Skip to content

Refactor & fully implement SCIM 2.0 specification #15830

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
Emyrk opened this issue Dec 11, 2024 · 2 comments
Open

Refactor & fully implement SCIM 2.0 specification #15830

Emyrk opened this issue Dec 11, 2024 · 2 comments
Labels
api Area: HTTP API customer-requested Features requested by enterprise customers. Only humans may set this. s2 Broken use cases or features (with a workaround). Only humans may set this.

Comments

@Emyrk
Copy link
Member

Emyrk commented Dec 11, 2024

Coder supports SCIM as a premium feature: https://coder.com/docs/admin/users/oidc-auth#scim-enterprise-premium

The goal of SCIM is to push user updates from an IdP into Coder. This allows Coder to stay in sync with the IdP without requiring the user to log in with claims.

The current implementation was implemented to a MVP state, specifically to work with Okta cloud. Over time, as more customers try and use SCIM, it is clear the MVP implementation is insufficient, and fragile.

Fragility concerns:

  • We do not parse the schema types from requests, so we accept 1.0, 1.1, and 2.0 requests, all which look different. Because of how Golang JSON unmarshals, these errors could be silent, and cause unexpected behavior.
  • Our PATCH endpoint is not 2.0 compliant. Given this works with Okta cloud, either Okta cloud is sending 1.0 request payloads, or using the PUT endpoint request in the PATCH payload?!
  • Our user updates only support changing the user status. Not groups, orgs, or roles.

This refactor should implement SCIM as a library if possible, and implement the protocol specification as defined here: https://datatracker.ietf.org/doc/html/rfc7644
@Emyrk Emyrk added the customer-requested Features requested by enterprise customers. Only humans may set this. label Dec 11, 2024
@bpmct
Copy link
Member

bpmct commented Dec 17, 2024 •
edited
Loading

It seems like many SCIM 2.0 providers are working with Coder and our documentation claims to be SCIM 2.0 compatible.

Suggested course of action:

  • Review how GitHub, GitLab, and Sourcegraph handle SCIM
  • Continue audit how Coder's SCIM works and doesn't work, starting from this issue
  • Expand our docs to reflect the current behavior with more detail
  • Audit "open" customer requests around SCIM
  • Make enhancements to get clearer/closer parity

Given many providers do not support all SCIM 2.0 features, I think we should bias towards clarity versus parity/compliance in the first pass. Better to communicate current state and reduce confusion before undergoing a larger refactor. Bringing this into our first sprint next year.

@bpmct bpmct added docs Area: coder.com/docs api Area: HTTP API s2 Broken use cases or features (with a workaround). Only humans may set this. labels Dec 17, 2024
@bpmct
Copy link
Member

bpmct commented Jan 2, 2025

Not sure if we have capacity for this in this sprint, but want to reiterate that "p1" (which can be extracted to a smaller issue) is ensuring our docs reflect the current behavior and documenting any edge cases and workarounds that may impact users.

Then p2 is finding ways for us to have clearer support for the spec, by referencing what other vendors do to support this.

@EdwardAngert EdwardAngert removed the docs Area: coder.com/docs label Mar 19, 2025
@Jphalan Jphalan mentioned this issue May 1, 2025
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
api Area: HTTP API customer-requested Features requested by enterprise customers. Only humans may set this. s2 Broken use cases or features (with a workaround). Only humans may set this.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@Emyrk @EdwardAngert @bpmct