Documentation
¶
Overview ¶
Package store provides SCIM Store implementations.
Index ¶
- type Config
- type EntStore
- func (s *EntStore) AddMemberToGroup(ctx context.Context, groupID, userID string) error
- func (s *EntStore) CreateGroup(ctx context.Context, scimGroup *scim.Group) (*scim.Group, error)
- func (s *EntStore) CreateUser(ctx context.Context, scimUser *scim.User) (*scim.User, error)
- func (s *EntStore) DeleteGroup(ctx context.Context, id string) error
- func (s *EntStore) DeleteUser(ctx context.Context, id string) error
- func (s *EntStore) GetGroupByDisplayName(ctx context.Context, displayName string) (*scim.Group, error)
- func (s *EntStore) GetGroupByExternalID(ctx context.Context, externalID string) (*scim.Group, error)
- func (s *EntStore) GetGroupByID(ctx context.Context, id string) (*scim.Group, error)
- func (s *EntStore) GetGroupsForUser(ctx context.Context, userID string) ([]scim.GroupRef, error)
- func (s *EntStore) GetMembersForGroup(ctx context.Context, groupID string) ([]scim.MemberRef, error)
- func (s *EntStore) GetUserByExternalID(ctx context.Context, externalID string) (*scim.User, error)
- func (s *EntStore) GetUserByID(ctx context.Context, id string) (*scim.User, error)
- func (s *EntStore) GetUserByUserName(ctx context.Context, userName string) (*scim.User, error)
- func (s *EntStore) ListGroups(ctx context.Context, opts scim.ListOptions) ([]*scim.Group, int, error)
- func (s *EntStore) ListUsers(ctx context.Context, opts scim.ListOptions) ([]*scim.User, int, error)
- func (s *EntStore) RemoveMemberFromGroup(ctx context.Context, groupID, userID string) error
- func (s *EntStore) UpdateGroup(ctx context.Context, id string, scimGroup *scim.Group) (*scim.Group, error)
- func (s *EntStore) UpdateUser(ctx context.Context, id string, scimUser *scim.User) (*scim.User, error)
- type Memberships
- type Principals
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
// BaseURL is the base URL for SCIM resources.
BaseURL string
// DefaultRole is the default role for new group members.
DefaultRole string
// TrustProvisionedEmail marks emails written through SCIM as verified.
// Enable it only when the identity provider is trusted to assert email
// ownership: a verified email lets a later social login with the same
// address link to the provisioned user automatically. When false (the
// default), provisioned and changed emails are unverified, and social
// login refuses to link rather than creating a second identity.
TrustProvisionedEmail bool
// Memberships adds, changes and removes organization memberships for
// SCIM, with their side effects: authorization-graph sync, access-change
// records, and cleanup of application roles and resource grants. Pass
// the application's organization service so the graph sync uses its
// syncer. Default: organization.NewService on the store's client, which
// records access changes but syncs no authorization graph.
Memberships Memberships
// Principals deactivates and reactivates accounts, recording the access
// change that stops existing tokens being honored. Default:
// principal.NewService on the store's client.
Principals Principals
}
Config holds configuration for the Ent store.
func DefaultConfig ¶
func DefaultConfig() *Config
DefaultConfig returns the default store configuration.
type EntStore ¶
type EntStore struct {
// contains filtered or unexported fields
}
EntStore implements the scim.Store interface using Ent ORM.
func NewEntStore ¶
NewEntStore creates a new Ent-backed SCIM store.
func (*EntStore) AddMemberToGroup ¶
AddMemberToGroup adds a user to a group. Adding an existing member is a no-op; re-adding a deactivated member restores the membership with the default role. A tenant may add only users it already sees: members of its organization, active or not.
func (*EntStore) CreateGroup ¶
CreateGroup creates a new group. Only a platform scope may create groups.
func (*EntStore) CreateUser ¶
CreateUser creates a new user as a human principal. For a tenant, the user also becomes a member of the tenant's organization, and the tenant is recorded as having provisioned it. A user who already exists elsewhere is linked by adding the membership; their identity is not changed.
The account is created first and the membership is added after through the membership service. If adding it fails, the request fails and the identity provider's retry finds the account by email and links it.
func (*EntStore) DeleteGroup ¶
DeleteGroup deletes a group. Only a platform scope may delete groups.
func (*EntStore) DeleteUser ¶
DeleteUser deletes a user. For a tenant, a user the tenant does not own only loses the membership in the tenant's organization. Otherwise every membership is removed through the membership service, the account is deactivated so existing tokens stop being honored, and the account and the records that belong only to it are deleted. An organization owner is never deleted through SCIM.
func (*EntStore) GetGroupByDisplayName ¶
func (s *EntStore) GetGroupByDisplayName(ctx context.Context, displayName string) (*scim.Group, error)
GetGroupByDisplayName retrieves a group by displayName.
func (*EntStore) GetGroupByExternalID ¶
func (s *EntStore) GetGroupByExternalID(ctx context.Context, externalID string) (*scim.Group, error)
GetGroupByExternalID retrieves a group by externalId (the organization slug).
func (*EntStore) GetGroupByID ¶
GetGroupByID retrieves a group by SCIM ID.
func (*EntStore) GetGroupsForUser ¶
GetGroupsForUser returns all groups a user belongs to. A tenant sees only its own organization.
func (*EntStore) GetMembersForGroup ¶
func (s *EntStore) GetMembersForGroup(ctx context.Context, groupID string) ([]scim.MemberRef, error)
GetMembersForGroup returns all human members of a group.
func (*EntStore) GetUserByExternalID ¶
GetUserByExternalID retrieves a user by externalId. SystemForge does not store externalId, so this always reports not found.
func (*EntStore) GetUserByID ¶
GetUserByID retrieves a user by SCIM ID.
func (*EntStore) GetUserByUserName ¶
GetUserByUserName retrieves a user by userName (email). userName is not case-exact (RFC 7643 section 4.1.1), so the match ignores case.
func (*EntStore) ListGroups ¶
func (s *EntStore) ListGroups(ctx context.Context, opts scim.ListOptions) ([]*scim.Group, int, error)
ListGroups lists groups with filtering and pagination.
func (*EntStore) RemoveMemberFromGroup ¶
RemoveMemberFromGroup removes a user from a group. An organization owner cannot be removed through SCIM.
func (*EntStore) UpdateGroup ¶
func (s *EntStore) UpdateGroup(ctx context.Context, id string, scimGroup *scim.Group) (*scim.Group, error)
UpdateGroup updates an existing group. A tenant may not rename its organization; an update that keeps the name is accepted so that member changes in the same request apply.
func (*EntStore) UpdateUser ¶
func (s *EntStore) UpdateUser(ctx context.Context, id string, scimUser *scim.User) (*scim.User, error)
UpdateUser updates an existing user. For a platform scope, active deactivates or reactivates the account. For a tenant, active suspends or restores the membership in the tenant's organization, and identity fields change only for users the tenant owns; for other users they are left as they are.
type Memberships ¶ added in v0.20.0
type Memberships interface {
AddMember(ctx context.Context, input orgsvc.AddMemberInput) (*orgsvc.Membership, error)
UpdateMember(ctx context.Context, membershipID uuid.UUID, input orgsvc.UpdateMemberInput) (*orgsvc.Membership, error)
RemoveMember(ctx context.Context, organizationID, principalID uuid.UUID) error
}
Memberships is the part of organization.Service the SCIM store uses.
Source Files