scimgateway 4.2.3 → 4.2.6

package/.travis.yml

@@ -1,7 +1,7 @@
 language: node_js
 
 node_js:
-  - "10"
+  - "14"
 
 sudo: false
 

package/README.md

@@ -1165,6 +1165,24 @@ MIT © [Jarle Elshaug](https://www.elshaug.xyz)
 
 ## Change log  
 
+### v4.2.6  
+
+[Fixed] 
+
+- cosmetics related to 401 error handling introduced in v4.2.4  
+
+### v4.2.5  
+
+[Fixed] 
+
+- travis test build cosmetics
+
+### v4.2.4  
+
+[Added]  
+
+- provided plugins now supports Auth PassThrough. See helpers methods like getClientIdentifier(), getCtxAuth() and changes in doRequest() and getServiceClient(). In general, PassThrough is supported for both basic and bearer auth. Password/secret/client_secret are then not needed in configuration file. Username may still be needed in configuration file depended on how logic is implemented (ref. mongodb/mssql) and what auth beeing used (basic/bearer). Plugin scim, api and azure-ad are all REST plugins having the same helpers (but, some minor differences to azure-ad using OAuth and the getAccessToken() method)
+
 ### v4.2.3  
 
 [Fixed]  

package/lib/plugin-api.js

@@ -77,7 +77,7 @@ scimgateway.postApi = async (baseEntity, apiObj, ctx) => {
     Excerpt: apiObj.userID
   }
   try {
-    const response = await doRequest(baseEntity, method, path, body)
+    const response = await doRequest(baseEntity, method, path, body, ctx)
     return response.body
   } catch (err) {
     const newErr = err
@@ -111,7 +111,7 @@ scimgateway.putApi = async (baseEntity, id, apiObj, ctx) => {
     Excerpt: apiObj.userID
   }
   try {
-    const response = await doRequest(baseEntity, method, path, body)
+    const response = await doRequest(baseEntity, method, path, body, ctx)
     return response.body
   } catch (err) {
     const newErr = err
@@ -144,7 +144,7 @@ scimgateway.patchApi = async (baseEntity, id, apiObj, ctx) => {
   if (apiObj.userID) body.Excerpt = apiObj.userID
 
   try { // note, Books example do not support patch
-    const response = await doRequest(baseEntity, method, path, body)
+    const response = await doRequest(baseEntity, method, path, body, ctx)
     return response.body
   } catch (err) {
     const newErr = err
@@ -170,13 +170,13 @@ scimgateway.getApi = async (baseEntity, id, apiQuery, apiObj, ctx) => {
     if (id) {
       const path = `/api/v1/Books/${id}`
       const body = null
-      const response = await doRequest(baseEntity, method, path, body)
+      const response = await doRequest(baseEntity, method, path, body, ctx)
       return response.body
     } else {
       const path = '/api/Books'
       const body = null
       if (apiQuery) { /* some logic here */ }
-      const response = await doRequest(baseEntity, method, path, body)
+      const response = await doRequest(baseEntity, method, path, body, ctx)
       return response.body
     }
   } catch (err) {
@@ -201,7 +201,7 @@ scimgateway.deleteApi = async (baseEntity, id, ctx) => {
   const body = null
 
   try {
-    const response = await doRequest(baseEntity, method, path, body)
+    const response = await doRequest(baseEntity, method, path, body, ctx)
     return response.body
   } catch (err) {
     const newErr = err
@@ -213,6 +213,24 @@ scimgateway.deleteApi = async (baseEntity, id, ctx) => {
 // helpers
 // =================================================
 
+const getClientIdentifier = (ctx) => {
+  if (!ctx?.request?.header?.authorization) return undefined
+  const [user, secret] = getCtxAuth(ctx)
+  return `${encodeURIComponent(user)}_${encodeURIComponent(secret)}` // user_password or undefined_password
+}
+
+//
+// getCtxAuth returns username/secret from ctx header when using Auth PassThrough
+//
+const getCtxAuth = (ctx) => { // eslint-disable-line
+  if (!ctx?.request?.header?.authorization) return []
+  const [authType, authToken] = (ctx.request.header.authorization || '').split(' ') // [0] = 'Basic' or 'Bearer'
+  let username, password
+  if (authType === 'Basic') [username, password] = (Buffer.from(authToken, 'base64').toString() || '').split(':')
+  if (username) return [username, password] // basic auth
+  else return [undefined, authToken] // bearer auth
+}
+
 //
 // getServiceClient - returns options needed for connection parameters
 //
@@ -222,7 +240,7 @@ scimgateway.deleteApi = async (baseEntity, id, ctx) => {
 //   path = url e.g. "http(s)://<host>:<port>/xxx/yyy", then using the url host/port/protocol
 //          opt (options) may be needed e.g {auth: {username: "username", password: "password"} }
 //
-const getServiceClient = async (baseEntity, method, path, opt) => {
+const getServiceClient = async (baseEntity, method, path, opt, ctx) => {
   const action = 'getServiceClient'
 
   let urlObj
@@ -233,15 +251,15 @@ const getServiceClient = async (baseEntity, method, path, opt) => {
     //
     // path (no url) - default approach and client will be cached based on config
     //
-    if (_serviceClient[baseEntity]) { // serviceClient already exist
+    const clientIdentifier = getClientIdentifier(ctx)
+    if (_serviceClient[baseEntity] && _serviceClient[baseEntity][clientIdentifier]) { // serviceClient already exist
       scimgateway.logger.debug(`${pluginName}[${baseEntity}] ${action}: Using existing client`)
     } else {
       scimgateway.logger.debug(`${pluginName}[${baseEntity}] ${action}: Client have to be created`)
       let client = null
       if (config.entity && config.entity[baseEntity]) client = config.entity[baseEntity]
       if (!client) {
-        const err = new Error(`Base URL have baseEntity=${baseEntity}, and configuration file ${pluginName}.json is missing required baseEntity configuration for ${baseEntity}`)
-        throw err
+        throw new Error(`Base URL have baseEntity=${baseEntity}, and configuration file ${pluginName}.json is missing required baseEntity configuration for ${baseEntity}`)
       }
 
       urlObj = new URL(config.entity[baseEntity].baseUrls[0])
@@ -251,7 +269,8 @@ const getServiceClient = async (baseEntity, method, path, opt) => {
           json: true, // json-object response instead of string
           headers: {
             'Content-Type': 'application/json',
-            Authorization: 'Basic ' + Buffer.from(`${config.entity[baseEntity].username}:${scimgateway.getPassword(`endpoint.entity.${baseEntity}.password`, configFile)}`).toString('base64')
+            // Auth PassThrough or configuration, using ctx "AS-IS" header for PassThrough. For more advanced logic use getCtxAuth(ctx) - see examples in other plugins
+            Authorization: ctx?.request?.header?.authorization ? ctx.request.header.authorization : 'Basic ' + Buffer.from(`${config.entity[baseEntity].username}:${scimgateway.getPassword(`endpoint.entity.${baseEntity}.password`, configFile)}`).toString('base64')
           },
           host: urlObj.hostname,
           port: urlObj.port, // null if https and 443 defined in url
@@ -271,13 +290,14 @@ const getServiceClient = async (baseEntity, method, path, opt) => {
       }
 
       if (!_serviceClient[baseEntity]) _serviceClient[baseEntity] = {}
-      _serviceClient[baseEntity] = param // serviceClient created
+      if (!_serviceClient[baseEntity][clientIdentifier]) _serviceClient[baseEntity][clientIdentifier] = {}
+      _serviceClient[baseEntity][clientIdentifier] = param // serviceClient created
     }
 
-    const cli = scimgateway.copyObj(_serviceClient[baseEntity]) // client ready
+    const cli = scimgateway.copyObj(_serviceClient[baseEntity][clientIdentifier]) // client ready
 
     // failover support
-    path = _serviceClient[baseEntity].baseUrl + path
+    path = _serviceClient[baseEntity][clientIdentifier].baseUrl + path
     urlObj = new URL(path)
     cli.options.host = urlObj.hostname
     cli.options.port = urlObj.port
@@ -330,16 +350,16 @@ const getServiceClient = async (baseEntity, method, path, opt) => {
   return cli // final client
 }
 
-const updateServiceClient = (baseEntity, obj) => {
-  if (_serviceClient[baseEntity]) _serviceClient[baseEntity] = scimgateway.extendObj(_serviceClient[baseEntity], obj) // merge with argument options
+const updateServiceClient = (baseEntity, clientIdentifier, obj) => {
+  if (_serviceClient[baseEntity] && _serviceClient[baseEntity][clientIdentifier]) _serviceClient[baseEntity][clientIdentifier] = scimgateway.extendObj(_serviceClient[baseEntity][clientIdentifier], obj) // merge with argument options
 }
 
 //
 // doRequest - execute REST service
 //
-const doRequest = async (baseEntity, method, path, body, opt, retryCount) => {
+const doRequest = async (baseEntity, method, path, body, ctx, opt, retryCount) => {
   try {
-    const cli = await getServiceClient(baseEntity, method, path, opt)
+    const cli = await getServiceClient(baseEntity, method, path, opt, ctx)
     const options = cli.options
     const result = await new Promise((resolve, reject) => {
       let dataString = ''
@@ -394,15 +414,18 @@ const doRequest = async (baseEntity, method, path, body, opt, retryCount) => {
     return result
   } catch (err) { // includes failover/retry logic based on config baseUrls array
     scimgateway.logger.error(`${pluginName}[${baseEntity}] doRequest ${method} ${path} Body = ${JSON.stringify(body)} Error Response = ${err.message}`)
+    let statusCode
+    try { statusCode = JSON.parse(err.message).statusCode } catch (e) {}
+    const clientIdentifier = getClientIdentifier(ctx)
     if (!retryCount) retryCount = 0
     let urlObj
     try { urlObj = new URL(path) } catch (err) {}
     if (!urlObj && (err.code === 'ECONNREFUSED' || err.code === 'ENOTFOUND')) {
       if (retryCount < config.entity[baseEntity].baseUrls.length) {
         retryCount++
-        updateServiceClient(baseEntity, { baseUrl: config.entity[baseEntity].baseUrls[retryCount - 1] })
+        updateServiceClient(baseEntity, clientIdentifier, { baseUrl: config.entity[baseEntity].baseUrls[retryCount - 1] })
         scimgateway.logger.debug(`${pluginName}[${baseEntity}] ${(config.entity[baseEntity].baseUrls.length > 1) ? 'failover ' : ''}retry[${retryCount}] using baseUrl = ${_serviceClient[baseEntity].baseUrl}`)
-        const ret = await doRequest(baseEntity, method, path, body, opt, retryCount) // retry
+        const ret = await doRequest(baseEntity, method, path, body, ctx, opt, retryCount) // retry
         return ret // problem fixed
       } else {
         const newerr = new Error(err.message)
@@ -410,7 +433,10 @@ const doRequest = async (baseEntity, method, path, body, opt, retryCount) => {
         newerr.message = newerr.message.replace('ENOTFOUND', 'UnableConnectingHost') // avoid returning ENOTFOUND error
         throw newerr
       }
-    } else throw err // CA IM retries getUser failure once (retry 6 times on ECONNREFUSED)
+    } else {
+      if (statusCode === 401 && _serviceClient[baseEntity]) delete _serviceClient[baseEntity][clientIdentifier]
+      throw err // CA IM retries getUsers failure once (retry 6 times on ECONNREFUSED)
+    }
   }
 } // doRequest
 

package/lib/plugin-azure-ad.js

@@ -128,7 +128,9 @@ for (const key in config.map.user) { // userAttributes = ['country', 'preferredL
   if (config.map.user[key].mapTo) userAttributes.push(config.map.user[key].mapTo)
 }
 
-const graphUrl = 'https://graph.microsoft.com/beta' // beta instead ov 'v1.0' gives all user attributes when no $select
+for (const baseEntity in config.entity) { // ensure we have baseUrls in config and for this azure-ad plugin we overwrite any existing to hardcoded value ['https://graph.microsoft.com/beta']
+  config.entity[baseEntity].baseUrls = ['https://graph.microsoft.com/beta'] // beta instead of 'v1.0' gives all user attributes when no $select
+}
 
 const _serviceClient = {}
 const lock = new scimgateway.Lock()
@@ -211,9 +213,9 @@ scimgateway.getUsers = async (baseEntity, getObj, attributes, ctx) => {
     let response
     if (path === 'getUser') { // special
       response = { body: { value: [] } }
-      const userObj = await getUser(baseEntity, getObj.value, attributes)
+      const userObj = await getUser(baseEntity, getObj.value, attributes, ctx)
       if (userObj) response.body.value.push(userObj)
-    } else response = await doRequest(baseEntity, method, path, body)
+    } else response = await doRequest(baseEntity, method, path, body, ctx)
     if (!response.body.value) {
       throw new Error(`invalid response: ${JSON.stringify(response)}`)
     }
@@ -258,7 +260,7 @@ scimgateway.createUser = async (baseEntity, userObj, ctx) => {
   const [body] = scimgateway.endpointMapper('outbound', userObj, config.map.user)
 
   try {
-    await doRequest(baseEntity, method, path, body)
+    await doRequest(baseEntity, method, path, body, ctx)
     if (Object.keys(addonObj).length > 0) {
       await scimgateway.modifyUser(baseEntity, userObj.userName, addonObj, ctx) // manager, servicePlan
       return null
@@ -281,7 +283,7 @@ scimgateway.deleteUser = async (baseEntity, id, ctx) => {
   const body = null
 
   try {
-    await doRequest(baseEntity, method, path, body)
+    await doRequest(baseEntity, method, path, body, ctx)
     return (null)
   } catch (err) {
     throw new Error(`${action} error: ${err.message}`)
@@ -326,7 +328,7 @@ scimgateway.modifyUser = async (baseEntity, id, attrObj, ctx) => {
             const method = 'GET'
             const path = `/users/${id}?$select=${key}`
             try {
-              const res = await doRequest(baseEntity, method, path, null)
+              const res = await doRequest(baseEntity, method, path, null, ctx)
               if (res && res.body && res.body[key]) {
                 const fullKeyObj = Object.assign(res.body[key], parsedAttrObj[key]) // merge original with modified
                 if (fullKeyObj && Object.keys(fullKeyObj).length > 0) {
@@ -341,7 +343,7 @@ scimgateway.modifyUser = async (baseEntity, id, attrObj, ctx) => {
         const method = 'PATCH'
         const path = `/users/${id}`
         try {
-          await doRequest(baseEntity, method, path, parsedAttrObj)
+          await doRequest(baseEntity, method, path, parsedAttrObj, ctx)
           resolve(null)
         } catch (err) {
           return reject(err)
@@ -357,6 +359,7 @@ scimgateway.modifyUser = async (baseEntity, id, attrObj, ctx) => {
         let path = null
         let body = null
         if (objManager.manager) { // new manager
+          const graphUrl = config.entity[baseEntity].baseUrls[0]
           method = 'PUT'
           path = `/users/${id}/manager/$ref`
           body = { '@odata.id': `${graphUrl}/users/${objManager.manager}` }
@@ -366,7 +369,7 @@ scimgateway.modifyUser = async (baseEntity, id, attrObj, ctx) => {
           body = null
         } else return resolve(null)
         try {
-          await doRequest(baseEntity, method, path, body)
+          await doRequest(baseEntity, method, path, body, ctx)
           resolve(null)
         } catch (err) {
           return reject(err)
@@ -387,7 +390,7 @@ scimgateway.modifyUser = async (baseEntity, id, attrObj, ctx) => {
         try { // build currentLic
           let response
           try {
-            response = await doRequest(baseEntity, method, path, null)
+            response = await doRequest(baseEntity, method, path, null, ctx)
           } catch (err) {
             let statusCode
             try { statusCode = JSON.parse(err.message).statusCode } catch (e) {}
@@ -419,7 +422,7 @@ scimgateway.modifyUser = async (baseEntity, id, attrObj, ctx) => {
           const addLic = {}
           const removeLic = {}
 
-          response = await doRequest(baseEntity, method, path, null)
+          response = await doRequest(baseEntity, method, path, null, ctx)
           if (!response.body.value) {
             const err = new Error(`${action}: Got empty response on REST request`)
             return reject(err)
@@ -504,7 +507,7 @@ scimgateway.modifyUser = async (baseEntity, id, attrObj, ctx) => {
           method = 'POST'
           path = `/users/${id}/assignLicense`
           const body = lic
-          await doRequest(baseEntity, method, path, body)
+          await doRequest(baseEntity, method, path, body, ctx)
 
           resolve(null)
         } catch (err) {
@@ -611,7 +614,7 @@ scimgateway.getGroups = async (baseEntity, getObj, attributes, ctx) => {
   if (!path) throw new Error(`${action} error: mandatory if-else logic not fully implemented`)
 
   try {
-    let response = await doRequest(baseEntity, method, path, body)
+    let response = await doRequest(baseEntity, method, path, body, ctx)
     if (!response.body) {
       throw new Error(`invalid response: ${JSON.stringify(response)}`)
     }
@@ -672,7 +675,7 @@ scimgateway.createGroup = async (baseEntity, groupObj, ctx) => {
     if (res && res.Resources && res.Resources.length > 0) {
       throw new Error(`group ${groupObj.displayName} already exist`)
     }
-    await doRequest(baseEntity, method, path, body)
+    await doRequest(baseEntity, method, path, body, ctx)
     return null
   } catch (err) {
     const newErr = new Error(`${action} error: ${err.message}`)
@@ -720,10 +723,11 @@ scimgateway.modifyGroup = async (baseEntity, id, attrObj, ctx) => {
         if (arrGrpAdd.length < 1) return resolve(null)
         const method = 'POST'
         const path = `/groups/${id}/members/$ref`
+        const graphUrl = config.entity[baseEntity].baseUrls[0]
         for (let i = 0, len = arrGrpAdd.length; i < len; i++) {
           const body = { '@odata.id': `${graphUrl}/directoryObjects/${arrGrpAdd[i]}` }
           try {
-            await doRequest(baseEntity, method, path, body)
+            await doRequest(baseEntity, method, path, body, ctx)
             if (i === len - 1) resolve(null) // loop completed
           } catch (err) {
             return reject(err)
@@ -742,7 +746,7 @@ scimgateway.modifyGroup = async (baseEntity, id, attrObj, ctx) => {
         for (let i = 0, len = arrGrpDel.length; i < len; i++) {
           const path = `/groups/${id}/members/${arrGrpDel[i]}/$ref`
           try {
-            await doRequest(baseEntity, method, path, body)
+            await doRequest(baseEntity, method, path, body, ctx)
             if (i === len - 1) resolve(null) // loop completed
           } catch (err) {
             return reject(err)
@@ -821,7 +825,7 @@ scimgateway.getServicePlans = async (baseEntity, getObj, attributes, ctx) => {
       response = { body: { value: [] } }
       path = '/subscribedSkus'
 
-      const res = await doRequest(baseEntity, method, path, body)
+      const res = await doRequest(baseEntity, method, path, body, ctx)
       if (!res.body.value) {
         throw new Error('got empty response on REST request')
       }
@@ -850,7 +854,7 @@ scimgateway.getServicePlans = async (baseEntity, getObj, attributes, ctx) => {
       }
       if (planObj) ret.Resources.push(planObj)
     } else {
-      response = await doRequest(baseEntity, method, path, body)
+      response = await doRequest(baseEntity, method, path, body, ctx)
 
       if (!response.body.value) {
         throw new Error('got empty response on REST request')
@@ -908,6 +912,24 @@ scimgateway.modifyServicePlan = async (baseEntity, id, ctx) => {
 // helpers
 // =================================================
 
+const getClientIdentifier = (ctx) => {
+  if (!ctx?.request?.header?.authorization) return undefined
+  const [user, secret] = getCtxAuth(ctx)
+  return `${encodeURIComponent(user)}_${encodeURIComponent(secret)}` // user_password or undefined_password
+}
+
+//
+// getCtxAuth returns username/secret from ctx header when using Auth PassThrough
+//
+const getCtxAuth = (ctx) => {
+  if (!ctx?.request?.header?.authorization) return []
+  const [authType, authToken] = (ctx.request.header.authorization || '').split(' ') // [0] = 'Basic' or 'Bearer'
+  let username, password
+  if (authType === 'Basic') [username, password] = (Buffer.from(authToken, 'base64').toString() || '').split(':')
+  if (username) return [username, password] // basic auth
+  else return [undefined, authToken] // bearer auth
+}
+
 //
 // getServiceClient - returns options needed for connection parameters
 //
@@ -917,7 +939,7 @@ scimgateway.modifyServicePlan = async (baseEntity, id, ctx) => {
 //   path = url e.g. "http(s)://<host>:<port>/xxx/yyy", then using the url host/port/protocol
 //          opt (options) may be needed e.g {auth: {username: "username", password: "password"} }
 //
-const getServiceClient = async (baseEntity, method, path, opt) => {
+const getServiceClient = async (baseEntity, method, path, opt, ctx) => {
   const action = 'getServiceClient'
 
   let urlObj
@@ -928,17 +950,20 @@ const getServiceClient = async (baseEntity, method, path, opt) => {
     //
     // path (no url) - default approach and client will be cached based on config
     //
-    if (_serviceClient[baseEntity] && _serviceClient[baseEntity].accessToken) { // serviceClient already exist - Azure plugin specific
+
+    const clientIdentifier = getClientIdentifier(ctx)
+    if (_serviceClient[baseEntity] && _serviceClient[baseEntity][clientIdentifier] && _serviceClient[baseEntity][clientIdentifier].accessToken) { // serviceClient already exist - Azure plugin specific
       scimgateway.logger.debug(`${pluginName}[${baseEntity}] ${action}: Using existing client`)
       // check if token refresh is needed
       const d = new Date() / 1000 // seconds (unix time)
-      if (_serviceClient[baseEntity].accessToken.validTo < d + 30) { // less than 30 sec before token expiration
-        scimgateway.logger.debug(`${pluginName}[${baseEntity}] ${action}: Accesstoken about to expire in ${_serviceClient[baseEntity].accessToken.validTo - d} seconds`)
+      if (_serviceClient[baseEntity][clientIdentifier].accessToken.validTo < d + 30) { // less than 30 sec before token expiration
+        scimgateway.logger.debug(`${pluginName}[${baseEntity}] ${action}: Accesstoken about to expire in ${_serviceClient[baseEntity][clientIdentifier].accessToken.validTo - d} seconds`)
         try {
-          const accessToken = await getAccessToken(baseEntity)
-          _serviceClient[baseEntity].accessToken = accessToken
-          _serviceClient[baseEntity].options.headers.Authorization = ` Bearer ${accessToken.access_token}`
+          const accessToken = await getAccessToken(baseEntity, ctx)
+          _serviceClient[baseEntity][clientIdentifier].accessToken = accessToken
+          _serviceClient[baseEntity][clientIdentifier].options.headers.Authorization = ` Bearer ${accessToken.access_token}`
         } catch (err) {
+          delete _serviceClient[baseEntity][clientIdentifier]
           const newErr = err
           throw newErr
         }
@@ -953,8 +978,7 @@ const getServiceClient = async (baseEntity, method, path, opt) => {
       }
 
       // Azure plugin specific
-      const accessToken = await getAccessToken(baseEntity)
-      if (!config.entity[baseEntity].baseUrls) config.entity[baseEntity].baseUrls = [graphUrl] // Azure plugin avoid config file and keep baseUrls logic
+      const accessToken = await getAccessToken(baseEntity, ctx)
 
       urlObj = new URL(config.entity[baseEntity].baseUrls[0])
       const param = {
@@ -983,18 +1007,20 @@ const getServiceClient = async (baseEntity, method, path, opt) => {
       }
 
       if (!_serviceClient[baseEntity]) _serviceClient[baseEntity] = {}
-      _serviceClient[baseEntity] = param // serviceClient created
+      if (!_serviceClient[baseEntity][clientIdentifier]) _serviceClient[baseEntity][clientIdentifier] = {}
 
-      // Azure plugin specific
+      _serviceClient[baseEntity][clientIdentifier] = param // serviceClient created
+
+      // Azure plugin specific (note, not using [clientIdentifier])
       _serviceClient[baseEntity].nextLink = {}
       _serviceClient[baseEntity].nextLink.users = null // Azure users pagination
       _serviceClient[baseEntity].nextLink.groups = null // Azure groups pagination
     }
 
-    const cli = scimgateway.copyObj(_serviceClient[baseEntity]) // client ready
+    const cli = scimgateway.copyObj(_serviceClient[baseEntity][clientIdentifier]) // client ready
 
     // failover support
-    path = _serviceClient[baseEntity].baseUrl + path
+    path = _serviceClient[baseEntity][clientIdentifier].baseUrl + path
     urlObj = new URL(path)
     cli.options.host = urlObj.hostname
     cli.options.port = urlObj.port
@@ -1047,16 +1073,16 @@ const getServiceClient = async (baseEntity, method, path, opt) => {
   return cli // final client
 }
 
-const updateServiceClient = (baseEntity, obj) => {
-  if (_serviceClient[baseEntity]) _serviceClient[baseEntity] = scimgateway.extendObj(_serviceClient[baseEntity], obj) // merge with argument options
+const updateServiceClient = (baseEntity, clientIdentifier, obj) => {
+  if (_serviceClient[baseEntity] && _serviceClient[baseEntity][clientIdentifier]) _serviceClient[baseEntity][clientIdentifier] = scimgateway.extendObj(_serviceClient[baseEntity][clientIdentifier], obj) // merge with argument options
 }
 
 //
 // doRequest - execute REST service
 //
-const doRequest = async (baseEntity, method, path, body, opt, retryCount) => {
+const doRequest = async (baseEntity, method, path, body, ctx, opt, retryCount) => {
   try {
-    const cli = await getServiceClient(baseEntity, method, path, opt)
+    const cli = await getServiceClient(baseEntity, method, path, opt, ctx)
     const options = cli.options
 
     const result = await new Promise((resolve, reject) => {
@@ -1116,15 +1142,16 @@ const doRequest = async (baseEntity, method, path, body, opt, retryCount) => {
     if (statusCode === 404) { // not logged as error, let caller decide e.g. getUser-manager
       scimgateway.logger.debug(`${pluginName}[${baseEntity}] doRequest ${method} ${path} Body = ${JSON.stringify(body)} Error Response = ${err.message}`)
     } else scimgateway.logger.error(`${pluginName}[${baseEntity}] doRequest ${method} ${path} Body = ${JSON.stringify(body)} Error Response = ${err.message}`)
+    const clientIdentifier = getClientIdentifier(ctx)
     if (!retryCount) retryCount = 0
     let urlObj
     try { urlObj = new URL(path) } catch (err) {}
     if (!urlObj && (err.code === 'ECONNREFUSED' || err.code === 'ENOTFOUND' || err.code === 'ETIMEDOUT')) {
       if (retryCount < config.entity[baseEntity].baseUrls.length) {
         retryCount++
-        updateServiceClient(baseEntity, { baseUrl: config.entity[baseEntity].baseUrls[retryCount - 1] })
+        updateServiceClient(baseEntity, clientIdentifier, { baseUrl: config.entity[baseEntity].baseUrls[retryCount - 1] })
         scimgateway.logger.debug(`${pluginName}[${baseEntity}] ${(config.entity[baseEntity].baseUrls.length > 1) ? 'failover ' : ''}retry[${retryCount}] using baseUrl = ${_serviceClient[baseEntity].baseUrl}`)
-        const ret = await doRequest(baseEntity, method, path, body, opt, retryCount) // retry
+        const ret = await doRequest(baseEntity, method, path, body, ctx, opt, retryCount) // retry
         return ret // problem fixed
       } else {
         const newerr = new Error(err.message)
@@ -1132,17 +1159,21 @@ const doRequest = async (baseEntity, method, path, body, opt, retryCount) => {
         newerr.message = newerr.message.replace('ENOTFOUND', 'UnableConnectingHost') // avoid returning ENOTFOUND error
         throw newerr
       }
-    } else throw err // CA IM retries getUser failure once (retry 6 times on ECONNREFUSED)
+    } else {
+      if (statusCode === 401 && _serviceClient[baseEntity]) delete _serviceClient[baseEntity][clientIdentifier]
+      throw err // CA IM retries getUser failure once (retry 6 times on ECONNREFUSED)
+    }
   }
 } // doRequest
 
 //
 // getAccessToken - returns oauth jwt accesstoken
 //
-const getAccessToken = async (baseEntity) => {
+const getAccessToken = async (baseEntity, ctx) => {
   await lock.acquire()
+  const clientIdentifier = getClientIdentifier(ctx)
   const d = new Date() / 1000 // seconds (unix time)
-  if (_serviceClient[baseEntity] && _serviceClient[baseEntity].accessToken &&
+  if (_serviceClient[baseEntity] && _serviceClient[baseEntity][clientIdentifier] && _serviceClient[baseEntity][clientIdentifier].accessToken &&
    (_serviceClient[baseEntity].accessToken.validTo >= d + 30)) { // avoid simultaneously token requests
     lock.release()
     return _serviceClient[baseEntity].accessToken
@@ -1154,10 +1185,11 @@ const getAccessToken = async (baseEntity) => {
   const req = `https://login.microsoftonline.com/${config.entity[baseEntity].tenantIdGUID}/oauth2/token`
   const method = 'POST'
 
-  const form = { // to be query string formatted
+  const [, secret] = getCtxAuth(ctx) // if Auth PassTrough, secret from basic or bearer auth
+  const form = { // query string formatted
     grant_type: 'client_credentials',
     client_id: config.entity[baseEntity].clientId,
-    client_secret: scimgateway.getPassword(`endpoint.entity.${baseEntity}.clientSecret`, configFile),
+    client_secret: secret || scimgateway.getPassword(`endpoint.entity.${baseEntity}.clientSecret`, configFile), // using config if no Auth PassThrough
     resource: 'https://graph.microsoft.com'
   }
 
@@ -1168,7 +1200,7 @@ const getAccessToken = async (baseEntity) => {
   }
 
   try {
-    const response = await doRequest(baseEntity, method, req, form, options)
+    const response = await doRequest(baseEntity, method, req, form, ctx, options)
     if (!response.body) {
       const err = new Error(`[${action}] No data retrieved from: ${method} ${req}`)
       throw (err)
@@ -1194,7 +1226,7 @@ const getAccessToken = async (baseEntity) => {
   }
 }
 
-const getUser = async (baseEntity, uid, attributes) => { // uid = id, userName (upn) or externalId (upn)
+const getUser = async (baseEntity, uid, attributes, ctx) => { // uid = id, userName (upn) or externalId (upn)
   if (attributes.length < 1) {
     attributes = userAttributes
   }
@@ -1207,7 +1239,7 @@ const getUser = async (baseEntity, uid, attributes) => { // uid = id, userName (
         const path = `/users/${querystring.escape(uid)}?$expand=manager($select=userPrincipalName)` // beta returns all attributes or use: ?$select=${attrs.join()}
         const body = null
         try {
-          const response = await doRequest(baseEntity, method, path, body)
+          const response = await doRequest(baseEntity, method, path, body, ctx)
           const userObj = response.body
           if (!userObj) {
             const err = new Error('Got empty response when retrieving data for ' + uid)
@@ -1237,7 +1269,7 @@ const getUser = async (baseEntity, uid, attributes) => { // uid = id, userName (
         const retObj = { servicePlan: [] }
 
         try {
-          const response = await doRequest(baseEntity, method, path, body)
+          const response = await doRequest(baseEntity, method, path, body, ctx)
           if (!response.body.value) {
             const err = new Error('No content for license information ' + uid)
             return reject(err)