scimgateway 6.1.2 → 6.1.4

package/README.md

@@ -18,10 +18,10 @@
 Latest news:  
 
 - Bun binary build is now supported, allowing SCIM Gateway to be compiled into a single executable binary for simplified deployment and execution. SCIM Gateway can now run as an ES module (TypeScript) in Node.js.
-- Major release **v6.0.0** introduces changes to API method response bodies (not SCIM-related) and a new method `publicApi()` for handling public path `/pub/api` requests with no authentication required. In addition, the configuration option `bearerJwtAzure.tenantIdGUID` has been replaced by `bearerJwt.azureTenantId`. See the version history for details.
+- Major release **v6.0.0** introduces changes to API method responses (not SCIM-related) and a new method `publicApi()` for handling public path `/pub/api` requests with no authentication required. In addition, the configuration option `bearerJwtAzure.tenantIdGUID` has been replaced by `bearerJwt.azureTenantId`. See the version history for details.
 - Support for Entra ID [Federated Identity Credentials](https://learn.microsoft.com/en-us/graph/api/resources/federatedidentitycredentials-overview?view=graph-rest-1.0) has been added through internal JWKS (JSON Web Key Set), allowing SCIM Gateway to access Microsoft Entra–protected resources without the need to manage secrets
 - External JWKS (JSON Web Key Set) is now supported by JWT authentication, allowing external applications to access SCIM Gateway without the need to manage secrets
-- [Azure Relay](https://learn.microsoft.com/en-us/azure/azure-relay/relay-what-is-it) is now supported for secure and hassle-free outbound communication — with just one minute of configuration
+- [Azure Relay](https://learn.microsoft.com/en-us/azure/azure-relay/relay-what-is-it) is now supported for secure and hassle-free outbound-only communication — with just one minute of configuration
 - [ETag](https://datatracker.ietf.org/doc/html/rfc7644#section-3.14) is now supported
 - [Bulk Operations](https://datatracker.ietf.org/doc/html/rfc7644#section-3.7) is now supported
 - Remote real-time log subscription for centralized logging and monitoring. Using browser `https://<host>/logger`, curl or custom client API - see configuration notes  
@@ -1303,9 +1303,30 @@ MIT © [Jarle Elshaug](https://www.elshaug.xyz)
 
 ## Change log
 
+### v6.1.4
+
+[Fixed]
+
+- plugin-entra-id, OData paging was not working, so some users/groups/members might be missing
+- helper-rest, OData paging
+- user’s group membership did not iterate through paging and may be incomplete
+
+### v6.1.3
+
+[Fixed]
+
+- azure relay, recover on failure
+- plugin-ldap, some improvements for Active Directory and the use of objectGUID/mS-DS-ConsistencyGuid
+- plugin-mongodb, group meta.version not standarized
+- when modifying group members, if an error occurs, the gateway now checks whether it was caused by adding an existing member or removing a non-existing member. In such cases, it returns 200 OK instead of an error.
+
+[Improved]
+- Dependencies bump
+
 ### v6.1.2
 
 [Fixed]
+
 - SMTP mail functionality failed because of an updated dependency
 - endpointMapper failed when `mapTo` included multiple comma-separated attributes and one of them was a multivalued attribute, e.g. `{ "mail": { "mapTo": "userName,emails.work.value" } }`
 

package/bun.lock

@@ -16,12 +16,12 @@
         "https-proxy-agent": "^7.0.6",
         "hyco-https": "^1.4.5",
         "is-in-subnet": "^4.0.1",
-        "jose": "^6.1.0",
+        "jose": "^6.1.1",
         "ldapjs": "^3.0.7",
         "lokijs": "^1.5.12",
-        "mongodb": "^6.20.0",
+        "mongodb": "^7.0.0",
         "node-machine-id": "1.1.12",
-        "nodemailer": "^7.0.9",
+        "nodemailer": "^7.0.10",
         "saml": "^3.0.1",
         "tsx": "^4.20.6",
       },
@@ -233,7 +233,7 @@
 
     "@ldapjs/protocol": ["@ldapjs/protocol@1.2.1", "", {}, "sha512-O89xFDLW2gBoZWNXuXpBSM32/KealKCTb3JGtJdtUQc7RjAk8XzrRgyz02cPAwGKwKPxy0ivuC7UP9bmN87egQ=="],
 
-    "@mongodb-js/saslprep": ["@mongodb-js/saslprep@1.3.1", "", { "dependencies": { "sparse-bitfield": "^3.0.3" } }, "sha512-6nZrq5kfAz0POWyhljnbWQQJQ5uT8oE2ddX303q1uY0tWsivWKgBDXBBvuFPwOqRRalXJuVO9EjOdVtuhLX0zg=="],
+    "@mongodb-js/saslprep": ["@mongodb-js/saslprep@1.3.2", "", { "dependencies": { "sparse-bitfield": "^3.0.3" } }, "sha512-QgA5AySqB27cGTXBFmnpifAi7HxoGUeezwo6p9dI03MuDB6Pp33zgclqVb6oVK3j6I9Vesg0+oojW2XxB59SGg=="],
 
     "@nats-io/jetstream": ["@nats-io/jetstream@3.2.0", "", { "dependencies": { "@nats-io/nats-core": "3.2.0" } }, "sha512-6H/vMjTMPsFEXKGK7dqScwHEtP1ZedZrwbCdRQuYDIVq4WLqZOD6ryeEZ/gMAP7YKLy82G6IixGUm2DVsDPCMw=="],
 
@@ -357,7 +357,7 @@
 
     "@types/webidl-conversions": ["@types/webidl-conversions@7.0.3", "", {}, "sha512-CiJJvcRtIgzadHCYXw7dqEnMNRjhGZlYK05Mj9OyktqV8uVT8fD2BFOB7S1uwBE3Kj2Z+4UyPmFw/Ixgw/LAlA=="],
 
-    "@types/whatwg-url": ["@types/whatwg-url@11.0.5", "", { "dependencies": { "@types/webidl-conversions": "*" } }, "sha512-coYR071JRaHa+xoEvvYqvnIHaVqaYrLPbsufM9BF63HkwI5Lgmy2QR8Q5K/lYDYo5AK82wOvSOS0UsLTpTG7uQ=="],
+    "@types/whatwg-url": ["@types/whatwg-url@13.0.0", "", { "dependencies": { "@types/webidl-conversions": "*" } }, "sha512-N8WXpbE6Wgri7KUSvrmQcqrMllKZ9uxkYWMt+mCSGwNc0Hsw9VQTW7ApqI4XNrx6/SaM2QQJCzMPDEXE058s+Q=="],
 
     "@typescript-eslint/eslint-plugin": ["@typescript-eslint/eslint-plugin@8.46.0", "", { "dependencies": { "@eslint-community/regexpp": "^4.10.0", "@typescript-eslint/scope-manager": "8.46.0", "@typescript-eslint/type-utils": "8.46.0", "@typescript-eslint/utils": "8.46.0", "@typescript-eslint/visitor-keys": "8.46.0", "graphemer": "^1.4.0", "ignore": "^7.0.0", "natural-compare": "^1.4.0", "ts-api-utils": "^2.1.0" }, "peerDependencies": { "@typescript-eslint/parser": "^8.46.0", "eslint": "^8.57.0 || ^9.0.0", "typescript": ">=4.8.4 <6.0.0" } }, "sha512-hA8gxBq4ukonVXPy0OKhiaUh/68D0E88GSmtC1iAEnGaieuDi38LhS7jdCHRLi6ErJBNDGCzvh5EnzdPwUc0DA=="],
 
@@ -421,7 +421,7 @@
 
     "braces": ["braces@3.0.3", "", { "dependencies": { "fill-range": "^7.1.1" } }, "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA=="],
 
-    "bson": ["bson@6.10.4", "", {}, "sha512-WIsKqkSC0ABoBJuT1LEX+2HEvNmNKKgnTAyd0fL8qzK4SH2i9NXg+t08YtdZp/V9IZ33cxe3iV4yM0qg8lMQng=="],
+    "bson": ["bson@7.0.0", "", {}, "sha512-Kwc6Wh4lQ5OmkqqKhYGKIuELXl+EPYSCObVE6bWsp1T/cGkOCBN0I8wF/T44BiuhHyNi1mmKVPXk60d41xZ7kw=="],
 
     "buffer": ["buffer@6.0.3", "", { "dependencies": { "base64-js": "^1.3.1", "ieee754": "^1.2.1" } }, "sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA=="],
 
@@ -617,7 +617,7 @@
 
     "isexe": ["isexe@2.0.0", "", {}, "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw=="],
 
-    "jose": ["jose@6.1.0", "", {}, "sha512-TTQJyoEoKcC1lscpVDCSsVgYzUDg/0Bt3WE//WiTPK6uOCQC2KZS4MpugbMWt/zyjkopgZoXhZuCi00gLudfUA=="],
+    "jose": ["jose@6.1.1", "", {}, "sha512-GWSqjfOPf4cWOkBzw5THBjtGPhXKqYnfRBzh4Ni+ArTrQQ9unvmsA3oFLqaYKoKe5sjWmGu5wVKg9Ft1i+LQfg=="],
 
     "js-md4": ["js-md4@0.3.2", "", {}, "sha512-/GDnfQYsltsjRswQhN9fhv3EMw2sCpUdrdxyWDOUK7eyD++r3gRhzgiQgc/x4MAv2i1iuQ4lxO5mvqM3vj4bwA=="],
 
@@ -673,9 +673,9 @@
 
     "moment": ["moment@2.30.1", "", {}, "sha512-uEmtNhbDOrWPFS+hdjFCBfy9f2YoyzRpwcl+DqpC6taX21FzsTLQVbMV/W7PzNSX6x/bhC1zA3c2UQ5NzH6how=="],
 
-    "mongodb": ["mongodb@6.20.0", "", { "dependencies": { "@mongodb-js/saslprep": "^1.3.0", "bson": "^6.10.4", "mongodb-connection-string-url": "^3.0.2" }, "peerDependencies": { "@aws-sdk/credential-providers": "^3.188.0", "@mongodb-js/zstd": "^1.1.0 || ^2.0.0", "gcp-metadata": "^5.2.0", "kerberos": "^2.0.1", "mongodb-client-encryption": ">=6.0.0 <7", "snappy": "^7.3.2", "socks": "^2.7.1" }, "optionalPeers": ["@aws-sdk/credential-providers", "@mongodb-js/zstd", "gcp-metadata", "kerberos", "mongodb-client-encryption", "snappy", "socks"] }, "sha512-Tl6MEIU3K4Rq3TSHd+sZQqRBoGlFsOgNrH5ltAcFBV62Re3Fd+FcaVf8uSEQFOJ51SDowDVttBTONMfoYWrWlQ=="],
+    "mongodb": ["mongodb@7.0.0", "", { "dependencies": { "@mongodb-js/saslprep": "^1.3.0", "bson": "^7.0.0", "mongodb-connection-string-url": "^7.0.0" }, "peerDependencies": { "@aws-sdk/credential-providers": "^3.806.0", "@mongodb-js/zstd": "^7.0.0", "gcp-metadata": "^7.0.1", "kerberos": "^7.0.0", "mongodb-client-encryption": ">=7.0.0 <7.1.0", "snappy": "^7.3.2", "socks": "^2.8.6" }, "optionalPeers": ["@aws-sdk/credential-providers", "@mongodb-js/zstd", "gcp-metadata", "kerberos", "mongodb-client-encryption", "snappy", "socks"] }, "sha512-vG/A5cQrvGGvZm2mTnCSz1LUcbOPl83hfB6bxULKQ8oFZauyox/2xbZOoGNl+64m8VBrETkdGCDBdOsCr3F3jg=="],
 
-    "mongodb-connection-string-url": ["mongodb-connection-string-url@3.0.2", "", { "dependencies": { "@types/whatwg-url": "^11.0.2", "whatwg-url": "^14.1.0 || ^13.0.0" } }, "sha512-rMO7CGo/9BFwyZABcKAWL8UJwH/Kc2x0g72uhDWzG48URRax5TCIcJ7Rc3RZqffZzO/Gwff/jyKwCU9TN8gehA=="],
+    "mongodb-connection-string-url": ["mongodb-connection-string-url@7.0.0", "", { "dependencies": { "@types/whatwg-url": "^13.0.0", "whatwg-url": "^14.1.0" } }, "sha512-irhhjRVLE20hbkRl4zpAYLnDMM+zIZnp0IDB9akAFFUZp/3XdOfwwddc7y6cNvF2WCEtfTYRwYbIfYa2kVY0og=="],
 
     "ms": ["ms@2.1.3", "", {}, "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="],
 
@@ -685,7 +685,7 @@
 
     "node-machine-id": ["node-machine-id@1.1.12", "", {}, "sha512-QNABxbrPa3qEIfrE6GOJ7BYIuignnJw7iQ2YPbc3Nla1HzRJjXzZOiikfF8m7eAMfichLt3M4VgLOetqgDmgGQ=="],
 
-    "nodemailer": ["nodemailer@7.0.9", "", {}, "sha512-9/Qm0qXIByEP8lEV2qOqcAW7bRpL8CR9jcTwk3NBnHJNmP9fIJ86g2fgmIXqHY+nj55ZEMwWqYAT2QTDpRUYiQ=="],
+    "nodemailer": ["nodemailer@7.0.10", "", {}, "sha512-Us/Se1WtT0ylXgNFfyFSx4LElllVLJXQjWi2Xz17xWw7amDKO2MLtFnVp1WACy7GkVGs+oBlRopVNUzlrGSw1w=="],
 
     "once": ["once@1.4.0", "", { "dependencies": { "wrappy": "1" } }, "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w=="],
 

package/config/plugin-entra-id.json

@@ -195,6 +195,10 @@
           "mapTo": "companyName",
           "type": "string"
         },
+        "employeeHireDate": {
+          "mapTo": "employeeHireDate",
+          "type": "string"
+        },
         "employeeOrgData.costCenter": {
           "mapTo": "employeeOrgData.costCenter",
           "type": "string"
@@ -239,6 +243,10 @@
           "type": "array",
           "typeInbound": "string"
         },
+        "faxNumber": {
+          "mapTo": "faxNumber",
+          "type": "string"
+        },
         "country": {
           "mapTo": "country",
           "type": "string"
@@ -298,7 +306,7 @@
           "type": "string"
         },
         "displayName": {
-          "mapTo": "displayName,externalId",
+          "mapTo": "displayName",
           "type": "string"
         },
         "securityEnabled": {

package/lib/helper-rest.ts

@@ -65,10 +65,9 @@ export class HelperRest {
    * getAccessToken returns oauth accesstoken object
    * @param baseEntity 
    * @param connectionObj endpoint.entity.baseEntity.connection
-   * @param ctx 
    * @returns { access_token: 'xxx', token_type: 'Bearer/Basic', validTo: 'xxx' }
    */
-  public async getAccessToken(baseEntity: string, connectionObj: Record<string, any>, ctx?: Record<string, any> | undefined) { // public in case token is needed for other logic e.g. sending mail
+  public async getAccessToken(baseEntity: string, connectionObj: Record<string, any>) { // public in case token is needed for other logic e.g. sending mail
     await this.lock.acquire()
     const d = Math.floor(Date.now() / 1000) // seconds (unix time)
     if (this._serviceClient[baseEntity]?.accessToken?.validTo >= d + 30) { // avoid simultaneously token requests
@@ -229,7 +228,7 @@ export class HelperRest {
               if (!this.scimgateway.jwk[kid]) {
                 this.scimgateway.jwk[kid] = { publicKey, privateKey }
                 const ttl = 5 * 60
-                ;(async () => {
+                  ; (async () => {
                   setTimeout(async () => {
                     delete this.scimgateway.jwk[kid]
                   }, ttl * 1000)
@@ -393,7 +392,7 @@ export class HelperRest {
       if (!connOpt.headers) connOpt.headers = {}
       connOpt.headers['Content-Type'] = 'application/x-www-form-urlencoded' // body must be query string formatted (no JSON)
 
-      const response = await this.doRequest(baseEntity, method, tokenUrl, form, ctx, connOpt)
+      const response = await this.doRequest(baseEntity, method, tokenUrl, form, undefined, connOpt)
       if (!response.body) {
         const err = new Error(`[${action}] No data retrieved from: ${method} ${tokenUrl}`)
         throw (err)
@@ -452,7 +451,7 @@ export class HelperRest {
           if (this._serviceClient[baseEntity].accessToken.validTo < d + 30) { // less than 30 sec before token expiration
             this.scimgateway.logDebug(baseEntity, `${action}: Accesstoken about to expire in ${this._serviceClient[baseEntity].accessToken.validTo - d} seconds`)
             try {
-              const accessToken = await this.getAccessToken(baseEntity, connectionObj, ctx)
+              const accessToken = await this.getAccessToken(baseEntity, connectionObj)
               this._serviceClient[baseEntity].accessToken = accessToken
               this._serviceClient[baseEntity].options.headers['Authorization'] = `${accessToken.token_type} ${accessToken.access_token}`
             } catch (err) {
@@ -512,7 +511,7 @@ export class HelperRest {
           }
         }
 
-        param.accessToken = await this.getAccessToken(baseEntity, connectionObj, ctx)
+        param.accessToken = await this.getAccessToken(baseEntity, connectionObj)
         if (param.accessToken?.access_token && param.accessToken?.token_type) {
           param.options.headers['Authorization'] = `${param.accessToken.token_type} ${param.accessToken.access_token}`
         } else { // no auth or PassTrough
@@ -561,8 +560,6 @@ export class HelperRest {
 
         // OData support
         this._serviceClient[baseEntity].nextLink = {} // OData pagination (Entra ID)
-        this._serviceClient[baseEntity].nextLink.users = null
-        this._serviceClient[baseEntity].nextLink.groups = null
       }
 
       if (ctx?.headers?.get) { // Auth PassThrough using ctx header
@@ -679,7 +676,35 @@ export class HelperRest {
           options.body = dataString
         } else if (options.headers) delete options.headers['Content-Type']
 
-        const url = `${options.protocol}//${options.host}${options.port ? ':' + options.port : ''}${options.path}`
+        let url = `${options.protocol}//${options.host}${options.port ? ':' + options.port : ''}${options.path}`
+        if (url.includes('$count=true') && url.includes('graph.microsoft.com')) {
+          options.headers['ConsistencyLevel'] = 'eventual'
+        }
+
+        if (this._serviceClient[baseEntity]?.nextLink[url]) {
+          if (ctx?.paging?.startIndex && ctx.paging.startIndex > 1) {
+            if (ctx.paging.startIndex === this._serviceClient[baseEntity]?.nextLink[url].startIndex) {
+              url = this._serviceClient[baseEntity]?.nextLink[url]['@odata.nextLink']
+            } else {
+              if (!ctx) ctx = {}
+              if (!ctx.paging) ctx.paging = {}
+              if (this._serviceClient[baseEntity]?.nextLink[url].totalResults
+                && ctx.paging.startIndex > this._serviceClient[baseEntity]?.nextLink[url].totalResults) {
+                ctx.paging.totalResults = this._serviceClient[baseEntity]?.nextLink[url].totalResults
+                return { body: { value: [] } }
+              } else {
+                // reset the paging cursor - none expected startIndex sequence, using default none paged url
+                ctx.paging.startIndex = 1 // caller should check and return this new startIndex in final response
+                delete this._serviceClient[baseEntity].nextLink[url]
+              }
+            }
+          }
+        } else {
+          if (ctx?.paging?.startIndex > 1 && !this._serviceClient[baseEntity]?.nextLink[url]) { // no previous paging and invalid startIndex
+            ctx.paging.totalResults = ctx.paging.startIndex - 1
+            return { body: { value: [] } }
+          }
+        }
 
         // execute request
         const f = await fetch(url, options)
@@ -708,30 +733,50 @@ export class HelperRest {
           throw new Error(JSON.stringify(result))
         }
         this.scimgateway.logDebug(baseEntity, `doRequest ${method} ${options.protocol}//${options.host}${(options.port ? `:${options.port}` : '')}${options.path} Body = ${JSON.stringify(body)} Response = ${JSON.stringify(result)}`)
-        if (result.body && typeof result.body === 'object' && result.body['@odata.nextLink']) { // {"@odata.nextLink": "https://graph.microsoft.com/beta/users?$top=100&$skiptoken=xxx"}
-          // OData paging
-          const nextUrl = result.body['@odata.nextLink'].split('?')[1] // keep search query
-          const arr = result['@odata.nextLink'].split('?')[0].split('/')
-          const objType = (arr[arr.length - 1]) // users
-          let startIndexNext = ''
-          if (this._serviceClient[baseEntity].nextLink[objType]) {
-            for (const k in this._serviceClient[baseEntity].nextLink[objType]) {
-              if (this._serviceClient[baseEntity].nextLink[objType][k] === nextUrl) return result // repetive startIndex=1
-              startIndexNext = k
-              break
+
+        // OData paging logic
+        // client prerequisite for enabling doRequest() OData paging support (see plugin-entra-id):
+        //   let paging = { startIndex: getObj.startIndex }
+        //   if (!ctx) ctx = { paging }
+        //   else ctx.paging = paging
+        if (result.body && typeof result.body === 'object') {
+          if (result.body['@odata.nextLink']) { // {"@odata.nextLink": "https://graph.microsoft.com/beta/users?$top=100&$skiptoken=xxx"}
+            if (!ctx) ctx = {}
+            if (!ctx.paging) ctx.paging = {}
+            const nextLinkBase = decodeURIComponent(result.body['@odata.nextLink'].substring(0, result.body['@odata.nextLink'].indexOf('$skiptoken') - 1))
+            const count = result.body['@odata.count']
+            if (count !== undefined) {
+              ctx.paging.totalResults = count
+            }
+            let totalResults = ctx.paging.totalResults
+            if (!totalResults) totalResults = (this._serviceClient[baseEntity].nextLink[nextLinkBase]?.totalResults)
+            let isCount = this._serviceClient[baseEntity].nextLink[nextLinkBase]?.isCount || count !== undefined
+            const itemsPerPage = result.body.value.length
+            this._serviceClient[baseEntity].nextLink[nextLinkBase] = {}
+            this._serviceClient[baseEntity].nextLink[nextLinkBase]['startIndex'] = ctx.paging.startIndex ? ctx.paging.startIndex + itemsPerPage : itemsPerPage + 1
+            this._serviceClient[baseEntity].nextLink[nextLinkBase]['@odata.nextLink'] = result.body['@odata.nextLink']
+            this._serviceClient[baseEntity].nextLink[nextLinkBase]['isCount'] = isCount
+            if (isCount) {
+              this._serviceClient[baseEntity].nextLink[nextLinkBase]['totalResults'] = totalResults // count=true ignored when using nextLink
+              ctx.paging.totalResults = totalResults
+            } else {
+              const totalResults = ctx.paging.startIndex - 1 + (itemsPerPage * 2) // ensure new client paging
+              this._serviceClient[baseEntity].nextLink[nextLinkBase]['totalResults'] = totalResults
+              ctx.paging.totalResults = totalResults
+            }
+          } else { // no more paging
+            const linkBase = decodeURIComponent(url.substring(0, url.indexOf('$skiptoken') - 1))
+            if (ctx?.paging?.startIndex && ctx.paging.startIndex > 1 && this._serviceClient[baseEntity]?.nextLink[linkBase]) {
+              if (!this._serviceClient[baseEntity]?.nextLink[linkBase].isCount) { // final no count page
+                const itemsPerPage = result.body.value.length
+                const totalResults = ctx.paging.startIndex - 1 + itemsPerPage
+                this._serviceClient[baseEntity].nextLink[linkBase]['totalResults'] = totalResults
+                ctx.paging.totalResults = totalResults
+              }
             }
           }
-          const a = result.body['@odata.nextLink'].split('top=')
-          let top = '0'
-          if (a.length > 1) {
-            top = a[1].split('&')[0]
-          }
-          if (!startIndexNext) startIndexNext = (Number(top) + 1).toString()
-          else startIndexNext = (Number(startIndexNext) + Number(top) + 1).toString()
-          // reset and set new nextLink
-          this._serviceClient[baseEntity].nextLink[objType] = {}
-          this._serviceClient[baseEntity].nextLink[objType][startIndexNext] = nextUrl
         }
+
         return result
       } finally {
         clearTimeout(timeout)
@@ -976,36 +1021,6 @@ export class HelperRest {
     return await this.doRequestHandler(baseEntity, method, path, body, ctx, opt)
   }
 
-  /**
-  * nextLinkPaging returns paging url when using OData e.g., Entra ID 
-  * @param baseEntity baseEntity
-  * @param objType e.g., 'users' or 'groups', a type that corresponds with what's being used by endpoint url request
-  * @param startIndex SCIM startIndex paramenter
-  * @returns paging url to be used
-  **/
-  public nextLinkPaging(baseEntity: string, objType: string, startIndex: number) {
-    objType = objType.toLowerCase() // users or groups
-    let nextPath = ''
-    if (!startIndex || !this._serviceClient[baseEntity]) return ''
-    if (startIndex < 2) {
-      if (this._serviceClient[baseEntity].nextLink[objType]) {
-        this._serviceClient[baseEntity].nextLink[objType] = null
-      }
-      return ''
-    }
-    if (this._serviceClient[baseEntity].nextLink[objType]) {
-      if (this._serviceClient[baseEntity].nextLink[objType][startIndex]) {
-        nextPath = `/users?${this._serviceClient[baseEntity].nextLink[objType][startIndex]}`
-      } else {
-        this._serviceClient[baseEntity].nextLink[objType] = null
-        return ''
-      }
-    } else {
-      return ''
-    }
-    return nextPath
-  }
-
   /**
   * getGraphUrl returns Microsoft Graph API url used for Entra ID 
   * @returns Microsoft Graph API url

package/lib/plugin-entra-id.ts

@@ -101,9 +101,17 @@ if (config.map) { // having licensDetails map here instead of config file
 }
 
 const userAttributes: string[] = []
-for (const key in config.map.user) { // userAttributes = ['country', 'preferredLanguage', 'mail', 'city', 'displayName', 'postalCode', 'jobTitle', 'businessPhones', 'onPremisesSyncEnabled', 'officeLocation', 'name.givenName', 'passwordPolicies', 'id', 'state', 'department', 'mailNickname', 'manager.managerId', 'active', 'userName', 'name.familyName', 'proxyAddresses.value', 'servicePlan.value', 'mobilePhone', 'streetAddress', 'onPremisesImmutableId', 'userType', 'usageLocation']
+for (const key in config.map.user) { // userAttributes = ['id', 'country', 'preferredLanguage', 'mail', 'city', 'displayName', 'postalCode', 'jobTitle', 'businessPhones', 'onPremisesSyncEnabled', 'officeLocation', 'name.givenName', 'passwordPolicies', 'id', 'state', 'department', 'mailNickname', 'manager.managerId', 'active', 'userName', 'name.familyName', 'proxyAddresses.value', 'servicePlan.value', 'mobilePhone', 'streetAddress', 'onPremisesImmutableId', 'userType', 'usageLocation']
   if (config.map.user[key].mapTo) userAttributes.push(config.map.user[key].mapTo)
 }
+if (!userAttributes.includes('id')) userAttributes.push('id')
+
+const groupAttributes: string[] = []
+for (const key in config.map.group) { // groupAttributes = ['id', 'displayName', 'securityEnabled', 'mailEnabled']
+  if (config.map.group[key].mapTo) groupAttributes.push(config.map.group[key].mapTo)
+}
+if (!groupAttributes.includes('id')) groupAttributes.push('id')
+if (!groupAttributes.includes('members.value')) groupAttributes.push('members.value')
 
 // =================================================
 // getUsers
@@ -150,18 +158,17 @@ scimgateway.getUsers = async (baseEntity, getObj, attributes, ctx) => {
     throw new Error(`${action} error: not supporting advanced filtering: ${getObj.rawFilter}`)
   } else {
     // mandatory - no filtering (!getObj.operator && !getObj.rawFilter) - all users to be returned - correspond to exploreUsers() in versions < 4.x.x
-    if (getObj.startIndex && getObj.startIndex > 1) { // paging
-      path = helper.nextLinkPaging(baseEntity, 'users', getObj.startIndex)
-      if (!path) return ret
-    } else {
-      getObj.count = (!getObj.count || getObj.count > 999) ? 999 : getObj.count
-      path = `/users?$top=${getObj.count}` // paging not supported using filter (Entra ID default page=100, max=999)
-    }
+    path = `/users?$top=${getObj.count}&$count=true`
   }
   // mandatory if-else logic - end
 
   if (!path) throw new Error(`${action} error: mandatory if-else logic not fully implemented`)
 
+  // enable doRequest() OData paging support 
+  let paging = { startIndex: getObj.startIndex }
+  if (!ctx) ctx = { paging }
+  else ctx.paging = paging
+
   try {
     let response: any
     if (path === 'getUser') { // special
@@ -176,10 +183,16 @@ scimgateway.getUsers = async (baseEntity, getObj, attributes, ctx) => {
       const [scimObj] = scimgateway.endpointMapper('inbound', response.body.value[i], config.map.user) // endpoint => SCIM/CustomSCIM attribute standard
       if (scimObj && typeof scimObj === 'object' && Object.keys(scimObj).length > 0) ret.Resources.push(scimObj)
     }
-    if (getObj.count === response.body.value.length) ret.totalResults = 99999999 // to ensure we get a new paging request - don't know the total numbers of users - metadata directoryObject collections are not countable
+
+    if (getObj.startIndex !== ctx.paging.startIndex) { // changed by doRequest()
+      ret.startIndex = ctx.paging.startIndex
+    }
+    if (ctx.paging.totalResults) ret.totalResults = ctx.paging.totalResults // set by doRequest()
     else ret.totalResults = getObj.startIndex ? getObj.startIndex - 1 + response.body.value.length : response.body.value.length
+
     return (ret)
   } catch (err: any) {
+    if (err.message.includes('Request_ResourceNotFound')) return { Resources: [] }
     throw new Error(`${action} error: ${err.message}`)
   }
 }
@@ -329,9 +342,7 @@ scimgateway.getGroups = async (baseEntity, getObj, attributes, ctx) => {
     totalResults: null,
   }
 
-  if (attributes.length < 1) attributes = ['id', 'displayName', 'members.value']
-  if (!attributes.includes('id')) attributes.push('id')
-
+  if (attributes.length === 0) attributes = groupAttributes
   let includeMembers = false
   if (attributes.includes('members.value') || attributes.includes('members')) {
     includeMembers = true
@@ -356,9 +367,7 @@ scimgateway.getGroups = async (baseEntity, getObj, attributes, ctx) => {
     } else if (getObj.operator === 'eq' && getObj.attribute === 'members.value') {
       // mandatory - return all groups the user 'id' (getObj.value) is member of - correspond to getGroupMembers() in versions < 4.x.x
       // Resources = [{ id: <id-group>> , displayName: <displayName-group>, members [{value: <id-user>}] }]
-      // not using below expand because Entra ID returns only a maximum of 20 items for the expanded relationship
-      // path = `/users/${getObj.value}/memberOf/microsoft.graph.group?$select=id,displayName&$expand=members($select=id,displayName)`
-      path = `/users/${getObj.value}/memberOf/microsoft.graph.group?$select=id,displayName`
+      path = `/users/${getObj.value}/memberOf/microsoft.graph.group?$top=${getObj.count}&$count=true&select=id,displayName`
     } else {
       // optional - simpel filtering
       throw new Error(`${action} error: not supporting simpel filtering: ${getObj.rawFilter}`)
@@ -368,16 +377,18 @@ scimgateway.getGroups = async (baseEntity, getObj, attributes, ctx) => {
     throw new Error(`${action} error: not supporting advanced filtering: ${getObj.rawFilter}`)
   } else {
     // mandatory - no filtering (!getObj.operator && !getObj.rawFilter) - all groups to be returned - correspond to exploreGroups() in versions < 4.x.x
-    // Entra paging not supported because of select filter (Entra default page=100, max=999)
-    // TODO: use a query that supports paging to fix current 999 limit of groups
-    getObj.count = 999
-    if (includeMembers) path = `/groups?$top=${getObj.count}&$select=${attrs.join()}&$expand=members($select=id,displayName)`
-    else path = `/groups?$top=${getObj.count}&$select=${attrs.join()}`
+    if (includeMembers) path = `/groups?$top=${getObj.count}&$count=true&$select=${attrs.join()}&$expand=members($select=id,displayName)`
+    else path = `/groups?$top=${getObj.count}&$count=true&$select=${attrs.join()}`
   }
   // mandatory if-else logic - end
 
   if (!path) throw new Error(`${action} error: mandatory if-else logic not fully implemented`)
 
+  // enable doRequest() OData paging support 
+  let paging = { startIndex: getObj.startIndex }
+  if (!ctx) ctx = { paging }
+  else ctx.paging = paging
+
   try {
     let response = await helper.doRequest(baseEntity, method, path, body, ctx)
     if (!response.body) {
@@ -411,12 +422,15 @@ scimgateway.getGroups = async (baseEntity, getObj, attributes, ctx) => {
       }
     }
 
-    // Entra paging not supported because of select filter
-    getObj.startIndex = 1
-    ret.totalResults = getObj.startIndex ? getObj.startIndex - 1 + response.body.value.length : response.body.value.length
+    if (getObj.startIndex !== ctx.paging.startIndex) { // changed by doRequest()
+      ret.startIndex = ctx.paging.startIndex
+    }
+    if (ctx.paging.totalResults) ret.totalResults = ctx.paging.totalResults // set by doRequest()
+    else ret.totalResults = getObj.startIndex ? getObj.startIndex - 1 + response.body.value.length : response.body.value.length
 
     return (ret)
   } catch (err: any) {
+    if (err.message.includes('Request_ResourceNotFound')) return { Resources: [] }
     throw new Error(`${action} error: ${err.message}`)
   }
 }
@@ -427,6 +441,7 @@ scimgateway.getGroups = async (baseEntity, getObj, attributes, ctx) => {
 scimgateway.createGroup = async (baseEntity, groupObj, ctx) => {
   const action = 'createGroup'
   scimgateway.logDebug(baseEntity, `handling ${action} groupObj=${JSON.stringify(groupObj)} passThrough=${ctx ? 'true' : 'false'}`)
+
   const body: any = { displayName: groupObj.displayName }
   body.mailNickName = groupObj.displayName
   body.mailEnabled = false
@@ -454,7 +469,12 @@ scimgateway.createGroup = async (baseEntity, groupObj, ctx) => {
 scimgateway.deleteGroup = async (baseEntity, id, ctx) => {
   const action = 'deleteGroup'
   scimgateway.logDebug(baseEntity, `handling ${action} id=${id} passThrough=${ctx ? 'true' : 'false'}`)
-  throw new Error(`${action} error: ${action} is not supported`)
+
+  const method = 'DELETE'
+  const path = `/groups/${id}`
+  const body = null
+
+  await helper.doRequest(baseEntity, method, path, body, ctx)
 }
 
 // =================================================