scimgateway 4.1.9 → 4.1.11

package/README.md

@@ -206,6 +206,7 @@ Below shows an example of config\plugin-saphana.json
 	  "scimgateway": {
 	    "port": 8884,
 	    "localhostonly": false,
+        "payloadSize": null,
         "scim": {
           "version": "2.0",
           "customSchema": null,
@@ -307,6 +308,8 @@ Definitions in `endpoint` object are customized according to our plugin code. Pl
 
 - **localhostonly** - true or false. False means gateway accepts incoming requests from all clients. True means traffic from only localhost (127.0.0.1) is accepted (gateway must then be installed on the CA Connector Server).  
 
+- **payloadSize** - if not defined, default "1mb" will be used. There are cases which large groups could exceed default size and you may want to increase by setting your own size  
+
 - **scim.version** - "1.1" or "2.0". Default is "2.0". For Symantec/Broadcom/CA Identity Manager "1.1" should be used.  
 
 - **scim.customSchema** - filename of JSON file located in `<package-root>\config\schemas` containing custom schema attributes, see configuration notes 
@@ -1143,6 +1146,23 @@ MIT © [Jarle Elshaug](https://www.elshaug.xyz)
 
 ## Change log  
 
+### v4.1.11  
+
+[Fixed]  
+  
+- basic auth logon dialog should not show up when not configured 
+
+### v4.1.10  
+
+[Added]  
+
+- new plugin configuration `payloadSize`. If not defined, default "1mb" will be used. There are cases which large groups could exceed default size and you may want to increase by setting your own size e.g. "5mb"  
+    **Thanks to Sam Murphy**
+
+[Fixed]  
+  
+- using `GET /Users`, scimgateway automatically adds groups if not included by plugin. This operation calls plugin getGroups having attributes=['members.value', 'id', 'displayName']. Now, `members.value` is excluded. This attribute was in use and could cause unneeded load when having many group members.  
+
 ### v4.1.9  
 
 [Fixed]  

package/config/plugin-api.json

@@ -2,6 +2,7 @@
   "scimgateway": {
     "port": 8890,
     "localhostonly": false,
+    "payloadSize": null,
     "scim": {
       "version": "2.0",
       "customSchema": null,
@@ -86,9 +87,7 @@
   "endpoint": {
     "entity": {
       "undefined": {
-        "baseUrls": [
-          "http://fakerestapi.azurewebsites.net"
-        ],
+        "baseUrls": ["http://fakerestapi.azurewebsites.net"],
         "username": "endpointuser",
         "password": "password",
         "proxy": {
@@ -99,4 +98,4 @@
       }
     }
   }
-}
+}

package/config/plugin-azure-ad.json

@@ -2,6 +2,7 @@
   "scimgateway": {
     "port": 8881,
     "localhostonly": false,
+    "payloadSize": null,
     "scim": {
       "version": "1.1",
       "customSchema": null,
@@ -259,4 +260,4 @@
       }
     }
   }
-}
+}

package/config/plugin-forwardinc.json

@@ -2,6 +2,7 @@
   "scimgateway": {
     "port": 8882,
     "localhostonly": false,
+    "payloadSize": null,
     "scim": {
       "version": "2.0",
       "customSchema": null,
@@ -145,4 +146,4 @@
       }
     }
   }
-}
+}

package/config/plugin-ldap.json

@@ -2,6 +2,7 @@
   "scimgateway": {
     "port": 8883,
     "localhostonly": false,
+    "payloadSize": null,
     "scim": {
       "version": "2.0",
       "customSchema": null,
@@ -86,10 +87,7 @@
   "endpoint": {
     "entity": {
       "undefined": {
-        "baseUrls": [
-          "ldaps://dc1.test.com:636",
-          "ldaps://dc2.test.com:636"
-        ],
+        "baseUrls": ["ldaps://dc1.test.com:636", "ldaps://dc2.test.com:636"],
         "username": "CN=Administrator,CN=Users,DC=test,DC=com",
         "password": "password",
         "ldap": {
@@ -105,10 +103,7 @@
             "organizationalPerson",
             "top"
           ],
-          "groupObjectClasses": [
-            "group",
-            "top"
-          ]
+          "groupObjectClasses": ["group", "top"]
         }
       }
     },
@@ -223,4 +218,4 @@
       }
     }
   }
-}
+}

package/config/plugin-loki.json

@@ -2,6 +2,7 @@
   "scimgateway": {
     "port": 8880,
     "localhostonly": false,
+    "payloadSize": null,
     "scim": {
       "version": "2.0",
       "customSchema": null,
@@ -87,4 +88,4 @@
     "dbname": "loki.db",
     "persistence": false
   }
-}
+}

package/config/plugin-mongodb.json

@@ -2,6 +2,7 @@
   "scimgateway": {
     "port": 8885,
     "localhostonly": false,
+    "payloadSize": null,
     "scim": {
       "version": "2.0",
       "customSchema": null,
@@ -107,4 +108,4 @@
       }
     }
   }
-}
+}

package/config/plugin-mssql.json

@@ -2,6 +2,7 @@
   "scimgateway": {
     "port": 8888,
     "localhostonly": false,
+    "payloadSize": null,
     "scim": {
       "version": "2.0",
       "customSchema": null,
@@ -103,4 +104,4 @@
       }
     }
   }
-}
+}

package/config/plugin-saphana.json

@@ -2,6 +2,7 @@
   "scimgateway": {
     "port": 8884,
     "localhostonly": false,
+    "payloadSize": null,
     "scim": {
       "version": "2.0",
       "customSchema": null,
@@ -90,4 +91,4 @@
     "password": "password",
     "saml_provider": "saml_provider_name"
   }
-}
+}

package/config/plugin-scim.json

@@ -2,6 +2,7 @@
   "scimgateway": {
     "port": 8886,
     "localhostonly": false,
+    "payloadSize": null,
     "scim": {
       "version": "2.0",
       "customSchema": null,
@@ -86,9 +87,7 @@
   "endpoint": {
     "entity": {
       "undefined": {
-        "baseUrls": [
-          "http://localhost:8880"
-        ],
+        "baseUrls": ["http://localhost:8880"],
         "scimVersion": "2.0",
         "username": "gwadmin",
         "password": "password",
@@ -99,9 +98,7 @@
         }
       },
       "clientA": {
-        "baseUrls": [
-          "http://localhost:8880"
-        ],
+        "baseUrls": ["http://localhost:8880"],
         "scimVersion": "2.0",
         "username": "gwadmin",
         "password": "password",
@@ -113,4 +110,4 @@
       }
     }
   }
-}
+}

package/lib/scimgateway.js

@@ -123,7 +123,7 @@ const ScimGateway = function () {
         logger.error(`${gwName}[${pluginName}] getPassword error: ${err.message}`)
         throw err // above logger.error included because this unhanledExcepton will be handled by winston and may fail with an other internal winston error e.g. related to memoryUsage collection logic when running in unikernel
       }
-      if (arr[i].password) foundBasic = true
+      if (arr[i].username && arr[i].password) foundBasic = true
     }
     if (!foundBasic) config.auth.basic = []
   }
@@ -223,7 +223,7 @@ const ScimGateway = function () {
   if (config.certificate.pfx.password) pwPfxPassword = ScimGateway.prototype.getPassword('scimgateway.certificate.pfx.password', configFile)
   if (config.emailOnError.smtp.password) config.emailOnError.smtp.password = ScimGateway.prototype.getPassword('scimgateway.emailOnError.smtp.password', configFile)
 
-  if (!foundBasic && !foundBearerToken && !foundBearerJwtAzure && !foundBearerJwt) {
+  if (!foundBasic && !foundBearerToken && !foundBearerJwtAzure && !foundBearerJwt && !foundBearerOAuth) {
     logger.error(`${gwName}[${pluginName}] Scimgateway password decryption failed or no password defined`)
     logger.error(`${gwName}[${pluginName}] stopping...\n`)
     throw (new Error('Using exception to stop further asynchronous code execution (ensure synchronous logger flush to logfile and exit program), please ignore this one...'))
@@ -505,7 +505,7 @@ const ScimGateway = function () {
         logger.debug(`${gwName}[${pluginName}] request jwt.decode(authToken) = ${JSON.stringify(jwt.decode(authToken))}`)
       }
       if (authType === 'Bearer') ctx.set('WWW-Authenticate', 'Bearer realm=""')
-      else ctx.set('WWW-Authenticate', 'Basic realm=""')
+      else if (foundBasic) ctx.set('WWW-Authenticate', 'Basic realm=""')
       ctx.set('Content-Type', 'application/json; charset=utf-8')
       ctx.status = 401
       ctx.body = { error: 'Access denied' }
@@ -578,7 +578,8 @@ const ScimGateway = function () {
   app.use(bodyParser({ // parsed body store in ctx.request.body
     enableTypes: ['json', 'form'],
     extendTypes: { json: ['application/scim+json', 'text/plain'] },
-    formTypes: { form: ['application/x-www-form-urlencoded'] }
+    formTypes: { form: ['application/x-www-form-urlencoded'] },
+    jsonLimit: (!config.payloadSize) ? undefined : config.payloadSize // default '1mb'
   }))
   app.use(ipAllowList)
   app.use(auth) // authentication before routes
@@ -787,7 +788,7 @@ const ScimGateway = function () {
           logger.debug(`${gwName}[${pluginName}] calling "${handler.groups.getMethod}" and awaiting result - groups to be included`)
           let res
           try {
-            res = await this[handler.groups.getMethod](ctx.params.baseEntity, { attribute: 'members.value', operator: 'eq', value: getObj.value }, ['members.value', 'id', 'displayName'])
+            res = await this[handler.groups.getMethod](ctx.params.baseEntity, { attribute: 'members.value', operator: 'eq', value: getObj.value }, ['id', 'displayName'])
           } catch (err) {} // method may be implemented but throwing error like groups not supported/implemented
           if (res && res.Resources && Array.isArray(res.Resources) && res.Resources.length > 0) {
             userObj.groups = []
@@ -798,7 +799,7 @@ const ScimGateway = function () {
               if (res.Resources[i].displayName) el.display = res.Resources[i].displayName
               if (isScimv2) el.type = 'direct'
               else el.type = { value: 'direct' }
-              if (el.value) userObj.groups.push(el) // { "value": "Admins", "display": "Admins", "type": "direct"}
+              userObj.groups.push(el) // { "value": "Admins", "display": "Admins", "type": "direct"}
             }
           }
         }
@@ -991,7 +992,7 @@ const ScimGateway = function () {
             logger.debug(`${gwName}[${pluginName}] calling "${handler.groups.getMethod}" and awaiting result - groups to be included`)
             let res
             try {
-              res = await this[handler.groups.getMethod](ctx.params.baseEntity, { attribute: 'members.value', operator: 'eq', value: decodeURIComponent(userObj.id) }, ['members.value', 'id', 'displayName']) // await scimgateway.getUserGroups(baseEntity, userObj.id, 'members.value,displayName')
+              res = await this[handler.groups.getMethod](ctx.params.baseEntity, { attribute: 'members.value', operator: 'eq', value: decodeURIComponent(userObj.id) }, ['id', 'displayName']) // await scimgateway.getUserGroups(baseEntity, userObj.id, 'members.value,displayName')
             } catch (err) {} // method may be implemented but throwing error like groups not supported/implemented
             if (res && res.Resources && Array.isArray(res.Resources) && res.Resources.length > 0) {
               userObj.groups = []
@@ -1002,7 +1003,7 @@ const ScimGateway = function () {
                 if (res.Resources[i].displayName) el.display = res.Resources[i].displayName
                 if (isScimv2) el.type = 'direct'
                 else el.type = { value: 'direct' }
-                if (el.value) userObj.groups.push(el) // { "value": "Admins", "display": "Admins", "type": "direct"}
+                userObj.groups.push(el) // { "value": "Admins", "display": "Admins", "type": "direct"}
               }
             }
           }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scimgateway",
-  "version": "4.1.9",
+  "version": "4.1.11",
   "description": "Using SCIM protocol as a gateway for user provisioning to other endpoints",
   "author": "Jarle Elshaug <jarle.elshaug@gmail.com> (https://elshaug.xyz)",
   "homepage": "https://elshaug.xyz",