From 6f9030ee3c2059dc82673cf7f9ac2d485391d351 Mon Sep 17 00:00:00 2001 From: Victor Lyuboslavsky Date: Thu, 8 May 2025 13:02:49 -0500 Subject: [PATCH] SCIM Entra ID support (#28832) For #28196 This PR adds full patching for SCIM Users and Groups, and adds the ability to filter Groups by displayName. The changes have been tested with [Entra ID SCIM Validator](https://github.com/fleetdm/fleet/blob/67dfd91c0cfb1546177ad533d02ee94eb199c3eb/docs/Contributing/SCIM-integration.md#entra-id-integration) and Okta SCIM 2.0 SPEC Test (to make sure we didn't break Okta). # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [x] Added/updated automated tests - [x] A detailed QA plan exists on the associated ticket (if it isn't there, work with the product group's QA engineer to add it) - [x] Manual QA for all new/changed functionality --- changes/28196-SCIM-for-Entra-ID | 1 + docs/Contributing/SCIM-integration.md | 10 +- ...IM-Entra-ID-Validator-Group-attributes.png | Bin 0 -> 28169 bytes ...CIM-Entra-ID-Validator-User-attributes.png | Bin 0 -> 56948 bytes .../SCIM-Entra-ID-Validator-results.png | Bin 0 -> 262992 bytes ee/server/integrationtest/scim/scim_test.go | 1564 ++++++++++++++++- ee/server/scim/groups.go | 338 +++- ee/server/scim/scim.go | 10 +- ee/server/scim/users.go | 346 ++-- server/datastore/mysql/scim.go | 143 +- server/datastore/mysql/scim_test.go | 275 ++- server/fleet/datastore.go | 5 +- server/fleet/scim.go | 29 + server/mock/datastore_mock.go | 16 +- 14 files changed, 2522 insertions(+), 215 deletions(-) create mode 100644 changes/28196-SCIM-for-Entra-ID create mode 100644 docs/Contributing/assets/SCIM-Entra-ID-Validator-Group-attributes.png create mode 100644 docs/Contributing/assets/SCIM-Entra-ID-Validator-User-attributes.png create mode 100644 docs/Contributing/assets/SCIM-Entra-ID-Validator-results.png diff --git a/changes/28196-SCIM-for-Entra-ID b/changes/28196-SCIM-for-Entra-ID new file mode 100644 index 0000000000..63f5590cef --- /dev/null +++ b/changes/28196-SCIM-for-Entra-ID @@ -0,0 +1 @@ +Added ability to sync end user's IdP information with Microsoft Entra ID using SCIM protocol. diff --git a/docs/Contributing/SCIM-integration.md b/docs/Contributing/SCIM-integration.md index 48c4994307..6f1d14a7b0 100644 --- a/docs/Contributing/SCIM-integration.md +++ b/docs/Contributing/SCIM-integration.md @@ -51,12 +51,20 @@ Run test using [Runscope](https://www.runscope.com/). See [instructions](https:/ ### Testing Entra ID integration -Use [scimvalidator.microsoft.com](https://scimvalidator.microsoft.com/). Only test the attributes that we have implemented. To see our supported attributes, check the schema: +Use [scimvalidator.microsoft.com](https://scimvalidator.microsoft.com/). Only test the attributes that we have implemented. +![SCIM-Entra-ID-Validator-User-attributes.png](assets/SCIM-Entra-ID-Validator-User-attributes.png) +![SCIM-Entra-ID-Validator-Group-attributes.png](assets/SCIM-Entra-ID-Validator-Group-attributes.png) + +To see our supported attributes, check the schema: ``` GET https://localhost:8080/api/latest/fleet/scim/Schemas ``` +Results (2025/05/06) + +![SCIM-Entra-ID-Validator-results.png](assets/SCIM-Entra-ID-Validator-results.png) + ## Authentication We use same authentication as API. HTTP header: `Authorization: Bearer xyz` diff --git a/docs/Contributing/assets/SCIM-Entra-ID-Validator-Group-attributes.png b/docs/Contributing/assets/SCIM-Entra-ID-Validator-Group-attributes.png new file mode 100644 index 0000000000000000000000000000000000000000..a0a52a790b0d9511c070b132e9c1d3e806c23649 GIT binary patch literal 28169 zcmdSBWmp_b7cPpshTzU18xQX85G=Uc;O=h0JxG9{!AWok?!g9k2<|$#4bGjtzi*#& z{@fqu%JbY?KYF@ny1S~nR;^m=ec$OAH5EBbG!irz7#K_idFf9uFz`#z{VfzE=yui9 zs~HByaY{j2Let0iq!ZCYYq;sXGWLr?4P2t1N{g^ zfZ(8@BA|qa`@mJ!>j4+z)f4+xqF5kUh`p-!?lF=F8LG=F~bRfv^{`Yd6ZMwheQU5()mq=Fr_f|fr zu@3*%(yycj{2x^sfBrwK;vx&w6(pjTUZu;NoUERgotE1U89D1j7S^%m|4kv9c9-in z{D^7bDL_vzt6go(&Ijl0ccSoV=V-Rf?eMqJx7w}G@p}F$3lx}X{#$i3_Py31f`6#H?MF3K1R8`kBdM(weAQwFGkaY=cVx;}$W*)@(2~-$EqMvytxQ zTM1m&90L_s+wf^*6t%x7XjmV)$%Durgx%R@eKt<&4n|$C=7@=T-8!UYOIE*KHsKKv zGvpqSWsFrVDlGN37cYYXQ_4o^8K(l{90VzLTb~TZ_cl?8J0B~hr5RePHhizr$JShB z@`MAAn?&iFaxu~+MVdw)dZOAoUjHaRG`;wtCS0hL^yJBx+xKcWCO)5E+3Rfiph=XTUON(tk|Bsebp>2l zSXiRDWH;0PrZ$xK&*0M*ZSo{{`kl%?j71OkWHX`{{Ny23JbfG&(J5o5DWaiszk9BC z7$9lB4GrbnGocIy$R$#E8|0Iqq7D}xP2{#;-8LfvUt}{ZpS1K^{lWqsJSk#)-fy)Y zRUHhcmd$t#sxwYG#*uaT=)8NEfA}bbZBcvxXEHovm3wc9b<2NzYB{-tGrZu`xtbL1 zZXg!0r}slRAZexTSG1~plYS9k`-v@kw-<08eX^g5tpq-j6Vd6u?J+3yd~!HkUE!^p8i?yx3(0|y{4B5>ya2?>*&Rm2Z7ZI5};rf8mqhDNe-H=X%NgAH@qd;C*Rga~Q$R;p7i7*US; zhg6Gye_5Mx`7LpsXtWJ{nHCrDJId2{^`C%zEqQ`Jd2tqrPKTZ?pDz={X}KfQO0fOP zmS}?dbq^Wt#62{#Wr)-HK&#b_*)W4rx_{)vF=M_h=;GOkxNSQ=Ue{Chxmu()Ng)oM zk8-3qfw1^oQtVsPUJ61KeLM9z7hL<^9N@~bqH)IgQbF(6kjcQ+@3q%YR+}orE1nG) zT#GAyzqRt<&Si(6jdbQEMXZOkjyTT4!{r8)E?#UJ0%Rx#S_HkQ>aV|9oQDsTYx(!2 zXzWw4job<)-!=Anb(=1oY!Sm`JnQZIN{zp{UM5-YFDUs@mLQ*`)!9!BC&vx%U0?2$ z)nCuC5_g>Z!Z7h26rLm>`exWa$Z#xzp%o}lq6nt|S z;azQGEiAJ5_|l*~x&Sq^frIe;PR!ed=xMy&9d>v5VNR{v^U;i&k=vf^nX)%E-}BVU zPfed#iFv&05fC?KEC|?*7?H8ar@N;a`2rV&TaPKJ*5Zf2LzxK>TO+?%rMuO5gSN$?dJI$`tn}eJu$* zSpQUOL;TRC#@KqqAGAM-zFWlJ^_3IfP9bcticaYc?$ZxH`1aoDz-~~AfsrWsi<-*M z1-qO0isk{j*~9VN?(p3a9m8esW5!#Orj#VnNwzrUFnq%nA3eJT$DagX^AaXScR=MO z%TVIeap&80*x086J0n2<(@3X(!8?3%R)MScT5&pC+j}K$2}pwbWVtXn^ElTqG*1Q% zCbIt zALTV#?eEVn&d2R<96Z5O80aB158v?x7@A!o-42m|`Pm1NZ^ZR4*)M^AM+!Qx|fv60T%J^rPzKzxbCh8!{4OwL=5 zPY&08Jvmg8*SgQ=xH!xi^<6baE6Pd!?hahCaQMP>!<@Af2U&88dufz|D|syMOlch# zv^DF$`_p*fL3V2cu!_4|rxy@%)I`5Z39JT-ryX!Z;LMDjE}U$+b~0m6;1A9~i~D2} z3UEOUxO={W&M8=2Nk{%if(PMge2WwIc^e0c^&m%~>vHa_!}V$RSJ_OUZKw7`)|