scimgateway 4.1.8 → 4.1.10

package/README.md

@@ -206,6 +206,7 @@ Below shows an example of config\plugin-saphana.json
 	  "scimgateway": {
 	    "port": 8884,
 	    "localhostonly": false,
+        "payloadSize": null,
         "scim": {
           "version": "2.0",
           "customSchema": null,
@@ -307,6 +308,8 @@ Definitions in `endpoint` object are customized according to our plugin code. Pl
 
 - **localhostonly** - true or false. False means gateway accepts incoming requests from all clients. True means traffic from only localhost (127.0.0.1) is accepted (gateway must then be installed on the CA Connector Server).  
 
+- **payloadSize** - if not defined, default "1mb" will be used. There are cases which large groups could exceed default size and you may want to increase by setting your own size  
+
 - **scim.version** - "1.1" or "2.0". Default is "2.0". For Symantec/Broadcom/CA Identity Manager "1.1" should be used.  
 
 - **scim.customSchema** - filename of JSON file located in `<package-root>\config\schemas` containing custom schema attributes, see configuration notes 
@@ -1143,6 +1146,24 @@ MIT © [Jarle Elshaug](https://www.elshaug.xyz)
 
 ## Change log  
 
+### v4.1.10  
+
+[Added]  
+
+- new plugin configuration `payloadSize`. If not defined, default "1mb" will be used. There are cases which large groups could exceed default size and you may want to increase by setting your own size e.g. "5mb"  
+    **Thanks to Sam Murphy**
+
+[Fixed]  
+  
+- using `GET /Users`, scimgateway automatically adds groups if not included by plugin. This operation calls plugin getGroups having attributes=['members.value', 'id', 'displayName']. Now, `members.value` is excluded. This attribute was in use and could cause unneeded load when having many group members.  
+
+### v4.1.9  
+
+[Fixed]  
+  
+- plugin-azure-ad.json configuration file introduced in v.4.1.7 was missing passwordProfile attribute mappings
+- Symantec/Broadcom/CA ConnectorXpress configuration file `config\resources\Azure - ScimGateway.xml` now using standard text on manager attribute instead of selection dialogbox.
+
 ### v4.1.8  
 
 [Fixed]  

package/config/plugin-api.json

@@ -2,6 +2,7 @@
   "scimgateway": {
     "port": 8890,
     "localhostonly": false,
+    "payloadSize": null,
     "scim": {
       "version": "2.0",
       "customSchema": null,
@@ -86,9 +87,7 @@
   "endpoint": {
     "entity": {
       "undefined": {
-        "baseUrls": [
-          "http://fakerestapi.azurewebsites.net"
-        ],
+        "baseUrls": ["http://fakerestapi.azurewebsites.net"],
         "username": "endpointuser",
         "password": "password",
         "proxy": {
@@ -99,4 +98,4 @@
       }
     }
   }
-}
+}

package/config/plugin-azure-ad.json

@@ -2,6 +2,7 @@
   "scimgateway": {
     "port": 8881,
     "localhostonly": false,
+    "payloadSize": null,
     "scim": {
       "version": "1.1",
       "customSchema": null,
@@ -210,6 +211,14 @@
           "mapTo": "passwordPolicies",
           "type": "string"
         },
+        "passwordProfile.forceChangePasswordNextSignIn": {
+          "mapTo": "passwordProfile.forceChangePasswordNextSignIn",
+          "type": "string"
+        },
+        "passwordProfile.password": {
+          "mapTo": "passwordProfile.password",
+          "type": "string"
+        },
         "servicePlan": {
           "mapTo": "servicePlan.value",
           "type": "array"
@@ -251,4 +260,4 @@
       }
     }
   }
-}
+}

package/config/plugin-forwardinc.json

@@ -2,6 +2,7 @@
   "scimgateway": {
     "port": 8882,
     "localhostonly": false,
+    "payloadSize": null,
     "scim": {
       "version": "2.0",
       "customSchema": null,
@@ -145,4 +146,4 @@
       }
     }
   }
-}
+}

package/config/plugin-ldap.json

@@ -2,6 +2,7 @@
   "scimgateway": {
     "port": 8883,
     "localhostonly": false,
+    "payloadSize": null,
     "scim": {
       "version": "2.0",
       "customSchema": null,
@@ -86,10 +87,7 @@
   "endpoint": {
     "entity": {
       "undefined": {
-        "baseUrls": [
-          "ldaps://dc1.test.com:636",
-          "ldaps://dc2.test.com:636"
-        ],
+        "baseUrls": ["ldaps://dc1.test.com:636", "ldaps://dc2.test.com:636"],
         "username": "CN=Administrator,CN=Users,DC=test,DC=com",
         "password": "password",
         "ldap": {
@@ -105,10 +103,7 @@
             "organizationalPerson",
             "top"
           ],
-          "groupObjectClasses": [
-            "group",
-            "top"
-          ]
+          "groupObjectClasses": ["group", "top"]
         }
       }
     },
@@ -223,4 +218,4 @@
       }
     }
   }
-}
+}

package/config/plugin-loki.json

@@ -2,6 +2,7 @@
   "scimgateway": {
     "port": 8880,
     "localhostonly": false,
+    "payloadSize": null,
     "scim": {
       "version": "2.0",
       "customSchema": null,
@@ -87,4 +88,4 @@
     "dbname": "loki.db",
     "persistence": false
   }
-}
+}

package/config/plugin-mongodb.json

@@ -2,6 +2,7 @@
   "scimgateway": {
     "port": 8885,
     "localhostonly": false,
+    "payloadSize": null,
     "scim": {
       "version": "2.0",
       "customSchema": null,
@@ -107,4 +108,4 @@
       }
     }
   }
-}
+}

package/config/plugin-mssql.json

@@ -2,6 +2,7 @@
   "scimgateway": {
     "port": 8888,
     "localhostonly": false,
+    "payloadSize": null,
     "scim": {
       "version": "2.0",
       "customSchema": null,
@@ -103,4 +104,4 @@
       }
     }
   }
-}
+}

package/config/plugin-saphana.json

@@ -2,6 +2,7 @@
   "scimgateway": {
     "port": 8884,
     "localhostonly": false,
+    "payloadSize": null,
     "scim": {
       "version": "2.0",
       "customSchema": null,
@@ -90,4 +91,4 @@
     "password": "password",
     "saml_provider": "saml_provider_name"
   }
-}
+}

package/config/plugin-scim.json

@@ -2,6 +2,7 @@
   "scimgateway": {
     "port": 8886,
     "localhostonly": false,
+    "payloadSize": null,
     "scim": {
       "version": "2.0",
       "customSchema": null,
@@ -86,9 +87,7 @@
   "endpoint": {
     "entity": {
       "undefined": {
-        "baseUrls": [
-          "http://localhost:8880"
-        ],
+        "baseUrls": ["http://localhost:8880"],
         "scimVersion": "2.0",
         "username": "gwadmin",
         "password": "password",
@@ -99,9 +98,7 @@
         }
       },
       "clientA": {
-        "baseUrls": [
-          "http://localhost:8880"
-        ],
+        "baseUrls": ["http://localhost:8880"],
         "scimVersion": "2.0",
         "username": "gwadmin",
         "password": "password",
@@ -113,4 +110,4 @@
       }
     }
   }
-}
+}

package/config/resources/Azure - ScimGateway.xml

@@ -3326,16 +3326,16 @@ function init(FieldContext)
             <property name="eTDYN-str-multi-11">
                 <doc></doc>
                 <value default="false">
-                    <flexiStrValue type="DN"></flexiStrValue>
+                    <strValue></strValue>
                 </value>
                 <metadata name="displayName">
                     <value>
-                        <strValue>Manager Id</strValue>
+                        <strValue>Manager UPN</strValue>
                     </value>
                 </metadata>
                 <metadata name="beanPropertyName">
                     <value>
-                        <strValue>managermanagerId</strValue>
+                        <strValue>managerId</strValue>
                     </value>
                 </metadata>
                 <metadata name="isRequired">
@@ -3348,26 +3348,6 @@ function init(FieldContext)
                         <strValue>manager.managerId</strValue>
                     </value>
                 </metadata>
-                <metadata name="DNTestExists">
-                    <value>
-                        <boolValue>true</boolValue>
-                    </value>
-                </metadata>
-                <metadata name="assocRefObjectClass">
-                    <value>
-                        <strValue>eTDYNAccount</strValue>
-                    </value>
-                </metadata>
-                <metadata name="assocRefKeyAttr">
-                    <value>
-                        <strValue>id</strValue>
-                    </value>
-                </metadata>
-                <metadata name="DNLdapObjectClass">
-                    <value>
-                        <strValue>eTDYNAccount</strValue>
-                    </value>
-                </metadata>
             </property>
             <property name="eTDYN-str-multi-29">
                 <doc>Proxy Addresses</doc>
@@ -4906,16 +4886,16 @@ function init(FieldContext)
             </property>
             <property name="eTDYN-str-multi-11">
                 <value>
-                    <flexiStrValue type="DN"></flexiStrValue>
+                    <strValue></strValue>
                 </value>
                 <metadata name="displayName">
                     <value>
-                        <strValue>Manager Id</strValue>
+                        <strValue>Manager UPN</strValue>
                     </value>
                 </metadata>
                 <metadata name="beanPropertyName">
                     <value>
-                        <strValue>managermanagerId</strValue>
+                        <strValue>managerId</strValue>
                     </value>
                 </metadata>
                 <metadata name="isRequired">
@@ -4923,21 +4903,6 @@ function init(FieldContext)
                         <boolValue>false</boolValue>
                     </value>
                 </metadata>
-                <metadata name="assocRefObjectClass">
-                    <value>
-                        <strValue>eTDYNAccount</strValue>
-                    </value>
-                </metadata>
-                <metadata name="assocRefKeyAttr">
-                    <value>
-                        <strValue>id</strValue>
-                    </value>
-                </metadata>
-                <metadata name="DNLdapObjectClass">
-                    <value>
-                        <strValue>eTDYNAccount</strValue>
-                    </value>
-                </metadata>
             </property>
             <property name="eTDYN-str-multi-29">
                 <value>
@@ -4962,11 +4927,6 @@ function init(FieldContext)
                         <boolValue>false</boolValue>
                     </value>
                 </metadata>
-                <metadata name="isReadOnly">
-                    <value>
-                        <boolValue>true</boolValue>
-                    </value>
-                </metadata>
                 <metadata name="writableBy">
                     <value>
                         <strValue></strValue>

package/lib/plugin-azure-ad.js

@@ -1199,7 +1199,7 @@ const getUser = async (baseEntity, uid, attributes) => { // uid = id, userName (
       (async () => {
         // const [attrs] = scimgateway.endpointMapper('outbound', attributes, config.map.user) // SCIM/CustomSCIM => endpoint attribute standard
         const method = 'GET'
-        const path = `/users/${querystring.escape(uid)}?$expand=manager($select=id)` // /beta returns all attributes or use: ?$select=${attrs.join()}
+        const path = `/users/${querystring.escape(uid)}?$expand=manager($select=userPrincipalName)` // beta returns all attributes or use: ?$select=${attrs.join()}
         const body = null
         try {
           const response = await doRequest(baseEntity, method, path, body)
@@ -1210,7 +1210,7 @@ const getUser = async (baseEntity, uid, attributes) => { // uid = id, userName (
           }
 
           let managerId
-          if (userObj.manager && userObj.manager.id) managerId = userObj.manager.id
+          if (userObj.manager && userObj.manager.userPrincipalName) managerId = userObj.manager.userPrincipalName
           delete userObj.manager
           if (managerId) userObj.manager = managerId
 

package/lib/scimgateway.js

@@ -578,7 +578,8 @@ const ScimGateway = function () {
   app.use(bodyParser({ // parsed body store in ctx.request.body
     enableTypes: ['json', 'form'],
     extendTypes: { json: ['application/scim+json', 'text/plain'] },
-    formTypes: { form: ['application/x-www-form-urlencoded'] }
+    formTypes: { form: ['application/x-www-form-urlencoded'] },
+    jsonLimit: (!config.payloadSize) ? undefined : config.payloadSize // default '1mb'
   }))
   app.use(ipAllowList)
   app.use(auth) // authentication before routes
@@ -787,7 +788,7 @@ const ScimGateway = function () {
           logger.debug(`${gwName}[${pluginName}] calling "${handler.groups.getMethod}" and awaiting result - groups to be included`)
           let res
           try {
-            res = await this[handler.groups.getMethod](ctx.params.baseEntity, { attribute: 'members.value', operator: 'eq', value: getObj.value }, ['members.value', 'id', 'displayName'])
+            res = await this[handler.groups.getMethod](ctx.params.baseEntity, { attribute: 'members.value', operator: 'eq', value: getObj.value }, ['id', 'displayName'])
           } catch (err) {} // method may be implemented but throwing error like groups not supported/implemented
           if (res && res.Resources && Array.isArray(res.Resources) && res.Resources.length > 0) {
             userObj.groups = []
@@ -798,7 +799,7 @@ const ScimGateway = function () {
               if (res.Resources[i].displayName) el.display = res.Resources[i].displayName
               if (isScimv2) el.type = 'direct'
               else el.type = { value: 'direct' }
-              if (el.value) userObj.groups.push(el) // { "value": "Admins", "display": "Admins", "type": "direct"}
+              userObj.groups.push(el) // { "value": "Admins", "display": "Admins", "type": "direct"}
             }
           }
         }
@@ -991,7 +992,7 @@ const ScimGateway = function () {
             logger.debug(`${gwName}[${pluginName}] calling "${handler.groups.getMethod}" and awaiting result - groups to be included`)
             let res
             try {
-              res = await this[handler.groups.getMethod](ctx.params.baseEntity, { attribute: 'members.value', operator: 'eq', value: decodeURIComponent(userObj.id) }, ['members.value', 'id', 'displayName']) // await scimgateway.getUserGroups(baseEntity, userObj.id, 'members.value,displayName')
+              res = await this[handler.groups.getMethod](ctx.params.baseEntity, { attribute: 'members.value', operator: 'eq', value: decodeURIComponent(userObj.id) }, ['id', 'displayName']) // await scimgateway.getUserGroups(baseEntity, userObj.id, 'members.value,displayName')
             } catch (err) {} // method may be implemented but throwing error like groups not supported/implemented
             if (res && res.Resources && Array.isArray(res.Resources) && res.Resources.length > 0) {
               userObj.groups = []
@@ -1002,7 +1003,7 @@ const ScimGateway = function () {
                 if (res.Resources[i].displayName) el.display = res.Resources[i].displayName
                 if (isScimv2) el.type = 'direct'
                 else el.type = { value: 'direct' }
-                if (el.value) userObj.groups.push(el) // { "value": "Admins", "display": "Admins", "type": "direct"}
+                userObj.groups.push(el) // { "value": "Admins", "display": "Admins", "type": "direct"}
               }
             }
           }

package/lib/utils.js

@@ -388,3 +388,22 @@ module.exports.fsExistsSync = function (f) {
     return false
   }
 }
+
+// createRandomPassword creates a random password, syntax:
+// utils.createRandomPassword(12) => 12 characters, lower, upper and special
+// utils.createRandomPassword(12, utils.createRandomPassword.alphaLower)
+// https://gist.github.com/6174/6062387
+module.exports.createRandomPassword = (function () {
+  const gen = (min, max) => max++ && [...Array(max - min)].map((s, i) => String.fromCharCode(min + i))
+  const sets = {
+    num: gen(48, 57),
+    alphaLower: gen(97, 122),
+    alphaUpper: gen(65, 90),
+    special: [...'~!@#$%^&*()_+-=[]{}|;:\'",./<>?']
+  }
+  function * iter (len, set) {
+    if (set.length < 1) { set = Object.values(sets).flat() }
+    for (let i = 0; i < len; i++) { yield set[Math.random() * set.length | 0] }
+  }
+  return Object.assign((len, ...set) => [...iter(len, set.flat())].join(''), sets)
+}())

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scimgateway",
-  "version": "4.1.8",
+  "version": "4.1.10",
   "description": "Using SCIM protocol as a gateway for user provisioning to other endpoints",
   "author": "Jarle Elshaug <jarle.elshaug@gmail.com> (https://elshaug.xyz)",
   "homepage": "https://elshaug.xyz",