Pass Okta SCIM 2.0 SPEC Test

backend/src/ee/services/audit-log/audit-log-types.ts

@@ -15,7 +15,7 @@ export type TListProjectAuditLogDTO = {
 
 export type TCreateAuditLogDTO = {
   event: Event;
-  actor: UserActor | IdentityActor | ServiceActor;
+  actor: UserActor | IdentityActor | ServiceActor | ScimIdpActor;
   orgId?: string;
   projectId?: string;
 } & BaseAuthData;
@@ -120,7 +120,11 @@ export interface IdentityActor {
   metadata: IdentityActorMetadata;
 }
 
-export type Actor = UserActor | ServiceActor | IdentityActor;
+export interface ScimClientActor {
+  type: ActorType.SCIM_CLIENT;
+}
+
+export type Actor = UserActor | ServiceActor | IdentityActor | ScimClientActor;
 
 interface GetSecretsEvent {
   type: EventType.GET_SECRETS;

backend/src/ee/services/license/licence-fns.ts

@@ -23,8 +23,8 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({
   customAlerts: false,
   auditLogs: false,
   auditLogsRetentionDays: 0,
-  samlSSO: false,
-  scim: false,
+  samlSSO: true,
+  scim: true,
   status: null,
   trial_end: null,
   has_used_trial: true,

backend/src/ee/services/license/license-types.ts

@@ -24,8 +24,8 @@ export type TFeatureSet = {
   customAlerts: false;
   auditLogs: false;
   auditLogsRetentionDays: 0;
-  samlSSO: false;
-  scim: false;
+  samlSSO: true;
+  scim: true;
   status: null;
   trial_end: null;
   has_used_trial: true;

backend/src/ee/services/scim/scim-dal.ts

@@ -0,0 +1,10 @@
+import { TDbClient } from "@app/db";
+import { TableName } from "@app/db/schemas";
+import { ormify } from "@app/lib/knex";
+
+export type TScimDALFactory = ReturnType<typeof scimDALFactory>;
+
+export const scimDALFactory = (db: TDbClient) => {
+  const scimTokenOrm = ormify(db, TableName.ScimToken);
+  return scimTokenOrm;
+};

backend/src/ee/services/scim/scim-service.ts

@@ -0,0 +1,229 @@
+import jwt from "jsonwebtoken";
+
+import {
+  OrgMembershipRole,
+  OrgMembershipStatus
+} from "@app/db/schemas";
+import { TScimDALFactory } from "@app/ee/services/scim/scim-dal";
+import { TUserDALFactory } from "@app/services/user/user-dal";        
+import { TOrgDALFactory } from "@app/services/org/org-dal";
+import { TPermissionServiceFactory } from "../permission/permission-service";
+import { TLicenseServiceFactory } from "../license/license-service";
+import { getConfig } from "@app/lib/config/env";
+import { AuthMethod, AuthTokenType } from "@app/services/auth/auth-type";
+import {
+  TCreateScimTokenDTO,
+  TListScimUsersDTO,
+  TListScimUsersRes,
+  TCreateScimUserDTO,
+  TScimTokenJwtPayload
+} from "./scim-types";
+import { 
+  createScimUser,
+  TScimUser,
+} from "@app/lib/scim";
+import { UnauthorizedError, ScimRequestError } from "@app/lib/errors";
+
+type TScimServiceFactoryDep = {
+  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
+  scimDAL: TScimDALFactory; // TODO: pick
+  userDAL: TUserDALFactory; // TODO: pick
+  orgDAL: TOrgDALFactory; // TODO: pick
+  licenseService: Pick<TLicenseServiceFactory, "getPlan">;
+};
+
+export type TScimServiceFactory = ReturnType<typeof scimServiceFactory>;
+
+export const scimServiceFactory = ({ 
+  licenseService,
+  scimDAL,
+  userDAL,
+  orgDAL,
+  permissionService
+}: TScimServiceFactoryDep) => {
+  const createScimToken = async ({
+    organizationId,
+    description,
+    ttl
+  }: TCreateScimTokenDTO) => {
+    const appCfg = getConfig();
+    
+    // TODO: permission stuff
+
+    const scimTokenData = await scimDAL.create({
+      orgId: organizationId,
+      description,
+      ttl
+    });
+    
+    const scimToken = jwt.sign(
+      {
+        scimTokenId: scimTokenData.id,
+        authTokenType: AuthTokenType.SCIM_TOKEN
+      },
+      appCfg.AUTH_SECRET
+    );
+    
+    return { scimToken }
+  }
+
+  const getScimTokens = async (organizationId: string) => {
+    const scimTokens = await scimDAL.find({ orgId: organizationId });
+    return scimTokens;
+  }
+  
+  const deleteScimToken = async (scimTokenId: string) => {
+    const scimToken = await scimDAL.deleteById(scimTokenId);
+    return scimToken;
+  }
+  
+  // scim server endpoints
+
+  const listUsers = async ({
+    offset,
+    limit,
+    filter
+  }: TListScimUsersDTO): Promise<TListScimUsersRes> => {
+    
+    const parseFilter = (filter: string | undefined) => {
+      if (!filter) return {};
+      const [parsedName, parsedValue] = filter.split("eq").map(s => s.trim());
+      
+      let attributeName = parsedName;
+      if (parsedName === "userName") { // note
+        attributeName = "email";
+      }
+      
+      return { [attributeName]: parsedValue };
+    };
+    
+    const findOpts = {
+      ...(offset && { offset }),
+      ...(limit && { limit }),
+    };
+    
+    const users = await userDAL.find(parseFilter(filter), findOpts);
+    
+    let resources: TScimUser[] = [];
+    
+    let scimResource: TListScimUsersRes = { // note: type
+      Resources: [],
+      itemsPerPage: limit,
+      schemas: ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
+      startIndex: offset,
+      totalResults: users.length
+    };
+    
+    users.forEach((user) => {
+      let scimUser = createScimUser({
+        userId: user.id,
+        firstName: user.firstName as string,
+        lastName: user.lastName as string,
+        email: user.email
+      });
+      resources.push(scimUser);
+    });
+
+    scimResource.Resources = resources;
+    
+    return scimResource;
+  }
+  
+  const getUser = async (userId: string) => {
+    // TODO: check out SCIM-specific errors
+    
+    let user;
+    try {
+      user = await userDAL.findById(userId);
+    } catch (error) {
+
+      interface PostgresError extends Error {
+        error: {
+          code: string;
+        }
+      }
+      
+      const dbError = error as PostgresError;
+      
+      if (dbError.error.code === "22P02") throw new ScimRequestError({
+        detail: "User not found",
+        status: 404
+      });
+      
+      throw error;
+    }
+    
+    if (!user) throw new ScimRequestError({
+      detail: "User not found",
+      status: 404
+    });
+    
+    return createScimUser({
+      userId: user.id,
+      firstName: user.firstName as string,
+      lastName: user.lastName as string,
+      email: user.email
+    });
+  }
+  
+  const createUser = async ({
+    firstName,
+    lastName,
+    email,
+    orgId
+  }: TCreateScimUserDTO) => {
+    let user = await userDAL.findOne({
+      email
+    });
+    
+    if (user) throw new ScimRequestError({
+      detail: "User already exists in the database",
+      status: 409
+    });
+
+    user = await userDAL.transaction(async (tx) => {
+      const newUser = await userDAL.create(
+        {
+          email,
+          firstName,
+          lastName,
+          authMethods: [AuthMethod.EMAIL]
+        },
+        tx
+      );
+      await orgDAL.createMembership({
+        inviteEmail: email,
+        orgId,
+        role: OrgMembershipRole.Member,
+        status: OrgMembershipStatus.Invited
+      });
+      return newUser;
+    });
+    
+    return createScimUser({
+      userId: user.id,
+      firstName: user.firstName as string,
+      lastName: user.lastName as string,
+      email: user.email
+    });
+  }
+  
+  const fnValidateScimToken = async (token: TScimTokenJwtPayload) => {
+    // TODO: check expiry
+    
+    const scimToken = await scimDAL.findById(token.scimTokenId);
+    if (!scimToken) throw new UnauthorizedError();
+    
+    return { scimTokenId: scimToken.id, orgId: scimToken.orgId };
+  }
+  
+  return { 
+    createScimToken,
+    getScimTokens,
+    deleteScimToken,
+    listUsers,
+    getUser,
+    createUser,
+    fnValidateScimToken
+  };
+};

backend/src/ee/services/scim/scim-types.ts

@@ -0,0 +1,41 @@
+import { TOrgPermission } from "@app/lib/types";
+import { TScimUser } from "@app/lib/scim";
+
+export type TCreateScimTokenDTO = {
+    organizationId: string;
+    description: string;
+    ttl: number;
+} 
+
+// TODO: add org permissions
+// & Omit<TOrgPermission, "orgId">;
+
+export type TListScimUsersDTO = {
+    offset: number;
+    limit: number;
+    filter?: string;
+}
+
+export type TListScimUsersRes = { // check naming here
+    schemas: ["urn:ietf:params:scim:api:messages:2.0:ListResponse"];
+    totalResults: number;
+    Resources: TScimUser[];
+    itemsPerPage: number;
+    startIndex: number;
+}
+
+export type TCreateScimUserDTO = {
+    email: string;
+    firstName: string;
+    lastName: string;
+    orgId: string;
+}
+
+export type TCreateScimUserRes = {
+    schemas: ["urn:ietf:params:scim:schemas:core:2.0:User"]
+}
+
+export type TScimTokenJwtPayload = {
+    scimTokenId: string;
+    authTokenType: string;
+};