goauthentik / goauthentik/authentik
SCIM schema and feature flexiblility
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 651
Description
**Is your feature request related to a problem? Please describe.**
For the last few days, I feel like I'm just submitting "please help work around Bitwarden's SCIM weirdness" requests :)
See: https://github.com/bitwarden/server/issues/2919
**Describe the solution you'd like**
I've been running patched versions of Authentik to test "fixes" to this and various other BW SCIM oddities:
1) An option to specify SCIM metadata manually in SCIM provider configuration, for those servers that do support additional things (such as PATCH) but do not properly publish metadata at their SCIM endpoint?
2) The ability to add data keys to SCIM that aren't specified in the official schema, e.g. group "organizationId" for Bitwarden. I've defined this in our SCIM maps, but I believe it's getting filtered out in to_scim when it goes through schema validation.
3) (Longest shot and probably worst idea, which is saying something given how bad all these ideas are) Some way to _really_ mess with SCIM calls, e.g. set headers such as User-Agent.
**Describe alternatives you've considered**
Not working around providers that are variously not SCIM-standard (I think?).
Contributor guide
Research direction
Start by reviewing the current SCIM provider configuration, SCIM maps, schema validation, and the to_scim path mentioned in the issue. Before implementation, clarify which of the three proposals are in scope and define how manually supplied metadata, nonstandard data keys, and custom headers should behave.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, authorization
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100