scim

Documentation

Overview

Package scim is a SCIM 2.0 provisioning server (Users + Groups) over an authx.DirectoryStore, so an upstream IdP (Okta, Entra/Azure AD, JumpCloud) can push and deprovision users and groups. It implements create / read / list / PATCH / PUT / delete, deprovision via PATCH active=false, filtered list (eq/ne/co/sw/ew/pr with and/or/not/parens composition), sorting (sortBy/sortOrder), ETags with If-Match / If-None-Match, the /Bulk endpoint, bearer-token auth, and the discovery endpoints. Filtering covers eq/ne/co/sw/ew/gt/ge/lt/le/pr with and/or/not composition, parentheses, and valuePath (emails[type eq "work"]). Mount it with StripPrefix:

mux.Handle("/scim/v2/", http.StripPrefix("/scim/v2", scim.NewServer(dir, auth).Handler()))

Index

• type Server
  • func NewServer(dir authx.DirectoryStore, auth func(token string) bool) *Server
  • func (s *Server) Handler() http.Handler
  • func (s *Server) SetBaseURL(u string)

Types

type Server

type Server struct {
	// contains filtered or unexported fields
}

Server is a SCIM 2.0 endpoint set backed by a directory.

func NewServer

func NewServer(dir authx.DirectoryStore, auth func(token string) bool) *Server

NewServer builds a SCIM server. auth validates the bearer token on every request; pass a scope-checking closure so only keys granted the "scim" scope may provision:

func(t string) bool { return authn.ValidateAPIKeyScope(t, "scim") }

(Prefer this over the scopeless ValidateAPIKey, which would admit any valid key regardless of scope.)

func (*Server) Handler

func (s *Server) Handler() http.Handler

Handler returns the SCIM routes (mount under /scim/v2 with http.StripPrefix).

func (*Server) SetBaseURL

func (s *Server) SetBaseURL(u string)

SetBaseURL sets the externally-visible SCIM root (e.g. "https://app.example.com/scim/v2") used to build the resource Location header + meta.location (RFC 7644 §3.1/§3.3). Optional — when unset, those fields are omitted.