Start SCIM functionality

backend/src/db/migrations/20240208234120_scim-token.ts

@@ -0,0 +1,24 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.ScimToken))) {
+    await knex.schema.createTable(TableName.ScimToken, (t) => {
+      t.string("id", 36).primary().defaultTo(knex.fn.uuid());
+      t.bigInteger("tokenTTL").defaultTo(15552000).notNullable(); // 180 days second
+      t.datetime("tokenLastUsedAt");
+      t.uuid("orgId").notNullable();
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+    });
+  }
+
+  await createOnUpdateTrigger(knex, TableName.IdentityAccessToken);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.ScimToken);
+  await dropOnUpdateTrigger(knex, TableName.ScimToken);
+}

backend/src/db/schemas/models.ts

@@ -40,6 +40,7 @@ export enum TableName {
   IdentityUaClientSecret = "identity_ua_client_secrets",
   IdentityOrgMembership = "identity_org_memberships",
   IdentityProjectMembership = "identity_project_memberships",
+  ScimToken = "scim_tokens",
   SecretApprovalPolicy = "secret_approval_policies",
   SecretApprovalPolicyApprover = "secret_approval_policies_approvers",
   SecretApprovalRequest = "secret_approval_requests",

backend/src/ee/routes/v1/index.ts

@@ -3,6 +3,7 @@ import { registerOrgRoleRouter } from "./org-role-router";
 import { registerProjectRoleRouter } from "./project-role-router";
 import { registerProjectRouter } from "./project-router";
 import { registerSamlRouter } from "./saml-router";
+import { registerScimRouter } from "./scim-router";
 import { registerSecretApprovalPolicyRouter } from "./secret-approval-policy-router";
 import { registerSecretApprovalRequestRouter } from "./secret-approval-request-router";
 import { registerSecretRotationProviderRouter } from "./secret-rotation-provider-router";
@@ -33,6 +34,7 @@ export const registerV1EERoutes = async (server: FastifyZodProvider) => {
     prefix: "/secret-rotation-providers"
   });
   await server.register(registerSamlRouter, { prefix: "/sso" });
+  await server.register(registerScimRouter, { prefix: "/scim" });
   await server.register(registerSecretScanningRouter, { prefix: "/secret-scanning" });
   await server.register(registerSecretRotationRouter, { prefix: "/secret-rotations" });
   await server.register(registerSecretVersionRouter, { prefix: "/secret" });

backend/src/ee/routes/v1/scim-router.ts

@@ -0,0 +1,111 @@
+import jwt from "jsonwebtoken";
+import { z } from "zod";
+
+import { getConfig } from "@app/lib/config/env";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AuthMode, AuthTokenType } from "@app/services/auth/auth-type";
+
+export const registerScimRouter = async (server: FastifyZodProvider) => {
+  server.route({
+    url: "/",
+    method: "GET",
+    schema: {
+      params: z.object({}),
+      response: {
+        200: z.object({})
+      }
+    },
+    // onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async () => {
+      return {
+        hello: "world"
+      };
+    }
+  });
+
+  server.route({
+    url: "/Users",
+    method: "GET",
+    schema: {
+      params: z.object({}),
+      response: {
+        200: z.object({})
+      }
+    },
+    // onRequest: verifyAuth([]),
+    handler: async () => {
+      return {
+        hello: "world"
+      };
+    }
+  });
+
+  server.route({
+    url: "/tokens/organizations/:organizationId", // api/v1/scim/token/organizations/:organizationId
+    method: "POST",
+    onRequest: verifyAuth([AuthMode.JWT]),
+    schema: {
+      params: z.object({
+        organizationId: z.string().trim()
+      }),
+      body: z.object({
+        description: z.string().trim(),
+        ttl: z.number().min(0).default(0)
+      }),
+      response: {
+        200: z.object({
+          scimToken: z.string().trim()
+        })
+      }
+    },
+    handler: async () => {
+      // TODO: create SCIM token logic
+      // TODO: create SCIM token controller
+
+      const appCfg = getConfig();
+      const scimToken = jwt.sign(
+        {
+          authTokenType: AuthTokenType.SCIM_TOKEN
+        },
+        appCfg.AUTH_SECRET,
+        {
+          // expiresIn: identityAccessToken.accessTokenMaxTTL === 0 ? undefined : identityAccessToken.accessTokenMaxTTL
+        }
+      ); // TODO: add expiration
+
+      return { scimToken };
+    }
+  });
+
+  server.route({
+    url: "/tokens/organizations/:organizationId", // api/v1/scim/token/organizations/:organizationId
+    method: "GET",
+    onRequest: verifyAuth([AuthMode.JWT]),
+    schema: {
+      params: z.object({
+        organizationId: z.string().trim()
+      }),
+      response: {
+        200: z.object({
+          scimToken: z.string().trim()
+        })
+      }
+    },
+    handler: async () => {
+      // TODO: put into service file
+
+      const appCfg = getConfig();
+      const scimToken = jwt.sign(
+        {
+          authTokenType: AuthTokenType.SCIM_TOKEN
+        },
+        appCfg.AUTH_SECRET,
+        {
+          // expiresIn: identityAccessToken.accessTokenMaxTTL === 0 ? undefined : identityAccessToken.accessTokenMaxTTL
+        }
+      ); // TODO: add expiration
+
+      return { scimToken };
+    }
+  });
+};

backend/src/server/plugins/auth/inject-identity.ts

@@ -33,6 +33,10 @@ export type TAuthMode =
       actor: ActorType.IDENTITY;
       identityId: string;
       identityName: string;
+    }
+  | {
+      authMode: AuthMode.SCIM_TOKEN;
+      actor: ActorType.SCIM_IDP;
     };
 
 const extractAuth = async (req: FastifyRequest, jwtSecret: string) => {
@@ -53,6 +57,7 @@ const extractAuth = async (req: FastifyRequest, jwtSecret: string) => {
   }
 
   const decodedToken = jwt.verify(authTokenValue, jwtSecret) as JwtPayload;
+
   switch (decodedToken.authTokenType) {
     case AuthTokenType.ACCESS_TOKEN:
       return {
@@ -68,6 +73,12 @@ const extractAuth = async (req: FastifyRequest, jwtSecret: string) => {
         token: decodedToken as TIdentityAccessTokenJwtPayload,
         actor: ActorType.IDENTITY
       } as const;
+    case AuthTokenType.SCIM_TOKEN:
+      return {
+        authMode: AuthMode.SCIM_TOKEN,
+        token: decodedToken,
+        actor: ActorType.SCIM_IDP
+      } as const;
     default:
       return { authMode: null, token: null } as const;
   }
@@ -111,6 +122,10 @@ export const injectIdentity = fp(async (server: FastifyZodProvider) => {
         req.auth = { authMode: AuthMode.API_KEY as const, userId: user.id, actor, user };
         break;
       }
+      case AuthMode.SCIM_TOKEN: {
+        req.auth = { authMode: AuthMode.SCIM_TOKEN, actor };
+        break;
+      }
       default:
         throw new UnauthorizedError({ name: "Unknown token strategy" });
     }

backend/src/services/auth/auth-type.ts

@@ -17,21 +17,24 @@ export enum AuthTokenType {
   API_KEY = "apiKey",
   SERVICE_ACCESS_TOKEN = "serviceAccessToken",
   SERVICE_REFRESH_TOKEN = "serviceRefreshToken",
-  IDENTITY_ACCESS_TOKEN = "identityAccessToken"
+  IDENTITY_ACCESS_TOKEN = "identityAccessToken",
+  SCIM_TOKEN = "scimToken"
 }
 
 export enum AuthMode {
   JWT = "jwt",
   SERVICE_TOKEN = "serviceToken",
   API_KEY = "apiKey",
-  IDENTITY_ACCESS_TOKEN = "identityAccessToken"
+  IDENTITY_ACCESS_TOKEN = "identityAccessToken",
+  SCIM_TOKEN = "scimToken"
 }
 
 export enum ActorType { // would extend to AWS, Azure, ...
   USER = "user", // userIdentity
   SERVICE = "service",
   IDENTITY = "identity",
-  Machine = "machine"
+  Machine = "machine",
+  SCIM_IDP = "scimIdp"
 }
 
 export type AuthModeJwtTokenPayload = {