feat(SCIM): user endpoints#12530
Conversation
Dschoordsch
changed the base branch from
master
to
feat/11050/SCIMAuthentication
| if (!user || user.isRemoved) { | ||
| throw new SCIMMY.Types.Error(404, '', 'User not found') | ||
| } |
There was a problem hiding this comment.
+1 we need active for Okta, so maybe we should do soft delete to please MS folks
There was a problem hiding this comment.
still valid comment? did you mean Entra by chance? or do both okta and MS require it?
There was a problem hiding this comment.
Yes. Okta requires it to be present for egress. It actually doesn't properly delete users, so we'll have to implement this in a follow-up.
For Entra it's configurable but recommended to allow deactivation of users.
| req.getHeader('x-application-authorization') || req.getHeader('authorization') | ||
| const token = authHeader?.slice(7) | ||
|
|
||
| // We're only peaking into the token here to check that it's for SCIM and so we can fetch the SAML config to verify it |
There was a problem hiding this comment.
+1 what's the harm in calling getReqAuth up here? if it's an empty token, then we know it's a 401 & we can remove the check down on L88
There was a problem hiding this comment.
You can chose OAuth or a simple bearer token for SCIM. If the user choses bearer token, then I want only 1 token to be valid at any time, the one stored in the DB. I want to make it a JWT so I can encode the scimId in it so all tenants can use the same endpoint. I don't want to sign it so it's still valid after a server secret rotation. That's why I only peak in it without checking the signature here and only check it for OAuth, for bearer token we check with the DB.
These should be in line with Microsofts validator
Dschoordsch
force-pushed
the
feat/11051/SCIMUserEndpoints
branch
from
5633613 to
bb94b19
Compare
| if (!user || user.isRemoved) { | ||
| throw new SCIMMY.Types.Error(404, '', 'User not found') | ||
| } |
There was a problem hiding this comment.
still valid comment? did you mean Entra by chance? or do both okta and MS require it?
2 participants
Description
Fixes #11051
Demo
[If possible, please include a screenshot or gif/video, it'll make it easier for reviewers to understand the scope of the changes and how the change is supposed to work. If you're introducing something new or changing the existing patterns, please share a Loom and explain what decisions you've made and under what circumstances]
Testing scenarios
[Please list all the testing scenarios a reviewer has to check before approving the PR]
Scenario A
Scenario B
Final checklist