scimgateway 4.1.3 → 4.1.4

package/README.md

@@ -1142,6 +1142,12 @@ MIT © [Jarle Elshaug](https://www.elshaug.xyz)
 
 ## Change log  
 
+### v4.1.4  
+[Fixed] 
+
+- TypeConvert logic for multivalue attribute `addresses` did not correctly catch duplicate entries  
+- PUT (Replace User) configuration `scim.usePutSoftsync=true` will also prevent removing any existing roles that are not included in body.roles ref. v4.1.3
+
 ### v4.1.3  
 [Fixed] 
 

package/lib/plugin-loki.js

@@ -272,7 +272,7 @@ scimgateway.modifyUser = async (baseEntity, id, attrObj) => {
         } else { // add
           if (!userObj[key]) userObj[key] = []
           let exists
-          if (el.value) exists = userObj[key].find(e => e.value && e.value === el.value)
+          if (el.value) exists = userObj[key].find(e => e.value && e.value === el.value && e.type === el.type) // allowing same value on different type (type not mandatory)
           if (!exists) userObj[key].push(el)
         }
       })

package/lib/plugin-mongodb.js

@@ -355,7 +355,7 @@ scimgateway.modifyUser = async (baseEntity, id, attrObj) => {
         } else { // add
           if (!userObj[key]) userObj[key] = []
           let exists
-          if (el.value) exists = userObj[key].find(e => e.value && e.value === el.value)
+          if (el.value) exists = userObj[key].find(e => e.value && e.value === el.value && e.type === el.type) // allowing same value on different type (type not mandatory)
           if (!exists) userObj[key].push(el)
         }
       })

package/lib/scimgateway.js

@@ -1209,7 +1209,7 @@ const ScimGateway = function () {
     } else {
       logger.debug(`${gwName}[${pluginName}] [Modify ${handle.description}] id=${id}`)
       let scimdata, err
-      if (jsonBody.Operations) [scimdata, err] = convertedScim20(jsonBody) // v2.0
+      if (jsonBody.Operations) [scimdata, err] = ScimGateway.prototype.convertedScim20(jsonBody) // v2.0
       else [scimdata, err] = ScimGateway.prototype.convertedScim(jsonBody) // v1.1
       logger.debug(`${gwName}[${pluginName}] convertedBody=${JSON.stringify(scimdata)}`)
       if (err) {
@@ -1259,10 +1259,6 @@ const ScimGateway = function () {
   // ==========================================
   router.put([`/(|scim/)(!${undefined}|Users|Groups|servicePlans)/:id`,
   `/:baseEntity/(|scim/)(!${undefined}|Users|Groups|servicePlans)/:id`], async (ctx) => {
-    await replaceUsrGrp(ctx)
-  })
-
-  const replaceUsrGrp = async (ctx, isExtCaller) => {
     let u = ctx.originalUrl.substr(0, ctx.originalUrl.lastIndexOf('/'))
     u = u.substr(u.lastIndexOf('/') + 1) // u = Users, Groups
     const handle = handler[u]
@@ -1275,7 +1271,6 @@ const ScimGateway = function () {
       err = jsonErr(config.scim.version, pluginName, ctx.status, err)
       ctx.body = err
     } else {
-      if (!isExtCaller) logger.debug(`${gwName}[${pluginName}] [Replace ${handle.description}] id=${id}`)
       logger.debug(`${gwName}[${pluginName}] PUT ${ctx.originalUrl} body=${strBody}`)
       try {
         // get current object
@@ -1293,6 +1288,18 @@ const ScimGateway = function () {
         delete clearedObj.password
         delete clearedObj.meta
 
+        // usePutSoftSync=true prevents removing existing roles (only add roles)
+        if (config.scim.usePutSoftSync) {
+          if (clearedObj.roles && Array.isArray(clearedObj.roles)) {
+            for (let i = 0; i < clearedObj.roles.length; i++) {
+              if (clearedObj.roles[i].operation && clearedObj.roles[i].operation === 'delete') {
+                clearedObj.roles.splice(i, 1) // delete
+                i -= 1
+              }
+            }
+          }
+        }
+
         // merge cleared object with the new
         const newObj = utils.extendObj(clearedObj, jsonBody)
         delete newObj.id
@@ -1368,7 +1375,7 @@ const ScimGateway = function () {
           }
 
           let errRemove
-          if (!config.scim.usePutSoftSync) { // default will remove any existing groups not included, usePutSoftSync=true prevents removing groups (only add groups)
+          if (!config.scim.usePutSoftSync) { // default will remove any existing groups not included, usePutSoftSync=true prevents removing existing groups (only add groups)
             await Promise.all(removeGrps.map((grp) => removeGroups(grp)))
               .then()
               .catch((err) => {
@@ -1433,8 +1440,7 @@ const ScimGateway = function () {
         ctx.body = e
       }
     }
-  }
-  this.replaceUsrGrp = replaceUsrGrp // exposed
+  })
 
   // ==========================================
   //           API POST (no SCIM)
@@ -1807,13 +1813,27 @@ const ScimGateway = function () {
             }
           })
         } else if (multiValueTypes.includes(key)) { // "type converted object" // groups, roles, member and scim.excludeTypeConvert are not included
+          const tmpAddr = []
           scimdata[key].forEach(function (element, index) {
             if (!element.type) element.type = 'undefined' // "none-type"
             if (element.operation && element.operation === 'delete') { // add as delete if same type not included as none delete
               const arr = scimdata[key].filter(obj => obj.type && obj.type === element.type && !obj.operation)
               if (arr.length < 1) {
                 if (!newMulti[key]) newMulti[key] = {}
-                if (newMulti[key][element.type]) err = new Error(`'type converted object' ${key} - includes more than one element having same type, or type is blank on more than one element - note, setting configuration scim.skipTypeConvert=true will disable this logic/check`)
+                if (newMulti[key][element.type]) {
+                  if (['addresses'].includes(key)) { // not checking type, but the others have to be unique
+                    for (const i in element) {
+                      if (i !== 'type') {
+                        if (tmpAddr.includes(i)) {
+                          err = new Error(`'type converted object' ${key} - includes more than one element having same ${i}, or ${i} is blank on more than one element - note, setting configuration scim.skipTypeConvert=true will disable this logic/check`)
+                        }
+                        tmpAddr.push(i)
+                      }
+                    }
+                  } else {
+                    err = new Error(`'type converted object' ${key} - includes more than one element having same type, or type is blank on more than one element - note, setting configuration scim.skipTypeConvert=true will disable this logic/check`)
+                  }
+                }
                 newMulti[key][element.type] = {}
                 for (const i in element) {
                   newMulti[key][element.type][i] = element[i]
@@ -1822,7 +1842,20 @@ const ScimGateway = function () {
               }
             } else {
               if (!newMulti[key]) newMulti[key] = {}
-              if (newMulti[key][element.type]) err = new Error(`'type converted object' ${key} - includes more than one element having same type, or type is blank on more than one element - note, setting configuration scim.skipTypeConvert=true will disable this logic/check`)
+              if (newMulti[key][element.type]) {
+                if (['addresses'].includes(key)) { // not checking type, but the others have to be unique
+                  for (const i in element) {
+                    if (i !== 'type') {
+                      if (tmpAddr.includes(i)) {
+                        err = new Error(`'type converted object' ${key} - includes more than one element having same ${i}, or ${i} is blank on more than one element - note, setting configuration scim.skipTypeConvert=true will disable this logic/check`)
+                      }
+                      tmpAddr.push(i)
+                    }
+                  }
+                } else {
+                  err = new Error(`'type converted object' ${key} - includes more than one element having same type, or type is blank on more than one element - note, setting configuration scim.skipTypeConvert=true will disable this logic/check`)
+                }
+              }
               newMulti[key][element.type] = {}
               for (const i in element) {
                 newMulti[key][element.type][i] = element[i]
@@ -2494,7 +2527,7 @@ const notValidAttributes = (obj, validScimAttr) => {
 // "type converted object" and blank deleted values
 // {"name":{"givenName":"Rocky",formatted:""},"emails":{"work":{"value":"user@company.com","type":"work"}}}
 //
-const convertedScim20 = (obj) => {
+ScimGateway.prototype.convertedScim20 = function convertedScim20 (obj) {
   let scimdata = {}
   if (!obj.Operations || !Array.isArray(obj.Operations)) return scimdata
   const o = utils.copyObj(obj)
@@ -2681,7 +2714,7 @@ const convertedScim20 = (obj) => {
 // clearObjectValues returns a new object having values set to blank
 // array values are kept, but includes {"operation" : "delete"} - scim 1.1 formatted
 // boolean values e.g. {"active" : true} are kept "as is"
-// parent only used for internal recursive logic
+// parent used for internal recursive logic
 const clearObjectValues = (o, parent) => {
   if (!o) return {}
   let v, key
@@ -2689,18 +2722,14 @@ const clearObjectValues = (o, parent) => {
   for (key in o) {
     v = o[key]
     if (typeof v === 'object' && v !== null) {
-      const objProp = Object.getPrototypeOf(v) // e.g. HttpsProxyAgent {}
+      const objProp = Object.getPrototypeOf(v)
       if (objProp !== null && objProp !== Object.getPrototypeOf({}) && objProp !== Object.getPrototypeOf([])) {
-        output[key] = Object.assign(Object.create(v), v) // e.g. { HttpsProxyAgent {...} }
+        output[key] = Object.assign(Object.create(v), v)
       } else {
         output[key] = clearObjectValues(v, key)
       }
-    } else if (key === 'type') {
-      output[key] = v
-      output.operation = 'delete'
-      if (output.value) output.value = ''
     } else {
-      if (parent && !isNaN(parent) && key === 'value') { // array
+      if (parent && !isNaN(parent)) { // array
         output.operation = 'delete'
         output[key] = v
       } else {

package/lib/utils.js

@@ -373,20 +373,3 @@ module.exports.getEncrypted = function (pw, seed) {
   }
   return undefined
 }
-
-// aadUnExtUpn convert Azure AD guest UPN to origin target UPN
-// john.doe_company.com#EXT#@company.onmicrosoft.com => john.doe@company.com
-module.exports.aadUnExtUpn = function (upn) {
-  const arr = upn.split('#EXT#')
-  if (arr.length === 1) return arr[0]
-  const extArr = arr[0].split('_')
-  if (extArr.length === 1) return extArr[0]
-  else {
-    upn = extArr[0]
-    for (let i = 1; i < extArr.length - 1; i++) {
-      upn += `_${extArr[i]}`
-    }
-    upn += `@${extArr[extArr.length - 1]}`
-  }
-  return upn
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scimgateway",
-  "version": "4.1.3",
+  "version": "4.1.4",
   "description": "Using SCIM protocol as a gateway for user provisioning to other endpoints",
   "author": "Jarle Elshaug <jarle.elshaug@gmail.com> (https://elshaug.xyz)",
   "homepage": "https://elshaug.xyz",