scimgateway 6.1.16 → 6.1.17

package/README.md

@@ -1051,7 +1051,7 @@ For testing purposes we could get an Azure free account
 Note: Entra ID has a role hierarchy, and running SCIM Gateway as a `User Administrator` has some limitations when administering users who have administrative roles. For full administrative access to all users, SCIM Gateway must have the `Global Administrator` role (`62e90394-69f5-4237-9190-012177145e10`). 
 
 Also note: The `plugin-entra-id.json` configuration file includes `map.user.signInActivity`. Using the `signInActivity` attribute requires an Entra ID Premium license and the API permission `AuditLog.Read.All`.
-**Remove this mapping configuration if these conditions are not met**, otherwise provisioning will fail and errors such as `Authentication_RequestFromNonPremiumTenantOrB2CTenant` may occur.
+**Remove this mapping configuration if these conditions are not met or override by configuring endpoint.entity.[baseEntity].skipSignInActivity = true**, otherwise provisioning will fail and errors such as `Authentication_RequestFromNonPremiumTenantOrB2CTenant` may occur.
 
 ### SCIM Gateway configuration  
 
@@ -1301,14 +1301,23 @@ In code editor (e.g., Visual Studio Code), method details and documentation are
  
 MIT © [Jarle Elshaug](https://www.elshaug.xyz)
 
+## Change log
+
+### v6.1.17
+
+[Fixed]
+
+- plugin-entra-id:
+
+  - Fixed an issue where `filter=userName eq "user_upn"` was broken in v6.1.11 when using the updated configuration file that includes `map.user.signInActivity`.
+  - Added new configuration option `endpoint.entity.[baseEntity].skipSignInActivity = true` to exclude the `signInActivity` attribute. This attribute requires a Microsoft Entra ID Premium license and the `AuditLog.Read.All` API permission.
+
 ### v6.1.16
 
 [Improved]
 
 - plugin-entra-id: `GET /Entitlements` using derivedIncludes, fully flattened (recursive expansion of previous includes).
 
-## Change log
-
 ### v6.1.15
 
 [Fixed]

package/config/plugin-entra-id.json

@@ -131,6 +131,7 @@
   "endpoint": {
     "entity": {
       "undefined": {
+        "skipSignInActivity": false,
         "connection": {
           "baseUrls": [],
           "auth": {

package/lib/plugin-entra-id.ts

@@ -158,6 +158,13 @@ scimgateway.getUsers = async (baseEntity, getObj, attributes, ctx) => {
     }
   } else selectAttributes = userSelectAttributes
 
+  if (config.entity[baseEntity]?.skipSignInActivity === true) { // remove signInActivity that requires Entra ID Premium license
+    const index = selectAttributes.indexOf('signInActivity')
+    if (index > -1) {
+      selectAttributes.splice(index, 1)
+    }
+  }
+
   const method = 'GET'
   const body = null
   let path
@@ -170,7 +177,7 @@ scimgateway.getUsers = async (baseEntity, getObj, attributes, ctx) => {
 
   // mandatory if-else logic - start
   if (getObj.operator) {
-    if (getObj.operator === 'eq' && ['id', 'userName', 'externalId'].includes(getObj.attribute)) {
+    if (getObj.operator === 'eq' && ['id'].includes(getObj.attribute)) { // userName/externalId using simpel filtering because direct lookup by upn do not allow select attribute signInActivity
       // mandatory - unique filtering - single unique user to be returned - correspond to getUser() in versions < 4.x.x
       path = `/users/${getObj.value}?$select=${selectAttributes.join(',')}`
     } else if (getObj.operator === 'eq' && getObj.attribute === 'group.value') {
@@ -848,7 +855,8 @@ scimgateway.getEntitlements = async (baseEntity, getObj, attributes, ctx) => {
         licenseInfo.derivedIncludes = licenseMapping[skuPartNumber].derivedIncludes
       }
       ret.Resources.push({
-        type: skuPartNumber, value: response.body.value[i].skuId, display: displayName, licenseInfo })
+        type: skuPartNumber, value: response.body.value[i].skuId, display: displayName, licenseInfo,
+      })
     }
 
     if (searchAttr && ret.Resources.length > 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scimgateway",
-  "version": "6.1.16",
+  "version": "6.1.17",
   "type": "module",
   "description": "Using SCIM protocol as a gateway for user provisioning to other endpoints",
   "author": "Jarle Elshaug <jarle.elshaug@gmail.com> (https://elshaug.xyz)",