feat: scim group and user provisioning - #8096

Merged

n1ru4l merged 127 commits into

mainfrom

feat-scim-user-group-provisioning

Aug 3, 2026

Commits on Aug 3, 2026

wip groups support
n1ru4l
committed
31b2e3f
indices
n1ru4l
committed
48dec9c
issa unique
n1ru4l
committed
78daa9b
typo
n1ru4l
committed
06c1572
implement managing mappings
n1ru4l
committed
94e1143
implement delete
n1ru4l
committed
35bb050
these are missing lol
n1ru4l
committed
4319678
feat: some more wip; display groups for user and use groups for authz
n1ru4l
committed
bf819eb
scimming?
n1ru4l
committed
33cc90a
cpu time revolution
n1ru4l
committed
62d0f23
damnnnn
n1ru4l
committed
cbda5f9
typo
n1ru4l
committed
1620a3a
groups innit
n1ru4l
committed
dab8c79
fix dem types
n1ru4l
committed
d908a7e
some types
n1ru4l
committed
6a83a8a
some lint
n1ru4l
committed
1975b3f
a bit more safety wont hurt
n1ru4l
committed
65a01ca
oidc integration resolution and todo comments
n1ru4l
committed
0e30318
more todos
n1ru4l
committed
7875993
wire up plugin
n1ru4l
committed
e56502c
not proud of it but
n1ru4l
committed
e734815
more
n1ru4l
committed
348dbc6
finally some tests
n1ru4l
committed
3aec497
more context
n1ru4l
committed
42f4ab3
wip
n1ru4l
committed
909f1e4
update external id
n1ru4l
committed
2dd6ab7
patch
n1ru4l
committed
f1e10fc
:)
n1ru4l
committed
eedfe7d
move things around
n1ru4l
committed
7429a7a
no escape needed
n1ru4l
committed
cb04518
sum cleanup
n1ru4l
committed
fa13280
more tests
n1ru4l
committed
5c83520
run some more things in a transaction
n1ru4l
committed
938e57d
the most basic rate limiting
n1ru4l
committed
6fd121d
offset-based pagination 久しぶり！
n1ru4l
committed
46b40a3
tests and fixes for get pagination!
n1ru4l
committed
e75de51
path validation
n1ru4l
committed
b065248
run these in a transaction just in case
n1ru4l
committed
fa85dbd
take over existing oidc account if the sub/externalId is shared
n1ru4l
committed
1983fd2
support setting custom id claim mapping
n1ru4l
committed
4759d51
no soft delete groups for now
n1ru4l
committed
5e1680e
facepalm
n1ru4l
committed
74a4002
feat: restrict SCIM provisioning to only domains verified with the organizationand add a flag to enforce login through oidc
n1ru4l
committed
8cc67df
feat: control "userProvisioningRequired" and "oidcForVerifiedDomainsRequired" flags via the GraphQL API; implement guard for "oidcForVerifiedDomainsRequired" when another oidc integration attempts …
n1ru4l
committed
88115b0
feat: only update supertokens user attributes if not provisioned
n1ru4l
committed
39712c0
add future note
n1ru4l
committed
9c492ab
feat: ensure that a organization admin can still sign in when oidc login is enforced
n1ru4l
committed
fa0e80d
fix typescript interference
n1ru4l
committed
865a409
enable feature for integration tests
n1ru4l
committed
7c1e5e3
satisfy the linter
n1ru4l
committed
15f529a
add basic crud tests for GraphQL fields "Organization.group", "Organization.groups" and "Mutation.addGroupMappingToGroup"
n1ru4l
committed
3fc25a6
cover "Mutation.Mutation.removeGroupMapping" and "Mutation.updateGroupMapping" with tests
n1ru4l
committed
be15143
use correct sign-in url
n1ru4l
committed
94015e6
the situation is a bit messy due to all the things that happen within Storage.ensureUserExists. This change should resolve the situation for now and makes the test for auto-updating the oidc provid…
n1ru4l
committed
e81f5e7
remove old input parameter
n1ru4l
committed
9467ba7
store record creation date on new tables and introduce stable sort for role assignments to avoid test flakiness
n1ru4l
committed
5ebd5b1
use relative imports to address lint issue
n1ru4l
committed
ab8fffc
add assertion just to be sure
n1ru4l
committed
fd1ed8d
add tests to ensure provisioned user use groups for resolving permissions and a disabled user is not able to log in
n1ru4l
committed
f13479c
use the scim endpoints for the disable and infer group assignment tests
n1ru4l
committed
d2b3831
one import
n1ru4l
committed
4efedec
run patch operation updates as single batch according to RFC 7644 paragraph 3.5.2
n1ru4l
committed
e276162
store updated_at value for groups and users and expose it via the required scim meta attributes
n1ru4l
committed
1f500c7
fix "totalResults" returning the total amount of rows (RFC 7644 3.4.2)
n1ru4l
committed
d0311f8
format the code
n1ru4l
committed
e581303
include groups property in Users resource to conform with strict SCIM provider requirements
n1ru4l
committed
3570893
add scim testkit
n1ru4l
committed
9075ad4
use provisioned user deactivation state and group memberships for resolving effective permissions and resources for personal access tokens
n1ru4l
committed
4b3c94b
add support for previding user list during group creation via SCIM API
n1ru4l
committed
b473167
use shared helper for performing "createPersonalAccessToken" mutation
n1ru4l
committed
98f765d
adjust whoami command implementation being able to show group role assignment permissions
n1ru4l
committed
86256f7
add skeleton loader and empty state for group list overview
n1ru4l
committed
7f3f1b9
remove non-existing classes and fix typo message
n1ru4l
committed
0857f83
add script for seeding scim users and groups
n1ru4l
committed
82aa6c2
add new badge component
n1ru4l
committed
a48296f
improve string perf
n1ru4l
committed
ce24043
refine styles of organization member list. Display groups and disabled state and make it obvious if a user was provisioned via SCIM
n1ru4l
committed
6cfa915
add missing seed script
n1ru4l
committed
cf44685
implement group filtering
n1ru4l
committed
d543dcb
use groups table look for members
n1ru4l
committed
e2f8b7c
fix pluralization
n1ru4l
committed
65ad179
improve group page styles by using new badge component
n1ru4l
committed
892bb4d
fix eslint issues
n1ru4l
committed
549e3e6
rename page
n1ru4l
committed
d96a879
disallow updating user properties via `User.updateMe` mutation of the user was provisioned via SCIM
n1ru4l
committed
955e7cb
disallow provisioned users creating organizations
n1ru4l
committed
e255d4e
prevent user from leaving the organization
n1ru4l
committed
60975b6
prevent provisioned user being removed from organization
n1ru4l
committed
0f70a9a
run all tests
n1ru4l
committed
a94f13a
restrict direct assignment of a role/group to a provisioned user
n1ru4l
committed
070403a
prevent provisioned users from joining another organization
n1ru4l
committed
74262c7
prevent organization ownership transfer to a provisioned user
n1ru4l
committed
5e657a6
prevent account linking to provisioned account
n1ru4l
committed
af46fa9
sync db types
n1ru4l
committed
6e01d28
support button variants for alert dialog action
n1ru4l
committed
de5a8e0
fix destructive state of delete role assignment confirm button
n1ru4l
committed
0fe6f00
allow managing the user id claim from the organization oidc settings
n1ru4l
committed
175b8df
small ui tweaks
n1ru4l
committed
bb9b395
entra id adjustments
n1ru4l
committed
579f6e8
refactor test cases to use testkit
n1ru4l
committed
df5f745
move `UpdateOIDCIntegrationInput.userProvisioningRequired` and `UpdateOIDCIntegrationInput.oidcForVerifiedDomainsRequired` fields from `UpdateOIDCIntegrationInput` to ` UpdateOIDCRestrictionsInput`
n1ru4l
committed
98211c0
implement ui for enforcing login through the oidc provider and enforcing scim provisioning
n1ru4l
committed
5186895
remove unused vars
n1ru4l
committed
b4c3d7a
prevent assigning a member role form a different organization to a role
n1ru4l
committed
0cdc5b6
ensure the correct content type is used
n1ru4l
committed
e63f067
support `excludeAttributes=members` for the `GET /Groups/:id` endpoint.
n1ru4l
committed
6752979
correctly handle patch user operation with mixed filtered email update
n1ru4l
committed
75bcf4c
ensure that batched user additions and removals are applied in sequence; make user and group lookup via secondary attributes case insensitive
n1ru4l
committed
20fb345
i dont want to cd into integreation-tests anymore
n1ru4l
committed
80dca31
ensure operations are atomic
n1ru4l
committed
0766c6e
remove unused method
n1ru4l
committed
0c01d13
fix tests
n1ru4l
committed
94a68b9
add audit log
n1ru4l
committed
7464cc7
introduce dedicated permission `scim:provision` for all scim operations
n1ru4l
committed
d6549a5
fix clickhouse import
n1ru4l
committed
d536587
pass null in case no user id claim is set
n1ru4l
committed
0f33300
expose scim endpoint via deployment config
n1ru4l
committed
06695b2
do not include the user id claim as a requested scope
n1ru4l
committed
f37a2db
:facepalm: of shame
n1ru4l
committed
74c15c0
add index for invalidating supertoken sessions
n1ru4l
committed
864b6ff
cleanup code
n1ru4l
committed
1e61535
improve class name
n1ru4l
committed
79f415f
remove codegen comments
n1ru4l
committed
e6cdfa6
no trpc
n1ru4l
committed
648b610
oops
n1ru4l
committed
ff88321
fix imports
n1ru4l
committed
ff233fb
scim opt-in via feature flag
n1ru4l
committed
61a968f

Uh oh!

Commits

Commits on Aug 3, 2026