scimgateway 4.5.6 → 4.5.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +59 -7
- package/config/plugin-api.json +2 -2
- package/config/plugin-entra-id.json +2 -2
- package/config/plugin-ldap.json +17 -4
- package/config/plugin-loki.json +2 -2
- package/config/plugin-mongodb.json +2 -2
- package/config/plugin-mssql.json +2 -2
- package/config/plugin-saphana.json +2 -2
- package/config/plugin-scim.json +2 -2
- package/config/plugin-soap.json +2 -2
- package/lib/plugin-ldap.js +462 -73
- package/lib/plugin-loki.js +16 -0
- package/lib/plugin-mongodb.js +18 -0
- package/lib/scim-stream.js +1 -1
- package/lib/scimgateway.js +155 -83
- package/lib/utils.js +8 -4
- package/package.json +2 -2
- package/test/lib/plugin-loki.js +28 -2
package/README.md
CHANGED
|
@@ -9,14 +9,14 @@ Validated through IdP's:
|
|
|
9
9
|
|
|
10
10
|
- Symantec/Broadcom/CA Identity Manager
|
|
11
11
|
- Microsoft Entra ID
|
|
12
|
-
- OneLogin
|
|
12
|
+
- One Identity/OneLogin
|
|
13
13
|
- Okta
|
|
14
14
|
- Omada
|
|
15
15
|
- SailPoint/IdentityNow
|
|
16
16
|
|
|
17
17
|
Latest news:
|
|
18
18
|
|
|
19
|
-
- Supports stream publishing mode having [SCIM Stream](https://elshaug.xyz/docs/scim-stream) as a prerequisite. In this mode, standard incoming SCIM requests from your Identity Provider (IdP) or API are directed and published to the stream. Subsequently, one of the gateways subscribing to the channel utilized by the publisher will manage the SCIM request, and response back. Using SCIM Stream we have egress/outbound
|
|
19
|
+
- Supports stream publishing mode having [SCIM Stream](https://elshaug.xyz/docs/scim-stream) as a prerequisite. In this mode, standard incoming SCIM requests from your Identity Provider (IdP) or API are directed and published to the stream. Subsequently, one of the gateways subscribing to the channel utilized by the publisher will manage the SCIM request, and response back. Using SCIM Stream we have only egress/outbound traffic and get loadbalancing/failover by adding more gateways subscribing to the same channel.
|
|
20
20
|
- **BREAKING**: [SCIM Stream](https://elshaug.xyz/docs/scim-stream) is the modern way of user provisioning letting clients subscribe to messages instead of traditional IGA top-down provisioning. SCIM Gateway now offers enhanced functionality with support for message subscription and automated provisioning using SCIM Stream
|
|
21
21
|
- Authentication PassThrough letting plugin pass authentication directly to endpoint for avoid maintaining secrets at the gateway. Kubernetes health checks and shutdown handler support
|
|
22
22
|
- Supports OAuth Client Credentials authentication
|
|
@@ -212,8 +212,8 @@ Below shows an example of config\plugin-saphana.json
|
|
|
212
212
|
"version": "2.0",
|
|
213
213
|
"skipTypeConvert" : false,
|
|
214
214
|
"skipMetaLocation" false,
|
|
215
|
-
"
|
|
216
|
-
"
|
|
215
|
+
"groupMemberOfUser": false
|
|
216
|
+
"usePutSoftSync" : false
|
|
217
217
|
},
|
|
218
218
|
"log": {
|
|
219
219
|
"loglevel": {
|
|
@@ -379,9 +379,9 @@ Definitions in `endpoint` object are customized according to our plugin code. Pl
|
|
|
379
379
|
|
|
380
380
|
- **scim.skipMetaLocation** - true or false, default false. If set to true, `meta.location` which contains protocol and hostname from request-url, will be excluded from response e.g. `"{...,meta":{"location":"https://my-company.com/<...>"}}`. If using reverse proxy and not including headers `X-Forwarded-Proto` and `X-Forwarded-Host`, originator will be the proxy and we might not want to expose internal protocol and hostname being used by the proxy request.
|
|
381
381
|
|
|
382
|
-
- **scim.
|
|
382
|
+
- **scim."groupMemberOfUser** - true or false, default false. If body contains groups and groupMemberOfUser=true, groups attribute will remain at user object (groups are member of user) instead of default user member of groups that will use modifyGroup method for maintaining group members.
|
|
383
383
|
|
|
384
|
-
- **scim.
|
|
384
|
+
- **scim.usePutSoftSync** - true or false, default false. `PUT /Users/bjensen` will replace the user bjensen with body content. If set to `true`, only PUT body content will be replaced. Any additional existing user attributes and groups supported by plugin will remain as-is.
|
|
385
385
|
|
|
386
386
|
- **log.loglevel.file** - off, error, info, or debug. Output to plugin-logfile e.g. `logs\plugin-saphana.log`
|
|
387
387
|
|
|
@@ -522,7 +522,7 @@ Definitions in `endpoint` object are customized according to our plugin code. Pl
|
|
|
522
522
|
|
|
523
523
|
## Manual startup
|
|
524
524
|
|
|
525
|
-
Gateway can
|
|
525
|
+
Gateway can be started from a command window running in administrative mode
|
|
526
526
|
|
|
527
527
|
3 ways to start:
|
|
528
528
|
|
|
@@ -1163,6 +1163,58 @@ MIT © [Jarle Elshaug](https://www.elshaug.xyz)
|
|
|
1163
1163
|
|
|
1164
1164
|
## Change log
|
|
1165
1165
|
|
|
1166
|
+
### v4.5.8
|
|
1167
|
+
|
|
1168
|
+
[Fixed]
|
|
1169
|
+
|
|
1170
|
+
- plugin-ldap failed when using national special characters and some other LDAP special characters in DN
|
|
1171
|
+
|
|
1172
|
+
Note, plugin-ldap now has following new configuration:
|
|
1173
|
+
|
|
1174
|
+
"ldap": {
|
|
1175
|
+
"isOpenLdap": false,
|
|
1176
|
+
...
|
|
1177
|
+
"namingAttribute": {
|
|
1178
|
+
"user": [
|
|
1179
|
+
{
|
|
1180
|
+
"attribute": "CN",
|
|
1181
|
+
"mapTo": "userName"
|
|
1182
|
+
}
|
|
1183
|
+
],
|
|
1184
|
+
"group": [
|
|
1185
|
+
{
|
|
1186
|
+
"attribute": "CN",
|
|
1187
|
+
"mapTo": "displayName"
|
|
1188
|
+
}
|
|
1189
|
+
]
|
|
1190
|
+
},
|
|
1191
|
+
...
|
|
1192
|
+
}
|
|
1193
|
+
|
|
1194
|
+
`isOpenLdap` true/false decides whether or not OpenLDAP Foundation protocol should be used for national characters and special characters in DN. For Active Directory, default isOpenLdap=false should be used.
|
|
1195
|
+
|
|
1196
|
+
`namingAttribute` can now be linked to scim `mapTo` attribute and is not hardcoded like it was in previous version.
|
|
1197
|
+
|
|
1198
|
+
Previous `userNamingAttr` and `groupNamingAttr` shown below, is now deprecated
|
|
1199
|
+
|
|
1200
|
+
"ldap": {
|
|
1201
|
+
...
|
|
1202
|
+
"userNamingAttr": "CN",
|
|
1203
|
+
"groupNamingAttr": "CN",
|
|
1204
|
+
...
|
|
1205
|
+
}
|
|
1206
|
+
|
|
1207
|
+
|
|
1208
|
+
### v4.5.7
|
|
1209
|
+
|
|
1210
|
+
[Fixed]
|
|
1211
|
+
|
|
1212
|
+
- PUT changes introduced in v4.4.6 did not handle PUT /Groups correctly
|
|
1213
|
+
|
|
1214
|
+
[Improved]
|
|
1215
|
+
- configuration scim.usePutGroupMemberOfUser replaced by scim.groupMemberOfUser
|
|
1216
|
+
- misc cosmetics
|
|
1217
|
+
|
|
1166
1218
|
### v4.5.6
|
|
1167
1219
|
|
|
1168
1220
|
[Improved]
|
package/config/plugin-api.json
CHANGED
package/config/plugin-ldap.json
CHANGED
|
@@ -7,8 +7,8 @@
|
|
|
7
7
|
"version": "2.0",
|
|
8
8
|
"skipTypeConvert": false,
|
|
9
9
|
"skipMetaLocation": false,
|
|
10
|
-
"
|
|
11
|
-
"
|
|
10
|
+
"groupMemberOfUser": false,
|
|
11
|
+
"usePutSoftSync": false
|
|
12
12
|
},
|
|
13
13
|
"log": {
|
|
14
14
|
"loglevel": {
|
|
@@ -139,12 +139,25 @@
|
|
|
139
139
|
"username": "CN=Administrator,CN=Users,DC=test,DC=com",
|
|
140
140
|
"password": "password",
|
|
141
141
|
"ldap": {
|
|
142
|
+
"isOpenLdap": false,
|
|
142
143
|
"userBase": "CN=Users,DC=test,DC=com",
|
|
143
144
|
"groupBase": "OU=Groups,DC=test,DC=com",
|
|
144
145
|
"userFilter": null,
|
|
145
146
|
"groupFilter": null,
|
|
146
|
-
"
|
|
147
|
-
|
|
147
|
+
"namingAttribute": {
|
|
148
|
+
"user": [
|
|
149
|
+
{
|
|
150
|
+
"attribute": "CN",
|
|
151
|
+
"mapTo": "userName"
|
|
152
|
+
}
|
|
153
|
+
],
|
|
154
|
+
"group": [
|
|
155
|
+
{
|
|
156
|
+
"attribute": "CN",
|
|
157
|
+
"mapTo": "displayName"
|
|
158
|
+
}
|
|
159
|
+
]
|
|
160
|
+
},
|
|
148
161
|
"userObjectClasses": [
|
|
149
162
|
"user",
|
|
150
163
|
"person",
|
package/config/plugin-loki.json
CHANGED
package/config/plugin-mssql.json
CHANGED
package/config/plugin-scim.json
CHANGED
package/config/plugin-soap.json
CHANGED