean(),
+            value: z.string().email(),
+            type: z.string().trim()
+          })),
+          displayName: z.string().trim(),
+          active: z.boolean()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.SCIM_TOKEN]),
+    handler: async (req, reply) => {
+      const user = await req.server.services.scim.createUser({
+        email: req.body.emails[0].value,
+        firstName: req.body.name.givenName,
+        lastName: req.body.name.familyName,
+        orgId: req.permission.orgId as string
+      });
+
+      reply.code(201);
+      return user;
+    }
+  });
+
+  server.route({
+    url: "/Users/:userId",
+    method: "PATCH",
+    schema: {
+      body: z.object({}),
+      response: {
+        200: z.object({})
+      }
+    },
+    onRequest: verifyAuth([AuthMode.SCIM_TOKEN]),
+    handler: async (req) => {
+      // TODO: update a user's attr
+      return {};
+    }
+  });
+
+  server.route({
+    url: "/Users/:userId",
+    method: "PUT",
+    schema: {
+      body: z.object({}),
+      response: {
+        200: z.object({})
+      }
+    },
+    onRequest: verifyAuth([AuthMode.SCIM_TOKEN]),
+    handler: async (req) => {
+      // TODO: update a user's profile
+      return {};
+    }
+  });
+
+  server.route({
+    url: "/scim-tokens",
     method: "POST",
     onRequest: verifyAuth([AuthMode.JWT]),
     schema: {
-      params: z.object({
-        organizationId: z.string().trim()
-      }),
       body: z.object({
-        description: z.string().trim(),
+        organizationId: z.string().trim(),
+        description: z.string().trim().default(""),
         ttl: z.number().min(0).default(0)
       }),
       response: {
@@ -58,53 +209,53 @@ export const registerScimRouter = async (server: FastifyZodProvider) => {
         })
       }
     },
-    handler: async () => {
-      // TODO: create SCIM token logic
-      // TODO: create SCIM token controller
-
-      const appCfg = getConfig();
-      const scimToken = jwt.sign(
-        {
-          authTokenType: AuthTokenType.SCIM_TOKEN
-        },
-        appCfg.AUTH_SECRET,
-        {
-          // expiresIn: identityAccessToken.accessTokenMaxTTL === 0 ? undefined : identityAccessToken.accessTokenMaxTTL
-        }
-      ); // TODO: add expiration
+    handler: async (req) => {
+      const { scimToken } = await server.services.scim.createScimToken({
+        organizationId: req.body.organizationId,
+        description: req.body.description,
+        ttl: req.body.ttl
+      });
 
       return { scimToken };
     }
   });
 
   server.route({
-    url: "/tokens/organizations/:organizationId", // api/v1/scim/token/organizations/:organizationId
+    url: "/scim-tokens",
     method: "GET",
     onRequest: verifyAuth([AuthMode.JWT]),
     schema: {
-      params: z.object({
+      querystring: z.object({
         organizationId: z.string().trim()
       }),
       response: {
         200: z.object({
-          scimToken: z.string().trim()
+          scimTokens: z.array(ScimTokensSchema)
         })
       }
     },
-    handler: async () => {
-      // TODO: put into service file
-
-      const appCfg = getConfig();
-      const scimToken = jwt.sign(
-        {
-          authTokenType: AuthTokenType.SCIM_TOKEN
-        },
-        appCfg.AUTH_SECRET,
-        {
-          // expiresIn: identityAccessToken.accessTokenMaxTTL === 0 ? undefined : identityAccessToken.accessTokenMaxTTL
-        }
-      ); // TODO: add expiration
+    handler: async (req) => {
+      const scimTokens = await server.services.scim.getScimTokens(req.query.organizationId);
+      return { scimTokens };
+    }
+  });
 
+  server.route({
+    url: "/scim-tokens/:scimTokenId",
+    method: "DELETE",
+    onRequest: verifyAuth([AuthMode.JWT]),
+    schema: {
+      params: z.object({
+        scimTokenId: z.string().trim()
+      }),
+      response: {
+        200: z.object({
+          scimToken: ScimTokensSchema
+        })
+      }
+    },
+    handler: async (req) => {
+      const scimToken = await server.services.scim.deleteScimToken(req.params.scimTokenId);
       return { scimToken };
     }
   });

backend/src/ee/services/audit-log/audit-log-types.ts

@@ -15,7 +15,7 @@ export type TListProjectAuditLogDTO = {
 
 export type TCreateAuditLogDTO = {
   event: Event;
-  actor: UserActor | IdentityActor | ServiceActor;
+  actor: UserActor | IdentityActor | ServiceActor | ScimIdpActor;
   orgId?: string;
   projectId?: string;
 } & BaseAuthData;
@@ -120,7 +120,11 @@ export interface IdentityActor {
   metadata: IdentityActorMetadata;
 }
 
-export type Actor = UserActor | ServiceActor | IdentityActor;
+export interface ScimClientActor {
+  type: ActorType.SCIM_CLIENT;
+}
+
+export type Actor = UserActor | ServiceActor | IdentityActor | ScimClientActor;
 
 interface GetSecretsEvent {
   type: EventType.GET_SECRETS;

backend/src/ee/services/license/licence-fns.ts

@@ -23,8 +23,8 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({
   customAlerts: false,
   auditLogs: false,
   auditLogsRetentionDays: 0,
-  samlSSO: false,
-  scim: false,
+  samlSSO: true,
+  scim: true,
   status: null,
   trial_end: null,
   has_used_trial: true,

backend/src/ee/services/license/license-types.ts

@@ -24,8 +24,8 @@ export type TFeatureSet = {
   customAlerts: false;
   auditLogs: false;
   auditLogsRetentionDays: 0;
-  samlSSO: false;
-  scim: false;
+  samlSSO: true;
+  scim: true;
   status: null;
   trial_end: null;
   has_used_trial: true;

backend/src/ee/services/scim/scim-dal.ts

@@ -0,0 +1,10 @@
+import { TDbClient } from "@app/db";
+import { TableName } from "@app/db/schemas";
+import { ormify } from "@app/lib/knex";
+
+export type TScimDALFactory = ReturnType<typeof scimDALFactory>;
+
+export const scimDALFactory = (db: TDbClient) => {
+  const scimTokenOrm = ormify(db, TableName.ScimToken);
+  return scimTokenOrm;
+};

backend/src/ee/services/scim/scim-service.ts

@@ -0,0 +1,229 @@
+import jwt from "jsonwebtoken";
+
+import {
+  OrgMembershipRole,
+  OrgMembershipStatus
+} from "@app/db/schemas";
+import { TScimDALFactory } from "@app/ee/services/scim/scim-dal";
+import { TUserDALFactory } from "@app/services/user/user-dal";        
+import { TOrgDALFactory } from "@app/services/org/org-dal";
+import { TPermissionServiceFactory } from "../permission/permission-service";
+import { TLicenseServiceFactory } from "../license/license-service";
+import { getConfig } from "@app/lib/config/env";
+import { AuthMethod, AuthTokenType } from "@app/services/auth/auth-type";
+import {
+  TCreateScimTokenDTO,
+  TListScimUsersDTO,
+  TListScimUsersRes,
+  TCreateScimUserDTO,
+  TScimTokenJwtPayload
+} from "./scim-types";
+import { 
+  createScimUser,
+  TScimUser,
+} from "@app/lib/scim";
+import { UnauthorizedError, ScimRequestError } from "@app/lib/errors";
+
+type TScimServiceFactoryDep = {
+  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
+  scimDAL: TScimDALFactory; // TODO: pick
+  userDAL: TUserDALFactory; // TODO: pick
+  orgDAL: TOrgDALFactory; // TODO: pick
+  licenseService: Pick<TLicenseServiceFactory, "getPlan">;
+};
+
+export type TScimServiceFactory = ReturnType<typeof scimServiceFactory>;
+
+export const scimServiceFactory = ({ 
+  licenseService,
+  scimDAL,
+  userDAL,
+  orgDAL,
+  permissionService
+}: TScimServiceFactoryDep) => {
+  const createScimToken = async ({
+    organizationId,
+    description,
+    ttl
+  }: TCreateScimTokenDTO) => {
+    const appCfg = getConfig();
+    
+    // TODO: permission stuff
+
+    const scimTokenData = await scimDAL.create({
+      orgId: organizationId,
+      description,
+      ttl
+    });
+    
+    const scimToken = jwt.sign(
+      {
+        scimTokenId: scimTokenData.id,
+        authTokenType: AuthTokenType.SCIM_TOKEN
+      },
+      appCfg.AUTH_SECRET
+    );
+    
+    return { scimToken }
+  }
+
+  const getScimTokens = async (organizationId: string) => {
+    const scimTokens = await scimDAL.find({ orgId: organizationId });
+    return scimTokens;
+  }
+  
+  const deleteScimToken = async (scimTokenId: string) => {
+    const scimToken = await scimDAL.deleteById(scimTokenId);
+    return scimToken;
+  }
+  
+  // scim server endpoints
+
+  const listUsers = async ({
+    offset,
+    limit,
+    filter
+  }: TListScimUsersDTO): Promise<TListScimUsersRes> => {
+    
+    const parseFilter = (filter: string | undefined) => {
+      if (!filter) return {};
+      const [parsedName, parsedValue] = filter.split("eq").map(s => s.trim());
+      
+      let attributeName = parsedName;
+      if (parsedName === "userName") { // note
+        attributeName = "email";
+      }
+      
+      return { [attributeName]: parsedValue };
+    };
+    
+    const findOpts = {
+      ...(offset && { offset }),
+      ...(limit && { limit }),
+    };
+    
+    const users = await userDAL.find(parseFilter(filter), findOpts);
+    
+    let resources: TScimUser[] = [];
+    
+    let scimResource: TListScimUsersRes = { // note: type
+      Resources: [],
+      itemsPerPage: limit,
+      schemas: ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
+      startIndex: offset,
+      totalResults: users.length
+    };
+    
+    users.forEach((user) => {
+      let scimUser = createScimUser({
+        userId: user.id,
+        firstName: user.firstName as string,
+        lastName: user.lastName as string,
+        email: user.email
+      });
+      resources.push(scimUser);
+    });
+
+    scimResource.Resources = resources;
+    
+    return scimResource;
+  }
+  
+  const getUser = async (userId: string) => {
+    // TODO: check out SCIM-specific errors
+    
+    let user;
+    try {
+      user = await userDAL.findById(userId);
+    } catch (error) {
+
+      interface PostgresError extends Error {
+        error: {
+          code: string;
+        }
+      }
+      
+      const dbError = error as PostgresError;
+      
+      if (dbError.error.code === "22P02") throw new ScimRequestError({
+        detail: "User not found",
+        status: 404
+      });
+      
+      throw error;
+    }
+    
+    if (!user) throw new ScimRequestError({
+      detail: "User not found",
+      status: 404
+    });
+    
+    return createScimUser({
+      userId: user.id,
+      firstName: user.firstName as string,
+      lastName: user.lastName as string,
+      email: user.email
+    });
+  }
+  
+  const createUser = async ({
+    firstName,
+    lastName,
+    email,
+    orgId
+  }: TCreateScimUserDTO) => {
+    let user = await userDAL.findOne({
+      email
+    });
+    
+    if (user) throw new ScimRequestError({
+      detail: "User already exists in the database",
+      status: 409
+    });
+
+    user = await userDAL.transaction(async (tx) => {
+      const newUser = await userDAL.create(
+        {
+          email,
+          firstName,
+          lastName,
+          authMethods: [AuthMethod.EMAIL]
+        },
+        tx
+      );
+      await orgDAL.createMembership({
+        inviteEmail: email,
+        orgId,
+        role: OrgMembershipRole.Member,
+        status: OrgMembershipStatus.Invited
+      });
+      return newUser;
+    });
+    
+    return createScimUser({
+      userId: user.id,
+      firstName: user.firstName as string,
+      lastName: user.lastName as string,
+      email: user.email
+    });
+  }
+  
+  const fnValidateScimToken = async (token: TScimTokenJwtPayload) => {
+    // TODO: check expiry
+    
+    const scimToken = await scimDAL.findById(token.scimTokenId);
+    if (!scimToken) throw new UnauthorizedError();
+    
+    return { scimTokenId: scimToken.id, orgId: scimToken.orgId };
+  }
+  
+  return { 
+    createScimToken,
+    getScimTokens,
+    deleteScimToken,
+    listUsers,
+    getUser,
+    createUser,
+    fnValidateScimToken
+  };
+};

backend/src/ee/services/scim/scim-types.ts

@@ -0,0 +1,41 @@
+import { TOrgPermission } from "@app/lib/types";
+import { TScimUser } from "@app/lib/scim";
+
+export type TCreateScimTokenDTO = {
+    organizationId: string;
+    description: string;
+    ttl: number;
+} 
+
+// TODO: add org permissions
+// & Omit<TOrgPermission, "orgId">;
+
+export type TListScimUsersDTO = {
+    offset: number;
+    limit: number;
+    filter?: string;
+}
+
+export type TListScimUsersRes = { // check naming here
+    schemas: ["urn:ietf:params:scim:api:messages:2.0:ListResponse"];
+    totalResults: number;
+    Resources: TScimUser[];
+    itemsPerPage: number;
+    startIndex: number;
+}
+
+export type TCreateScimUserDTO = {
+    email: string;
+    firstName: string;
+    lastName: string;
+    orgId: string;
+}
+
+export type TCreateScimUserRes = {
+    schemas: ["urn:ietf:params:scim:schemas:core:2.0:User"]
+}
+
+export type TScimTokenJwtPayload = {
+    scimTokenId: string;
+    authTokenType: string;
+};

backend/src/lib/errors/index.ts

@@ -58,3 +58,20 @@ export class BadRequestError extends Error {
     this.error = error;
   }
 }
+
+export class ScimRequestError extends Error {
+  name: string;
+  schemas: string[];
+  detail: string;
+  status: number;
+  error: unknown;
+
+  constructor({ name, error, detail, status }: { message?: string; name?: string; error?: unknown, detail: string, status: number }) {
+    super(detail ?? "The request is invalid");
+    this.name = name || "ScimRequestError";
+    this.schemas = ["urn:ietf:params:scim:api:messages:2.0:Error"];
+    this.error = error;
+    this.detail = detail;
+    this.status = status;
+  }
+}

backend/src/lib/scim/fns.ts

@@ -0,0 +1,39 @@
+import { TScimUser } from "./types";
+
+export const createScimUser = ({
+    userId,
+    firstName,
+    lastName,
+    email
+}: {
+    userId: string;
+    firstName: string;
+    lastName: string;
+    email: string;
+}): TScimUser => {
+    let scimUser = {
+        "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
+        "id": userId,
+        "userName": email,
+        "displayName": `${firstName} ${lastName}`,
+        "name": {
+            "givenName": firstName,
+            "middleName": null,
+            "familyName": lastName
+        },
+        "emails":
+            [{
+                "primary": true,
+                "value": email,
+                "type": "work"
+            }],
+        "active": true,
+        "groups": [],
+        "meta": {
+            "resourceType": "User",
+            "location": null
+        }
+    };
+    
+    return scimUser;
+}

backend/src/lib/scim/index.ts

@@ -0,0 +1,4 @@
+export { TScimUser } from "./types";
+export {
+    createScimUser
+} from "./fns";

backend/src/lib/scim/types.ts

@@ -0,0 +1,23 @@
+
+export type TScimUser = {
+    schemas: string[];
+    id: string;
+    userName: string;
+    displayName: string;
+    name: {
+        givenName: string;
+        middleName: null;
+        familyName: string;
+    };
+    emails: {
+        primary: boolean;
+        value: string;
+        type: string;
+    }[];
+    active: boolean;
+    groups: string[];
+    meta: {
+        resourceType: string;
+        location: null;
+    };
+}

backend/src/server/plugins/audit-log.ts

@@ -63,6 +63,10 @@ export const injectAuditLogInfo = fp(async (server: FastifyZodProvider) => {
           identityId: req.auth.identityId
         }
       };
+    } else if (req.auth.actor === ActorType.SCIM_CLIENT) {
+      payload.actor = {
+        type: ActorType.SCIM_CLIENT
+      };
     } else {
       throw new BadRequestError({ message: "Missing logic for other actor" });
     }

backend/src/server/plugins/auth/inject-identity.ts

@@ -7,6 +7,7 @@ import { getConfig } from "@app/lib/config/env";
 import { UnauthorizedError } from "@app/lib/errors";
 import { ActorType, AuthMode, AuthModeJwtTokenPayload, AuthTokenType } from "@app/services/auth/auth-type";
 import { TIdentityAccessTokenJwtPayload } from "@app/services/identity-access-token/identity-access-token-types";
+import { TScimTokenJwtPayload } from "@app/ee/services/scim/scim-types";
 
 export type TAuthMode =
   | {
@@ -38,7 +39,9 @@ export type TAuthMode =
     }
   | {
       authMode: AuthMode.SCIM_TOKEN;
-      actor: ActorType.SCIM_IDP;
+      actor: ActorType.SCIM_CLIENT;
+      scimTokenId: string;
+      orgId: string;
     };
 
 const extractAuth = async (req: FastifyRequest, jwtSecret: string) => {
@@ -78,8 +81,8 @@ const extractAuth = async (req: FastifyRequest, jwtSecret: string) => {
     case AuthTokenType.SCIM_TOKEN:
       return {
         authMode: AuthMode.SCIM_TOKEN,
-        token: decodedToken,
-        actor: ActorType.SCIM_IDP
+        token: decodedToken as TScimTokenJwtPayload,
+        actor: ActorType.SCIM_CLIENT
       } as const;
     default:
       return { authMode: null, token: null } as const;
@@ -125,7 +128,8 @@ export const injectIdentity = fp(async (server: FastifyZodProvider) => {
         break;
       }
       case AuthMode.SCIM_TOKEN: {
-        req.auth = { authMode: AuthMode.SCIM_TOKEN, actor };
+        const { orgId, scimTokenId } = await server.services.scim.fnValidateScimToken(token);
+        req.auth = { authMode: AuthMode.SCIM_TOKEN, actor, scimTokenId, orgId };
         break;
       }
       default:

backend/src/server/plugins/auth/inject-permission.ts

@@ -14,6 +14,8 @@ export const injectPermission = fp(async (server) => {
       req.permission = { type: ActorType.IDENTITY, id: req.auth.identityId };
     } else if (req.auth.actor === ActorType.SERVICE) {
       req.permission = { type: ActorType.SERVICE, id: req.auth.serviceTokenId };
+    } else if (req.auth.actor === ActorType.SCIM_CLIENT) {
+      req.permission = { type: ActorType.SCIM_CLIENT, id: req.auth.scimTokenId, orgId: req.auth.orgId };
     }
   });
 });

backend/src/server/plugins/error-handler.ts

@@ -2,7 +2,7 @@ import { ForbiddenError } from "@casl/ability";
 import fastifyPlugin from "fastify-plugin";
 import { ZodError } from "zod";
 
-import { BadRequestError, DatabaseError, InternalServerError, UnauthorizedError } from "@app/lib/errors";
+import { BadRequestError, DatabaseError, InternalServerError, UnauthorizedError, ScimRequestError } from "@app/lib/errors";
 
 export const fastifyErrHandler = fastifyPlugin(async (server: FastifyZodProvider) => {
   server.setErrorHandler((error, req, res) => {
@@ -21,6 +21,12 @@ export const fastifyErrHandler = fastifyPlugin(async (server: FastifyZodProvider
         error: "PermissionDenied",
         message: `You are not allowed to ${error.action} on ${error.subjectType}`
       });
+    } else if (error instanceof ScimRequestError) {
+      void res.status(error.status).send({
+        schemas: error.schemas,
+        status: error.status,
+        detail: error.detail
+      });
     } else {
       void res.send(error);
     }

backend/src/server/routes/index.ts

@@ -32,6 +32,8 @@ import { snapshotFolderDALFactory } from "@app/ee/services/secret-snapshot/snaps
 import { snapshotSecretDALFactory } from "@app/ee/services/secret-snapshot/snapshot-secret-dal";
 import { trustedIpDALFactory } from "@app/ee/services/trusted-ip/trusted-ip-dal";
 import { trustedIpServiceFactory } from "@app/ee/services/trusted-ip/trusted-ip-service";
+import { scimDALFactory } from "@app/ee/services/scim/scim-dal";
+import { scimServiceFactory } from "@app/ee/services/scim/scim-service";
 import { getConfig } from "@app/lib/config/env";
 import { TQueueServiceFactory } from "@app/queue";
 import { apiKeyDALFactory } from "@app/services/api-key/api-key-dal";
@@ -155,6 +157,7 @@ export const registerRoutes = async (
 
   const auditLogDAL = auditLogDALFactory(db);
   const trustedIpDAL = trustedIpDALFactory(db);
+  const scimDAL = scimDALFactory(db);
 
   // ee db layer ops
   const permissionDAL = permissionDALFactory(db);
@@ -188,6 +191,13 @@ export const registerRoutes = async (
     trustedIpDAL,
     permissionService
   });
+  const scimService = scimServiceFactory({ 
+    licenseService,
+    scimDAL,
+    userDAL,
+    orgDAL,
+    permissionService
+  });
   const auditLogQueue = auditLogQueueServiceFactory({
     auditLogDAL,
     queueService,
@@ -486,6 +496,7 @@ export const registerRoutes = async (
     secretScanning: secretScanningService,
     license: licenseService,
     trustedIp: trustedIpService,
+    scim: scimService,
     secretBlindIndex: secretBlindIndexService,
     telemetry: telemetryService
   });

backend/src/services/auth/auth-type.ts

@@ -34,7 +34,7 @@ export enum ActorType { // would extend to AWS, Azure, ...
   SERVICE = "service",
   IDENTITY = "identity",
   Machine = "machine",
-  SCIM_IDP = "scimIdp"
+  SCIM_CLIENT = "scimClient"
 }
 
 export type AuthModeJwtTokenPayload = {