scimgateway 6.1.16 → 6.1.18

package/README.md

@@ -801,6 +801,7 @@ There are two options: run SCIM Gateway in a single image, or use Docker Compose
 	bun install scimgateway  
 	bun pm trust scimgateway  
 	cp ./config/docker/* .  
+	cp ./config/docker/.dockerignore . 
 	```
 
 	**Dockerfile**   <== Main dockerfile  
@@ -1051,7 +1052,7 @@ For testing purposes we could get an Azure free account
 Note: Entra ID has a role hierarchy, and running SCIM Gateway as a `User Administrator` has some limitations when administering users who have administrative roles. For full administrative access to all users, SCIM Gateway must have the `Global Administrator` role (`62e90394-69f5-4237-9190-012177145e10`). 
 
 Also note: The `plugin-entra-id.json` configuration file includes `map.user.signInActivity`. Using the `signInActivity` attribute requires an Entra ID Premium license and the API permission `AuditLog.Read.All`.
-**Remove this mapping configuration if these conditions are not met**, otherwise provisioning will fail and errors such as `Authentication_RequestFromNonPremiumTenantOrB2CTenant` may occur.
+**Remove this mapping configuration if these conditions are not met or override by configuring endpoint.entity.[baseEntity].skipSignInActivity = true**, otherwise provisioning will fail and errors such as `Authentication_RequestFromNonPremiumTenantOrB2CTenant` may occur.
 
 ### SCIM Gateway configuration  
 
@@ -1301,14 +1302,29 @@ In code editor (e.g., Visual Studio Code), method details and documentation are
  
 MIT © [Jarle Elshaug](https://www.elshaug.xyz)
 
+## Change log
+
+### v6.1.18
+
+[Fixed]
+
+- createUser and modifyUser returns full user object. Some endpoints like Entra ID hasn’t caught up yet due to internal sync and changes are not reflected. This update ensure returned user object contains what have been modified.
+
+### v6.1.17
+
+[Fixed]
+
+- plugin-entra-id:
+
+  - Fixed an issue where `filter=userName eq "user_upn"` was broken in v6.1.11 when using the updated configuration file that includes `map.user.signInActivity`.
+  - Added new configuration option `endpoint.entity.[baseEntity].skipSignInActivity = true` to exclude the `signInActivity` attribute. This attribute requires a Microsoft Entra ID Premium license and the `AuditLog.Read.All` API permission.
+
 ### v6.1.16
 
 [Improved]
 
 - plugin-entra-id: `GET /Entitlements` using derivedIncludes, fully flattened (recursive expansion of previous includes).
 
-## Change log
-
 ### v6.1.15
 
 [Fixed]

package/config/plugin-entra-id.json

@@ -131,6 +131,7 @@
   "endpoint": {
     "entity": {
       "undefined": {
+        "skipSignInActivity": false,
         "connection": {
           "baseUrls": [],
           "auth": {

package/lib/azure-license-mapping.json

@@ -19,6 +19,19 @@
 "O365_w/o_Teams_Bundle_M5":{"displayName":"Office 365 without Teams Bundle M5","category":"Microsoft 365","licenseCategory":"Paid","isBillable":true,"priceUSD":28,"includes":["ENTERPRISEPACK","EXCHANGESTANDARD","SHAREPOINTSTANDARD"],"derivedIncludes":["EXCHANGEENTERPRISE","SHAREPOINTENTERPRISE","MCOSTANDARD","ONEDRIVESTANDARD","INTUNE_A","AAD_PREMIUM","EXCHANGESTANDARD","SHAREPOINTSTANDARD"]},
 "POWER_BI_PREMIUM_PER_USER":{"displayName":"Power BI Premium Per User","category":"Power Platform","licenseCategory":"Paid","isBillable":true,"priceUSD":20,"includes":["POWER_BI_PRO"],"derivedIncludes":["POWER_BI_PRO"]},
 "RMS_S_PREMIUM":{"displayName":"Azure Information Protection Premium P2","category":"Security","licenseCategory":"Paid","isBillable":true,"priceUSD":9,"includes":["RMS_S_ENTERPRISE"],"derivedIncludes":["RMS_S_ENTERPRISE"]},
+"O365_BUSINESS_ESSENTIALS":{"displayName":"Microsoft 365 Business Basic","category":"Microsoft 365","licenseCategory":"Paid","isBillable":true,"priceUSD":6,"includes":["EXCHANGESTANDARD","SHAREPOINTSTANDARD","MCOSTANDARD","ONEDRIVESTANDARD"],"derivedIncludes":["EXCHANGESTANDARD","SHAREPOINTSTANDARD","MCOSTANDARD","ONEDRIVESTANDARD"]},
+"M365_BUSINESS_BASIC":{"displayName":"Microsoft 365 Business Basic","category":"Microsoft 365","licenseCategory":"Paid","isBillable":true,"priceUSD":6,"includes":["EXCHANGESTANDARD","SHAREPOINTSTANDARD","MCOSTANDARD","ONEDRIVESTANDARD"],"derivedIncludes":["EXCHANGESTANDARD","SHAREPOINTSTANDARD","MCOSTANDARD","ONEDRIVESTANDARD"]},
+"M365_BUSINESS_STANDARD":{"displayName":"Microsoft 365 Business Standard","category":"Microsoft 365","licenseCategory":"Paid","isBillable":true,"priceUSD":12,"includes":["EXCHANGESTANDARD","SHAREPOINTSTANDARD","MCOSTANDARD","ONEDRIVESTANDARD"],"derivedIncludes":["EXCHANGESTANDARD","SHAREPOINTSTANDARD","MCOSTANDARD","ONEDRIVESTANDARD"]},
+"M365_BUSINESS_PREMIUM":{"displayName":"Microsoft 365 Business Premium","category":"Microsoft 365","licenseCategory":"Paid","isBillable":true,"priceUSD":22,"includes":["EXCHANGESTANDARD","SHAREPOINTSTANDARD","MCOSTANDARD","ONEDRIVESTANDARD","INTUNE_A","AAD_PREMIUM"],"derivedIncludes":["EXCHANGESTANDARD","SHAREPOINTSTANDARD","MCOSTANDARD","ONEDRIVESTANDARD","INTUNE_A","AAD_PREMIUM"]},
+"ENTRA_ID_GOVERNANCE":{"displayName":"Microsoft Entra ID Governance","category":"Entra","licenseCategory":"Paid","isBillable":true,"priceUSD":7,"includes":["AAD_PREMIUM_P2"],"derivedIncludes":["AAD_PREMIUM_P2","AAD_PREMIUM"]},
+"Microsoft_365_F1":{"displayName":"Microsoft 365 F1","category":"Microsoft 365","licenseCategory":"Paid","isBillable":true,"priceUSD":2.25,"includes":["EXCHANGESTANDARD","SHAREPOINTSTANDARD","MCOSTANDARD","ONEDRIVESTANDARD"],"derivedIncludes":["EXCHANGESTANDARD","SHAREPOINTSTANDARD","MCOSTANDARD","ONEDRIVESTANDARD"]},
+"ENTRA_IDENTITY_PROTECTION":{"displayName":"Microsoft Entra ID Protection","category":"Entra","licenseCategory":"Paid","isBillable":true,"priceUSD":6,"includes":["AAD_PREMIUM_P2"],"derivedIncludes":["AAD_PREMIUM_P2","AAD_PREMIUM"]},
+"ENTRA_IDENTITY_GOVERNANCE_STEPUP":{"displayName":"Microsoft Entra ID Governance Step-Up","category":"Entra","licenseCategory":"Paid","isBillable":true,"priceUSD":4,"includes":["AAD_PREMIUM_P1"],"derivedIncludes":["AAD_PREMIUM_P1"]},
+"ENTRA_PERMISSIONS_MANAGEMENT":{"displayName":"Microsoft Entra Permissions Management","category":"Entra","licenseCategory":"Paid","isBillable":true,"priceUSD":10,"includes":[]},
+"AAD_PREMIUM_P1":{"displayName":"Microsoft Entra ID P1","category":"Entra","licenseCategory":"Paid","isBillable":true,"priceUSD":6,"includes":[]},
+"AAD_B2C":{"displayName":"Azure AD B2C","category":"Entra","licenseCategory":"Consumption","isBillable":true,"priceUSD":0,"includes":[]},
+"AAD_BASIC_EDU":{"displayName":"Azure Active Directory Basic (Education)","category":"Entra","licenseCategory":"Free","isBillable":false,"priceUSD":0,"includes":[]},
+"M365_DEFENDER_IDENTITY":{"displayName":"Microsoft 365 Defender for Identity","category":"Security","licenseCategory":"Paid","isBillable":true,"priceUSD":6,"includes":[]},
 "Microsoft_Teams_EEA_New": { "displayName": "Microsoft Teams EEA New", "category": "Collaboration", "licenseCategory": "Paid", "isBillable": true, "priceUSD": 4.00, "includes": [] },
 "POWERAPPS_DEV": { "displayName": "Power Apps Developer Plan", "category": "Power Platform", "licenseCategory": "Free", "isBillable": false, "priceUSD": 0.00, "includes": [] },
 "EXCHANGESTANDARD":{"displayName":"Exchange Online Plan 1","category":"Exchange","licenseCategory":"Paid","isBillable":true,"priceUSD":4,"includes":[]},

package/lib/plugin-entra-id.ts

@@ -158,6 +158,13 @@ scimgateway.getUsers = async (baseEntity, getObj, attributes, ctx) => {
     }
   } else selectAttributes = userSelectAttributes
 
+  if (config.entity[baseEntity]?.skipSignInActivity === true) { // remove signInActivity that requires Entra ID Premium license
+    const index = selectAttributes.indexOf('signInActivity')
+    if (index > -1) {
+      selectAttributes.splice(index, 1)
+    }
+  }
+
   const method = 'GET'
   const body = null
   let path
@@ -170,7 +177,7 @@ scimgateway.getUsers = async (baseEntity, getObj, attributes, ctx) => {
 
   // mandatory if-else logic - start
   if (getObj.operator) {
-    if (getObj.operator === 'eq' && ['id', 'userName', 'externalId'].includes(getObj.attribute)) {
+    if (getObj.operator === 'eq' && ['id'].includes(getObj.attribute)) { // userName/externalId using simpel filtering because direct lookup by upn do not allow select attribute signInActivity
       // mandatory - unique filtering - single unique user to be returned - correspond to getUser() in versions < 4.x.x
       path = `/users/${getObj.value}?$select=${selectAttributes.join(',')}`
     } else if (getObj.operator === 'eq' && getObj.attribute === 'group.value') {
@@ -815,7 +822,7 @@ scimgateway.getEntitlements = async (baseEntity, getObj, attributes, ctx) => {
     throw new Error(`${action} error: advanced filtering not supported: ${getObj.rawFilter}`)
   } else {
     // mandatory - no filtering
-    path = `/subscribedSkus`
+    path = '/subscribedSkus'
   }
 
   if (!path) throw new Error(`${action} error: mandatory if-else logic not fully implemented`)
@@ -848,7 +855,8 @@ scimgateway.getEntitlements = async (baseEntity, getObj, attributes, ctx) => {
         licenseInfo.derivedIncludes = licenseMapping[skuPartNumber].derivedIncludes
       }
       ret.Resources.push({
-        type: skuPartNumber, value: response.body.value[i].skuId, display: displayName, licenseInfo })
+        type: skuPartNumber, value: response.body.value[i].skuId, display: displayName, licenseInfo,
+      })
     }
 
     if (searchAttr && ret.Resources.length > 0) {

package/lib/plugin-loki.ts

@@ -281,116 +281,10 @@ scimgateway.modifyUser = async (baseEntity, id, attrObj, ctx) => {
   const res = users.find({ id: id })
   if (res.length === 0) throw new Error(`${action} error: user id=${id} - user does not exist`)
   if (res.length > 1) throw new Error(`${action} error: user id=${id} - user is not unique, more than one have been found`)
-  const userObj: any = res[0]
-
-  for (const key in attrObj) {
-    if (Array.isArray(attrObj[key])) { // standard, not using type (e.g roles/groups) or skipTypeConvert=true
-      const delArr = attrObj[key].filter(el => el.operation === 'delete')
-      const addArr = attrObj[key].filter(el => (!el.operation || el.operation !== 'delete'))
-      if (!userObj[key] || !Array.isArray(userObj[key])) userObj[key] = []
-      // delete
-      userObj[key] = userObj[key].filter((el: Record<string, any>) => {
-        const index = delArr.findIndex((e) => {
-          let elExist = false
-          for (const k in e) {
-            if (k === 'primary' || k === 'operation') continue
-            if (e[k] !== el[k]) {
-              elExist = false
-              break
-            }
-            elExist = true
-          }
-          return elExist
-        })
-        if (index >= 0) return false
-        else return true
-      })
-      // add
-      addArr.forEach((el) => {
-        if (Object.prototype.hasOwnProperty.call(el, 'primary')) {
-          if (el.primary === true || (typeof el.primary === 'string' && el.primary.toLowerCase() === 'true')) {
-            const index = userObj[key].findIndex((e: Record<string, any>) => e.primary === el.primary)
-            if (index >= 0) {
-              if (key === 'roles') userObj[key].splice(index, 1) // roles, delete existing role having primary attribute true (new role with primary will be added)
-              else userObj[key][index].primary = undefined // remove primary attribute, only one primary
-            }
-          }
-        }
-        const index = userObj[key].findIndex((e: Record<string, any>, _index: number) => { // avoid adding existing
-          if (el.value && el.value === e.value && el.type === e.type) {
-            for (const k in el) {
-              e[k] = el[k]
-            }
-            return true
-          }
-          let elExist = false
-          for (const k in el) {
-            if (el[k] !== e[k]) {
-              if (k === 'primary') continue
-              elExist = false
-              break
-            }
-            elExist = true
-          }
-          return elExist
-        })
-        if (index < 0) userObj[key].push(el)
-      })
-    } else if (scimgateway.isMultiValueTypes(key)) { // "type converted object" logic and original blank type having type "undefined"
-      if (!attrObj[key]) delete userObj[key] // blank or null
-      for (const el in attrObj[key]) {
-        attrObj[key][el].type = el
-        if (attrObj[key][el].operation && attrObj[key][el].operation === 'delete') { // delete multivalue
-          let type: any = el
-          if (type === 'undefined') type = undefined
-          userObj[key] = userObj[key].filter((e: Record<string, any>) => e.type !== type)
-          if (userObj[key].length < 1) delete userObj[key]
-        } else { // modify/create multivalue
-          if (!userObj[key]) userObj[key] = []
-          if (attrObj[key][el].primary) { // remove any existing primary attribute, should only have one primary set
-            const primVal = attrObj[key][el].primary
-            if (primVal === true || (typeof primVal === 'string' && primVal.toLowerCase() === 'true')) {
-              const index = userObj[key].findIndex((e: Record<string, any>) => e.primary === primVal)
-              if (index >= 0) {
-                userObj[key][index].primary = undefined
-              }
-            }
-          }
-          const found = userObj[key].find((e: Record<string, any>, i: any) => {
-            if (e.type === el || (!e.type && el === 'undefined')) {
-              for (const k in attrObj[key][el]) {
-                userObj[key][i][k] = attrObj[key][el][k]
-                if (k === 'type' && attrObj[key][el][k] === 'undefined') delete userObj[key][i][k] // don't store with type "undefined"
-              }
-              return true
-            } else return false
-          })
-          if (attrObj[key][el].type && attrObj[key][el].type === 'undefined') delete attrObj[key][el].type // don't store with type "undefined"
-          if (!found) userObj[key].push(attrObj[key][el]) // create
-        }
-      }
-    } else {
-      // None multi value attribute, blank will be deleted
-      if (typeof (attrObj[key]) === 'object' && attrObj[key] !== null) {
-        // name.familyName=Bianchi
-        if (!userObj[key]) userObj[key] = {} // e.g name object does not exist
-        for (const sub in attrObj[key]) {
-          if (!userObj[key]) userObj[key] = {}
-          if (Object.prototype.hasOwnProperty.call(attrObj[key][sub], 'value')
-            && attrObj[key][sub].value === '') delete userObj[key][sub] // object having blank value attribute e.g. {"manager": {"value": "",...}}
-          else if (attrObj[key][sub] === '') delete userObj[key][sub]
-          else {
-            if (!userObj[key]) userObj[key] = {} // may have been deleted by length check below
-            userObj[key][sub] = attrObj[key][sub]
-          }
-          if (Object.keys(userObj[key]).length < 1) delete userObj[key]
-        }
-      } else {
-        if (attrObj[key] === '') delete userObj[key]
-        else userObj[key] = attrObj[key]
-      }
-    }
-  }
+
+  let userObj: any = res[0]
+  userObj = scimgateway.patchObj(userObj, attrObj) // merge
+
   await users.update(userObj) // needed for persistence
   return null
 }

package/lib/plugin-mongodb.ts

@@ -354,121 +354,7 @@ scimgateway.modifyUser = async (baseEntity, id, attrObj, ctx) => {
   }
 
   let userObj = decodeDotDate(res[0])
-
-  for (const key in attrObj) {
-    if (Array.isArray(attrObj[key])) { // standard, not using type (e.g roles/groups) or skipTypeConvert=true
-      const delArr = attrObj[key].filter(el => el.operation === 'delete')
-      const addArr = attrObj[key].filter(el => (!el.operation || el.operation !== 'delete'))
-      if (!userObj[key] || !Array.isArray(userObj[key])) userObj[key] = []
-      // delete
-      userObj[key] = userObj[key].filter((el: Record<string, any>) => {
-        const index = delArr.findIndex((e) => {
-          let elExist = false
-          for (const k in e) {
-            if (k === 'primary' || k === 'operation') continue
-            if (e[k] !== el[k]) {
-              elExist = false
-              break
-            }
-            elExist = true
-          }
-          return elExist
-        })
-        if (index >= 0) return false
-        else return true
-      })
-      // add
-      addArr.forEach((el) => {
-        if (Object.prototype.hasOwnProperty.call(el, 'primary')) {
-          if (el.primary === true || (typeof el.primary === 'string' && el.primary.toLowerCase() === 'true')) {
-            const index = userObj[key].findIndex((e: Record<string, any>) => e.primary === el.primary)
-            if (index >= 0) {
-              if (key === 'roles') userObj[key].splice(index, 1) // roles, delete existing role having primary attribute true (new role with primary will be added)
-              else userObj[key][index].primary = undefined // remove primary attribute, only one primary
-            }
-          }
-        }
-        const index = userObj[key].findIndex((e: Record<string, any>, _index: number) => { // avoid adding existing
-          if (el.value && el.value === e.value && el.type === e.type) {
-            for (const k in el) {
-              e[k] = el[k]
-            }
-            return true
-          }
-          let elExist = false
-          for (const k in el) {
-            if (el[k] !== e[k]) {
-              if (k === 'primary') continue
-              elExist = false
-              break
-            }
-            elExist = true
-          }
-          return elExist
-        })
-        if (index < 0) userObj[key].push(el)
-      })
-    } else if (scimgateway.isMultiValueTypes(key)) { // "type converted object" logic and original blank type having type "undefined"
-      if (!attrObj[key]) delete userObj[key] // blank or null
-      for (const el in attrObj[key]) {
-        attrObj[key][el].type = el
-        if (attrObj[key][el].operation && attrObj[key][el].operation === 'delete') { // delete multivalue
-          let type: any = el
-          if (type === 'undefined') type = undefined
-          userObj[key] = userObj[key].filter((e: Record<string, any>) => e.type !== type)
-          if (userObj[key].length < 1) delete userObj[key]
-        } else { // modify/create multivalue
-          if (!userObj[key]) userObj[key] = []
-          if (attrObj[key][el].primary) { // remove any existing primary attribute, should only have one primary set
-            const primVal = attrObj[key][el].primary
-            if (primVal === true || (typeof primVal === 'string' && primVal.toLowerCase() === 'true')) {
-              const index = userObj[key].findIndex((e: Record<string, any>) => e.primary === primVal)
-              if (index >= 0) {
-                userObj[key][index].primary = undefined
-              }
-            }
-          }
-          const found = userObj[key].find((e: Record<string, any>, i: any) => {
-            if (e.type === el || (!e.type && el === 'undefined')) {
-              for (const k in attrObj[key][el]) {
-                userObj[key][i][k] = attrObj[key][el][k]
-                if (k === 'type' && attrObj[key][el][k] === 'undefined') delete userObj[key][i][k] // don't store with type "undefined"
-              }
-              return true
-            } else return false
-          })
-          if (attrObj[key][el].type && attrObj[key][el].type === 'undefined') delete attrObj[key][el].type // don't store with type "undefined"
-          if (!found) userObj[key].push(attrObj[key][el]) // create
-        }
-      }
-    } else {
-      // None multi value attribute
-      if (typeof (attrObj[key]) !== 'object' || attrObj[key] === null) {
-        if (attrObj[key] === '' || attrObj[key] === null) delete userObj[key]
-        else userObj[key] = attrObj[key]
-      } else {
-      // None multi value attribute, blank will be deleted
-        if (typeof (attrObj[key]) === 'object' && attrObj[key] !== null) {
-        // name.familyName=Bianchi
-          if (!userObj[key]) userObj[key] = {} // e.g name object does not exist
-          for (const sub in attrObj[key]) {
-            if (!userObj[key]) userObj[key] = {}
-            if (Object.prototype.hasOwnProperty.call(attrObj[key][sub], 'value')
-              && attrObj[key][sub].value === '') delete userObj[key][sub] // object having blank value attribute e.g. {"manager": {"value": "",...}}
-            else if (attrObj[key][sub] === '') delete userObj[key][sub]
-            else {
-              if (!userObj[key]) userObj[key] = {} // may have been deleted by length check below
-              userObj[key][sub] = attrObj[key][sub]
-            }
-            if (Object.keys(userObj[key]).length < 1) delete userObj[key]
-          }
-        } else {
-          if (attrObj[key] === '') delete userObj[key]
-          else userObj[key] = attrObj[key]
-        }
-      }
-    }
-  }
+  userObj = scimgateway.patchObj(userObj, attrObj) // merge
 
   if (!userObj.meta) {
     const now = Date.now()

package/lib/scimgateway.ts

@@ -250,6 +250,9 @@ export class ScimGateway {
   /** getEntitlements returns endpoint supported entitlements - e.g., plugin-entra-id returns available Entra tenant licenses as entitlements */
   getEntitlements!: (baseEntity: string, getObj: Record<string, any>, attributes: Array<string>, ctx?: undefined | Record<string, any>) => any
 
+  /** getRoles returns endpoint supported roles - e.g., plugin-entra-id returns Entra permanent and eligible roles */
+  getRoles!: (baseEntity: string, getObj: Record<string, any>, attributes: Array<string>, ctx?: undefined | Record<string, any>) => any
+
   /**
   * postApi method is defined at the plugin and should handle incoming `"POST /api"` for creating an object and should be used according to your needs  
   * @param baseEntity used for multi tenant or multi endpoint support, either "undefined" or set by request url e.g., http://localhost:8880/loki2/Users gives baseEntity=loki2
@@ -488,12 +491,16 @@ export class ScimGateway {
       description: 'Entitlement',
       getMethod: 'getEntitlements',
     }
+    handler.Roles = handler.roles = {
+      description: 'Role',
+      getMethod: 'getRoles',
+    }
     handler.AppRoles = handler.approles = { // scim-stream
       description: 'AppRole',
       getMethod: 'getAppRoles',
     }
     /** handlers supported url paths */
-    const handlers = ['users', 'groups', 'bulk', 'entitlements', 'approles', 'api', 'schemas', 'resourcetypes', 'serviceproviderconfig', 'serviceproviderconfigs', 'oauth', '.well-known', 'logger']
+    const handlers = ['users', 'groups', 'bulk', 'entitlements', 'roles', 'approles', 'api', 'schemas', 'resourcetypes', 'serviceproviderconfig', 'serviceproviderconfigs', 'oauth', '.well-known', 'logger']
 
     try {
       if (!fs.existsSync(configDir + '/wsdls')) fs.mkdirSync(configDir + '/wsdls')
@@ -889,12 +896,45 @@ export class ScimGateway {
             if (parts.length === 1) {
               const org = scimResource.attributes.find((r: any) => r.name === item.mapTo)
               let attr: any
-              if (org) attr = structuredClone(org) // reusing original SCIM definition
-              else {
+              if (org) { // reusing original SCIM definition
+                attr = structuredClone(org)
+                if (item.subAttributes && Array.isArray(item.subAttributes) && attr?.subAttributes && Array.isArray(attr.subAttributes)) {
+                  // any configuration subAttributes takes precidence
+                  for (const el of item.subAttributes) {
+                    if (typeof el !== 'object' || !el.name) continue
+                    const existingSub = attr.subAttributes.find((sa: any) => sa.name === el.name)
+                    if (existingSub) {
+                      if (el.description) existingSub.description = el.description
+                      if (el.mutability) existingSub.mutability = el.mutability
+                      if (el.canonicalValues) existingSub.canonicalValues = el.canonicalValues
+                    } else {
+                      const newSub: Record<string, any> = {
+                        name: el.name,
+                        type: el.type ?? 'string',
+                        multiValued: el.mulitvalue ?? false,
+                        description: el.description ?? '',
+                        required: false,
+                        caseExact: false,
+                        mutability: el.mutability ?? 'readWrite',
+                        returned: 'default',
+                        uniqueness: 'none',
+                      }
+                      if (el.canonicalValues) newSub.canonicalValues = el.canonicalValues
+                      if (isV1) {
+                        newSub.readOnly = newSub.mutability === 'readOnly'
+                        delete newSub.mutability
+                        delete newSub.returned
+                        delete newSub.uniqueness
+                      }
+                      attr.subAttributes.push(newSub)
+                    }
+                  }
+                }
+              } else {
                 attr = {
                   name: item.mapTo,
                   type: (item.type === 'boolean') ? item.type : 'string',
-                  multiValued: item.type === 'array' ? true : false,
+                  multiValued: (item.type === 'array' || item.type === 'complexArray') ? true : false,
                   description: item.description ?? '',
                   required: (item.mapTo === 'userName') ? true : false,
                   caseExact: false,
@@ -902,10 +942,33 @@ export class ScimGateway {
                   returned: 'default',
                   uniqueness: (item.mapTo === 'userName') ? 'server' : 'none',
                 }
-                if (item.type === 'complexObject') {
+                if (item.type === 'complexObject' || item.type === 'complexArray') {
                   attr.type = 'complex'
                   attr.multiValued = false
                   attr.subAttributes = []
+                  if (item.subAttributes && Array.isArray(item.subAttributes)) {
+                    for (const el of item.subAttributes) {
+                      if (typeof el !== 'object' || el === null || !el.name) continue
+                      const obj: Record<string, any> = {
+                        name: el.name,
+                        type: el.type ?? 'string',
+                        multiValued: el.mulitvalue ?? false,
+                        description: el.description ?? '',
+                        required: false,
+                        caseExact: false,
+                        mutability: el.mutability ?? 'readWrite',
+                        returned: 'default',
+                        uniqueness: 'none',
+                      }
+                      if (isV1) {
+                        obj.readOnly = false
+                        delete obj.mutability
+                        delete obj.returned
+                        delete obj.uniqueness
+                      }
+                      attr.subAttributes.push(obj)
+                    }
+                  }
                 }
               }
               if (item['x-agent-schema']) {
@@ -1343,10 +1406,10 @@ export class ScimGateway {
       const baseEntity = ctx.routeObj.baseEntity
       const id = decodeURIComponent(path.basename(ctx.routeObj.id ?? '', '.json')) // supports <id>.json
 
-      if (!id || handle.getMethod === 'getEntitlements') {
+      if (!id || handle.getMethod === 'getEntitlements' || handle.getMethod === 'getRoles') {
         let err: Error
         if (!id) err = new Error('missing id')
-        else err = new Error(`GET /${handle.description}/${id} is not supported. Instead use filter query on users e.g., /users?filter=entitlements[value eq "xxx"]`)
+        else err = new Error(`GET /${handle.description}/${id} is not supported. Instead use filter query on users e.g., /users?filter=entitlements[value eq "xxx"] or /users?filter=roles[value eq "xxx"]`)
         const [e, statusCode] = utilsScim.jsonErr(this.config.scimgateway.scim.version, pluginName, 500, err)
         ctx.response.status = statusCode
         ctx.response.body = JSON.stringify(e)
@@ -1449,6 +1512,7 @@ export class ScimGateway {
     //           getUsers
     //           getGroups
     //           getEntitlements
+    //           getRoles
     // ==========================================
     const getHandler = async (ctx: Context) => {
       const handle = handler[ctx.routeObj.handle]
@@ -1493,7 +1557,7 @@ export class ScimGateway {
       }
 
       let err
-      if (handle.getMethod === 'getEntitlements') {
+      if (handle.getMethod === 'getEntitlements' || handle.getMethod === 'getRoles') {
         if (typeof (this as any)[handle.getMethod] !== 'function') err = new Error(`plugin method ${handle.getMethod}() not implemented`)
       }
       if (!err && getObj.attribute) {
@@ -1844,6 +1908,7 @@ export class ScimGateway {
           logger.warn(`${gwName} ${handle.createMethod} succeeded, but corresponding ${handle.getMethod} ${obj?.value} failed with error: ${err.message}`, { baseEntity: ctx?.routeObj?.baseEntity })
         }
         if (res?.Resources && Array.isArray(res.Resources) && res.Resources.length === 1) {
+          utils.extendObj(res.Resources[0], jsonBody) // we might have endpoint like Entra ID that hasn’t caught up yet due to internal sync - ensure returned object reflects changes by doing a merge with patch payload (convertedScim) 
           jsonBody = res.Resources[0]
         }
         delete jsonBody.password
@@ -2119,7 +2184,15 @@ export class ScimGateway {
           const ob = { attribute: 'id', operator: 'eq', value: id }
           logger.debug(`${gwName} calling ${handle.getMethod}`, { baseEntity: ctx?.routeObj?.baseEntity })
           res = await (this as any)[handle.getMethod](baseEntity, ob, [], ctx.passThrough)
+
+          if (res?.Resources && Array.isArray(res.Resources) && res.Resources.length === 1) {
+            // we might have endpoint like Entra ID that hasn’t caught up yet due to internal sync
+            // ensure returned object reflects changes by doing a merge with patch payload (convertedScim) 
+            res.Resources[0] = this.patchObj(res.Resources[0], finalScimdata) // merge
+            if (res.Resources[0].password) delete res.Resources[0].password
+          }
         }
+
         return response(res)
       } catch (err: any) {
         // check if error caused by: add existing member or remove none existing member => should not be an error
@@ -3430,6 +3503,7 @@ export class ScimGateway {
           case 'GET users':
           case 'GET groups':
           case 'GET entitlements':
+          case 'GET roles':
             if (ctx.routeObj.id) await getHandlerId(ctx)
             else await getHandler(ctx)
             return await onAfterHandle(ctx)
@@ -3952,6 +4026,17 @@ export class ScimGateway {
     return null
   }
 
+  /**
+  * patchObj returns object updated with the modify user PATCH convertedScim which is sent to plugin
+  * @param userObj "user object"
+  * @param attrObj "the attrObj (convertedSCIM PATCH payload) sent to plugin"
+  * @returns "user object updated according to PATCH payload -  attrObj"
+  **/
+  patchObj(userObj: Record<string, any>, attrObj: Record<string, any>): any {
+    const isMultiValueTypes = (attr: string) => this.isMultiValueTypes(attr)
+    return utilsScim.patchObj(userObj, attrObj, isMultiValueTypes)
+  }
+
   /**
   * endpointMapper maps inbound SCIM and outbound endpoint attributes both ways
   * @param direction 'outbound' (to the endpoint) or 'inbound' (SCIM response) 

package/lib/utils-scim.ts

@@ -376,6 +376,126 @@ export function convertedScim20(obj: any, multiValueTypes: string[]): any {
   return convertedScim(scimdata, multiValueTypes)
 }
 
+/**
+* patchObj updates userObj with the PATCH convertedScim body sent to plugin
+*/
+export function patchObj(userObj: Record<string, any>, attrObj: Record<string, any>, isMultiValueTypes: (attribute: string) => boolean): any {
+  if (typeof userObj !== 'object') return userObj
+  if (typeof attrObj !== 'object') return userObj
+
+  for (const key in attrObj) {
+    if (Array.isArray(attrObj[key])) { // standard, not using type (e.g roles/groups) or skipTypeConvert=true
+      const delArr = attrObj[key].filter(el => el.operation === 'delete')
+      const addArr = attrObj[key].filter(el => (!el.operation || el.operation !== 'delete'))
+      if (!userObj[key] || !Array.isArray(userObj[key])) userObj[key] = []
+      // delete
+      userObj[key] = userObj[key].filter((el: Record<string, any>) => {
+        const index = delArr.findIndex((e) => {
+          let elExist = false
+          for (const k in e) {
+            if (k === 'primary' || k === 'operation') continue
+            if (e[k] !== el[k]) {
+              elExist = false
+              break
+            }
+            elExist = true
+          }
+          return elExist
+        })
+        if (index >= 0) return false
+        else return true
+      })
+      // add
+      addArr.forEach((el) => {
+        if (Object.prototype.hasOwnProperty.call(el, 'primary')) {
+          if (el.primary === true || (typeof el.primary === 'string' && el.primary.toLowerCase() === 'true')) {
+            const index = userObj[key].findIndex((e: Record<string, any>) => e.primary === el.primary)
+            if (index >= 0) {
+              if (key === 'roles') userObj[key].splice(index, 1) // roles, delete existing role having primary attribute true (new role with primary will be added)
+              else userObj[key][index].primary = undefined // remove primary attribute, only one primary
+            }
+          }
+        }
+        const index = userObj[key].findIndex((e: Record<string, any>, _index: number) => { // avoid adding existing
+          if (el.value && el.value === e.value && el.type === e.type) {
+            for (const k in el) {
+              e[k] = el[k]
+            }
+            return true
+          }
+          let elExist = false
+          for (const k in el) {
+            if (el[k] !== e[k]) {
+              if (k === 'primary') continue
+              elExist = false
+              break
+            }
+            elExist = true
+          }
+          return elExist
+        })
+        if (index < 0) userObj[key].push(el)
+      })
+    } else if (isMultiValueTypes(key)) { // "type converted object" logic and original blank type having type "undefined"
+      if (!attrObj[key]) delete userObj[key] // blank or null
+      for (const el in attrObj[key]) {
+        attrObj[key][el].type = el
+        if (attrObj[key][el].operation && attrObj[key][el].operation === 'delete') { // delete multivalue
+          let type: any = el
+          if (type === 'undefined') type = undefined
+          if (Array.isArray(userObj[key])) {
+            userObj[key] = userObj[key].filter((e: Record<string, any>) => e.type !== type)
+            if (userObj[key].length < 1) delete userObj[key]
+          }
+        } else { // modify/create multivalue
+          if (!userObj[key]) userObj[key] = []
+          if (attrObj[key][el].primary) { // remove any existing primary attribute, should only have one primary set
+            const primVal = attrObj[key][el].primary
+            if (primVal === true || (typeof primVal === 'string' && primVal.toLowerCase() === 'true')) {
+              const index = userObj[key].findIndex((e: Record<string, any>) => e.primary === primVal)
+              if (index >= 0) {
+                userObj[key][index].primary = undefined
+              }
+            }
+          }
+          const found = userObj[key].find((e: Record<string, any>, i: any) => {
+            if (e.type === el || (!e.type && el === 'undefined')) {
+              for (const k in attrObj[key][el]) {
+                userObj[key][i][k] = attrObj[key][el][k]
+                if (k === 'type' && attrObj[key][el][k] === 'undefined') delete userObj[key][i][k] // don't store with type "undefined"
+              }
+              return true
+            } else return false
+          })
+          if (attrObj[key][el].type && attrObj[key][el].type === 'undefined') delete attrObj[key][el].type // don't store with type "undefined"
+          if (!found) userObj[key].push(attrObj[key][el]) // create
+        }
+      }
+    } else {
+      // None multi value attribute, blank will be deleted
+      if (typeof (attrObj[key]) === 'object' && attrObj[key] !== null) {
+        // name.familyName=Bianchi
+        if (!userObj[key]) userObj[key] = {} // e.g name object does not exist
+        for (const sub in attrObj[key]) {
+          if (!userObj[key]) userObj[key] = {}
+          if (Object.prototype.hasOwnProperty.call(attrObj[key][sub], 'value')
+            && attrObj[key][sub].value === '') delete userObj[key][sub] // object having blank value attribute e.g. {"manager": {"value": "",...}}
+          else if (attrObj[key][sub] === '') delete userObj[key][sub]
+          else {
+            if (!userObj[key]) userObj[key] = {} // may have been deleted by length check below
+            userObj[key][sub] = attrObj[key][sub]
+          }
+          if (Object.keys(userObj[key]).length < 1) delete userObj[key]
+        }
+      } else {
+        if (attrObj[key] === '' || attrObj[key] === null) delete userObj[key]
+        else userObj[key] = attrObj[key]
+      }
+    }
+  }
+  return userObj
+}
+
 // recursiveStrMap is used by endpointMapper() for converting obj according to endpointMap type definition
 const recursiveStrMap = function (direction: string, dotMap: any, obj: any, dotPath: any) {
   for (const key in obj) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scimgateway",
-  "version": "6.1.16",
+  "version": "6.1.18",
   "type": "module",
   "description": "Using SCIM protocol as a gateway for user provisioning to other endpoints",
   "author": "Jarle Elshaug <jarle.elshaug@gmail.com> (https://elshaug.xyz)",