scimgateway 6.1.9 → 6.1.10

package/README.md

@@ -1303,6 +1303,13 @@ MIT © [Jarle Elshaug](https://www.elshaug.xyz)
 
 ## Change log
 
+### v6.1.10
+
+[Fixed]
+
+- plugin-entra-id: user group membership now includes nested (transitive) groups (`direct` and `indirect`)
+- Docker example files `config/docker/.dockerignore` and `docker-compose-mssql.yml` were missing
+
 ### v6.1.9
 
 [Improved]

package/lib/helper-rest.ts

@@ -34,8 +34,8 @@ export class HelperRest {
     this.scimgateway = scimgateway
     this.idleTimeout = (scimgateway as any)?.config?.scimgateway.idleTimeout || 120
     this.idleTimeout = this.idleTimeout - 1
-    if (optionalEntities && optionalEntities.entity) this.config_entity = utils.copyObj(optionalEntities.entity) ?? {}
-    else this.config_entity = utils.copyObj(scimgateway.getConfig())?.entity ?? {}
+    if (optionalEntities && optionalEntities.entity) this.config_entity = structuredClone(optionalEntities.entity) ?? {}
+    else this.config_entity = structuredClone(scimgateway.getConfig())?.entity ?? {}
 
     for (const baseEntity in this.config_entity) {
       const connectionObj = this.config_entity[baseEntity]?.connection
@@ -387,7 +387,7 @@ export class HelperRest {
       const method = 'POST'
       let connOpt: any = {}
       if (connectionObj.options && typeof connectionObj.options === 'object') {
-        connOpt = utils.copyObj(connectionObj.options)
+        connOpt = structuredClone(connectionObj.options)
       }
       if (!connOpt.headers) connOpt.headers = {}
       connOpt.headers['Content-Type'] = 'application/x-www-form-urlencoded' // body must be query string formatted (no JSON)
@@ -494,7 +494,7 @@ export class HelperRest {
         let orgConnection: any
         if (opt?.connection) { // allow overriding/extending configuration connection by caller argument opt.connection
           let org = connectionObj
-          orgConnection = utils.copyObj(org)
+          orgConnection = structuredClone(org)
           if (!org) org = {}
           org = utils.extendObj(org, opt.connection)
         }
@@ -533,7 +533,7 @@ export class HelperRest {
         }
 
         if (connectionObj.options) { // http connect options
-          const connOpt: any = utils.copyObj(connectionObj.options)
+          const connOpt: any = structuredClone(connectionObj.options)
           try {
             // using fs.readFileSync().toString() instead of Bun.file().text() for nodejs compability
             if (connOpt?.tls?.key) connOpt.tls.key = fs.readFileSync(connOpt.tls.key).toString()
@@ -565,7 +565,7 @@ export class HelperRest {
       if (ctx?.headers?.get) { // Auth PassThrough using ctx header
         this._serviceClient[baseEntity].options.headers['Authorization'] = ctx.headers.get('authorization')
       }
-      const cli: any = utils.copyObj(this._serviceClient[baseEntity]) // client ready
+      const cli: any = structuredClone(this._serviceClient[baseEntity]) // client ready
 
       // failover support
       path = this._serviceClient[baseEntity].baseUrl + path
@@ -611,7 +611,7 @@ export class HelperRest {
 
     // merge any argument options - basic auth header is supported through {auth:{type:"basic",options:{username:"username",password:"password"}}}
     if (opt) {
-      const o: any = utils.copyObj(opt)
+      const o: any = structuredClone(opt)
       if (o?.auth?.type === 'basic') {
         options.headers['Authorization'] = 'Basic ' + Buffer.from(`${o.auth?.options?.username}:${o.auth?.options?.password}`).toString('base64')
         delete o.auth

package/lib/plugin-entra-id.ts

@@ -65,6 +65,8 @@ const config = scimgateway.getConfig()
 scimgateway.authPassThroughAllowed = false
 // end - mandatory plugin initialization
 
+const newHelper = new HelperRest(scimgateway)
+
 if (config.map) { // having licensDetails map here instead of config file
   config.map.licenseDetails = {
     servicePlanId: {
@@ -413,6 +415,7 @@ scimgateway.getGroups = async (baseEntity, getObj, attributes, ctx) => {
   const body = null
   let path
   let options: Record<string, any> = {}
+  let isUserMemberOf = getObj?.operator === 'eq' && getObj?.attribute === 'members.value'
 
   if (!Object.hasOwn(getObj, 'count')) getObj.count = 500
   if (getObj.count > 500) getObj.count = 500 // Entra ID max 999
@@ -428,10 +431,10 @@ scimgateway.getGroups = async (baseEntity, getObj, attributes, ctx) => {
         if (includeMembers) path = `/groups?$filter=${getObj.attribute} eq '${getObj.value}'&$select=${attrs.join()}&$expand=members($select=id,displayName)`
         else path = `/groups?$filter=${getObj.attribute} eq '${getObj.value}'&$select=${attrs.join()}`
       }
-    } else if (getObj.operator === 'eq' && getObj.attribute === 'members.value') {
+    } else if (isUserMemberOf) {
       // mandatory - return all groups the user 'id' (getObj.value) is member of - correspond to getGroupMembers() in versions < 4.x.x
       // Resources = [{ id: <id-group>> , displayName: <displayName-group>, members [{value: <id-user>}] }]
-      path = `/users/${getObj.value}/memberOf/microsoft.graph.group?$top=${getObj.count}&$count=true&select=id,displayName`
+      path = `/users/${getObj.value}/transitiveMemberOf/microsoft.graph.group?$top=${getObj.count}&$count=true&select=id,displayName`
     } else {
       // optional - simpel filtering
       if (getObj.attribute) {
@@ -471,8 +474,69 @@ scimgateway.getGroups = async (baseEntity, getObj, attributes, ctx) => {
   if (!ctx) ctx = { paging }
   else ctx.paging = paging
 
+  const newCtx = { ...ctx }
+  newCtx.paging = { startIndex: 1 }
+
   try {
-    let response = await helper.doRequest(baseEntity, method, path, body, ctx, options)
+    let response: any
+    let responseMemberOf: any
+    if (!isUserMemberOf) response = await helper.doRequest(baseEntity, method, path, body, ctx, options)
+    else {
+      // request both the default transitiveMemberOf (includes nested groups) and memberOf because we want to distinguish SCIM type=direct/indirect
+      const pathMemberOf = `/users/${getObj.value}/memberOf/microsoft.graph.group?$top=${getObj.count}&$count=true&select=id,displayName`
+      const allErrors: string[] = []
+      const results = await Promise.allSettled([
+        helper.doRequest(baseEntity, method, path, body, ctx, options),
+        newHelper.doRequest(baseEntity, method, pathMemberOf, body, newCtx, options), // using newHelper to avoid shared internal helperRest paging 
+      ])
+      const errors = results
+        .filter(r => r.status === 'rejected')
+        .map(r => (r as PromiseRejectedResult).reason.message)
+        .filter(msg => !msg.includes('already exist'))
+      allErrors.push(...errors)
+
+      if (allErrors.length > 0) {
+        throw new Error(allErrors.join(', '))
+      }
+
+      response = (results[0] as PromiseFulfilledResult<any>).value // includes all groups (also nested)
+      responseMemberOf = (results[1] as PromiseFulfilledResult<any>).value // do not include nested groups
+
+      let nextStartIndex = scimgateway.getNextStartIndex(responseMemberOf.body.value.length * 2, newCtx.paging.startIndex, responseMemberOf.body.value.length)
+      if (nextStartIndex > newCtx.paging.startIndex && responseMemberOf && responseMemberOf.body.value && Array.isArray(responseMemberOf.body.value)) {
+        // use paging to ensure responseMemberOf is complete 
+        let totalResults = responseMemberOf.body.value.length
+        let startIndex = 1
+        let res: any
+        do {
+          try {
+            startIndex = nextStartIndex
+            newCtx.paging.startIndex = startIndex
+            res = await newHelper.doRequest(baseEntity, method, pathMemberOf, body, newCtx, options)
+          } catch (err) { void 0 }
+          if (res?.body && res.body.value && Array.isArray(res.body.value) && res.body.value.length > 0) {
+            const count = res.body.value.length
+            totalResults += count
+            nextStartIndex = scimgateway.getNextStartIndex(totalResults + count, startIndex, count)
+            for (let i = 0; i < res.body.value.length; i++) {
+              if (!res.body.value[i].id) continue
+              responseMemberOf.body.value.push(res.body.value[i])
+            }
+          }
+        } while (nextStartIndex > startIndex)
+      }
+
+      if (response.body && response.body.value && Array.isArray(response.body.value)) {
+        const directIds = new Set()
+        if (responseMemberOf.body && responseMemberOf.body.value && Array.isArray(responseMemberOf.body.value)) {
+          responseMemberOf.body.value.forEach((el: any) => directIds.add(el.id))
+        }
+        response.body.value.forEach((el: any) => {
+          if (directIds.has(el.id)) el.type = 'direct'
+          else el.type = 'indirect'
+        })
+      }
+    }
     if (!response.body) {
       throw new Error(`invalid response: ${JSON.stringify(response)}`)
     }
@@ -494,6 +558,7 @@ scimgateway.getGroups = async (baseEntity, getObj, attributes, ctx) => {
       } else if (getObj.operator === 'eq' && getObj.attribute === 'members.value') { // Not using expand-members. Only includes current user as member, but should have requested all...
         members = [{
           value: getObj.value,
+          type: response.body.value[i].type || 'direct',
         }]
       }
 

package/lib/postinstall.ts

@@ -53,10 +53,12 @@ if (!fsExistsSync('../../config/wsdls/UserService.wsdl')) {
   fs.writeFileSync('../../config/wsdls/UserService.wsdl', fs.readFileSync('./config/wsdls/UserService.wsdl'))
 }
 
-fs.writeFileSync('../../config/docker/docker-compose.yml', fs.readFileSync('./config/docker/docker-compose.yml'))
-fs.writeFileSync('../../config/docker/Dockerfile', fs.readFileSync('./config/docker/Dockerfile'))
+fs.writeFileSync('../../config/docker/.dockerignore', fs.readFileSync('./config/docker/.dockerignore'))
 fs.writeFileSync('../../config/docker/DataDockerfile', fs.readFileSync('./config/docker/DataDockerfile'))
 fs.writeFileSync('../../config/docker/docker-compose-debug.yml', fs.readFileSync('./config/docker/docker-compose-debug.yml'))
+fs.writeFileSync('../../config/docker/docker-compose-mssql.yml', fs.readFileSync('./config/docker/docker-compose-mssql.yml'))
+fs.writeFileSync('../../config/docker/docker-compose.yml', fs.readFileSync('./config/docker/docker-compose.yml'))
+fs.writeFileSync('../../config/docker/Dockerfile', fs.readFileSync('./config/docker/Dockerfile'))
 
 fs.writeFileSync('../../LICENSE', fs.readFileSync('./LICENSE'))
 if (!fsExistsSync('../../index.ts')) fs.writeFileSync('../../index.ts', fs.readFileSync('./index.ts'))

package/lib/scimgateway.ts

@@ -757,7 +757,7 @@ export class ScimGateway {
             }
             if (utils.getEncrypted(authToken, arr[i].clientSecret) === arr[i].clientSecret) {
               arr[i].isTokenRequested = true // flagged as true to not allow repeated resolvements because token will also be cleared when expired
-              const baseEntities = utils.copyObj(arr[i].baseEntities)
+              const baseEntities = structuredClone(arr[i].baseEntities)
               let expires
               let readOnly = false
               if (arr[i].readOnly && arr[i].readOnly === true) readOnly = true
@@ -857,7 +857,7 @@ export class ScimGateway {
     }
 
     const getHandlerSchemas = async (ctx: Context) => {
-      let tx = utils.copyObj(this.scimDef.Schemas)
+      let tx = structuredClone(this.scimDef.Schemas)
       if (this.config.endpoint?.map) {
         // endpointMapper being used
         // Schemas returned should instead reflect what is defined in the plugin config file
@@ -891,7 +891,7 @@ export class ScimGateway {
                 uniqueness: (item.mapTo === 'userName') ? 'server' : 'none',
               }
               if (item['x-agent-schema']) {
-                const agentSchema = utils.copyObj(item['x-agent-schema'])
+                const agentSchema = structuredClone(item['x-agent-schema'])
                 if (agentSchema.description) {
                   attr.description = agentSchema.description
                   delete agentSchema.description
@@ -909,7 +909,7 @@ export class ScimGateway {
               if (names.length > 1) {
                 const userNameFound = attr.name.includes('userName')
                 for (let i = 0; i < names.length; i++) {
-                  let attrCopy = utils.copyObj(attr)
+                  let attrCopy = structuredClone(attr)
                   const name = names[i].trim()
                   attrCopy.name = name
                   if (name === 'id') continue
@@ -959,7 +959,7 @@ export class ScimGateway {
                   delete subAttr.uniqueness
                 }
                 if (item['x-agent-schema']) {
-                  const hints = utils.copyObj(item['x-agent-schema'])
+                  const hints = structuredClone(item['x-agent-schema'])
                   if (hints.description) {
                     subAttr.description = hints.description
                     delete hints.description
@@ -1147,7 +1147,7 @@ export class ScimGateway {
           ctx.request.body = body // now json - ensure final info log will be masked
           jsonBody = body
         }
-        jsonBody = utils.copyObj(jsonBody) // no changes to original
+        jsonBody = structuredClone(jsonBody) // no changes to original
       } catch (err: any) {
         logger.error(`${gwName} [oauth] token request error: ${err.message}`)
         ctx.response.status = 401
@@ -1184,7 +1184,7 @@ export class ScimGateway {
               if (!arr[i].baseEntities.includes(baseEntity)) continue
             }
             token = utils.getEncrypted(jsonBody.client_secret, jsonBody.client_secret)
-            baseEntities = utils.copyObj(arr[i].baseEntities)
+            baseEntities = structuredClone(arr[i].baseEntities)
             if (arr[i].readOnly && arr[i].readOnly === true) readOnly = true
             if (arr[i].expires_in && !isNaN(arr[i].expires_in)) expires = arr[i].expires_in
             else expires = oAuthTokenExpire
@@ -1291,7 +1291,7 @@ export class ScimGateway {
       logger.debug(`${gwName} [Get ${handle.description}] ${getObj.attribute}=${getObj.value}`, { baseEntity: ctx?.routeObj?.baseEntity })
 
       try {
-        const ob = utils.copyObj(getObj)
+        const ob = structuredClone(getObj)
         const attributes: string[] = ctx.query.attributes ? ctx.query.attributes.split(',').map((item: string) => item.trim()) : []
         if (attributes.length > 0 && !attributes.includes('id')) attributes.push('id')
         logger.debug(`${gwName} calling ${handle.getMethod}`, { baseEntity: ctx?.routeObj?.baseEntity })
@@ -1523,7 +1523,7 @@ export class ScimGateway {
         getObj.count = ctx.query.count ? parseInt(ctx.query.count, 10) : 200 // defaults to 200 (plugin may override)
 
         let res: any
-        const obj: any = utils.copyObj(getObj)
+        const obj: any = structuredClone(getObj)
         const attributes: string[] = ctx.query.attributes ? ctx.query.attributes.split(',').map((item: string) => item.trim()) : []
         if (attributes.length > 0 && !attributes.includes('id')) attributes.push('id') // id is mandatory
 
@@ -1659,7 +1659,7 @@ export class ScimGateway {
       try {
         if (!jsonBody) throw new Error('missing body')
         if (typeof jsonBody !== 'object' || jsonBody === null) throw new Error('body is not JSON')
-        jsonBody = utils.copyObj(jsonBody) // no changes to original
+        jsonBody = structuredClone(jsonBody) // no changes to original
       } catch (err: any) {
         const [e, statusCode] = utilsScim.jsonErr(this.config.scimgateway.scim.version, pluginName, 500, err)
         ctx.response.status = statusCode
@@ -1978,7 +1978,7 @@ export class ScimGateway {
         if (!this.config.scimgateway.scim.groupMemberOfUser) {
           for (let i = 0; i < scimdata.groups.length; i++) {
             if (!scimdata.groups[i].value) continue
-            const obj: any = utils.copyObj(scimdata.groups[i])
+            const obj: any = structuredClone(scimdata.groups[i])
             obj.value = decodeURIComponent(obj.value)
             groups.push(obj)
           }
@@ -1991,7 +1991,7 @@ export class ScimGateway {
           res = await replaceUsrGrp(ctx.routeObj.handle, baseEntity, id, scimdata, this.config.scimgateway.scim.usePutSoftSync, ctx.passThrough, undefined)
         } else {
           logger.debug(`${gwName} calling ${handle.modifyMethod}`, { baseEntity: ctx?.routeObj?.baseEntity })
-          finalScimdata = utils.copyObj(scimdata)
+          finalScimdata = structuredClone(scimdata)
           res = await (this as any)[handle.modifyMethod](baseEntity, id, scimdata, ctx.passThrough)
         }
 
@@ -2106,7 +2106,7 @@ export class ScimGateway {
       let objGroups: any
       if (obj.groups) {
         if (!this.config.scimgateway.scim.groupMemberOfUser) {
-          objGroups = utils.copyObj(obj.groups)
+          objGroups = structuredClone(obj.groups)
           delete obj.groups
         }
       }
@@ -2282,7 +2282,7 @@ export class ScimGateway {
     const postBulkHandler = async (ctx: Context) => {
       const baseEntity = ctx.routeObj.baseEntity
       logger.debug(`${gwName} [Bulk Operations]`, { baseEntity: ctx?.routeObj?.baseEntity })
-      const bulkBody: SCIMBulkRequest = utils.copyObj(ctx.request.body)
+      const bulkBody: SCIMBulkRequest = structuredClone(ctx.request.body)
       try {
         if (!bulkBody) throw new Error('missing body')
         if (typeof bulkBody !== 'object') throw new Error('body is not JSON')
@@ -2758,9 +2758,11 @@ export class ScimGateway {
               if (!res.Resources[i].id) continue
               const el: any = {}
               el.value = res.Resources[i].id
+              const type = (Array.isArray(res.Resources[i].members) && res.Resources[i].members[0]?.type === 'indirect') ? 'indirect' : 'direct'
+              el.type = { value: type }
               if (res.Resources[i].displayName) el.display = res.Resources[i].displayName
-              if (isScimv2) el.type = 'direct'
-              else el.type = { value: 'direct' }
+              if (isScimv2) el.type = type
+              else el.type = { value: type }
               groups.push(el) // { "value": "Admins", "display": "Admins", "type": "direct"}
             }
             nextStartIndex = utilsScim.getNextStartIndex(res.totalResults, startIndex, res.Resources.length)
@@ -3629,7 +3631,7 @@ export class ScimGateway {
       logger.info(`${gwName} starting SCIM Stream subscribers...`)
       const sub: any = new stream.Subscriber(this, funcHandler)
       for (const baseEntity in this.config.scimgateway.stream.subscriber.entity) {
-        const cfgSub: any = utils.copyObj(this.config.scimgateway.stream.subscriber.entity[baseEntity])
+        const cfgSub: any = structuredClone(this.config.scimgateway.stream.subscriber.entity[baseEntity])
         cfgSub.baseUrls = this.config.scimgateway.stream.baseUrls
         cfgSub.certificate = this.config.scimgateway.stream.certificate
         cfgSub.usePutSoftSync = this.config.scimgateway.scim.usePutSoftSync
@@ -3643,7 +3645,7 @@ export class ScimGateway {
       logger.info(`${gwName} starting SCIM Stream publishers...`)
       const pub: any = new stream.Publisher(this)
       for (const baseEntity in this.config.scimgateway.stream.publisher.entity) {
-        const cfgPub: any = utils.copyObj(this.config.scimgateway.stream.publisher.entity[baseEntity])
+        const cfgPub: any = structuredClone(this.config.scimgateway.stream.publisher.entity[baseEntity])
         cfgPub.baseUrls = this.config.scimgateway.stream.baseUrls
         cfgPub.certificate = this.config.scimgateway.stream.certificate
         pub.add(baseEntity, cfgPub)
@@ -3795,6 +3797,7 @@ export class ScimGateway {
 
   /**
   * copyObj returns a copy of the object
+  * Note: prefer using structuredClone(obj)
   * @param obj object to be copied
   * @returns copy of object
   **/
@@ -3812,6 +3815,17 @@ export class ScimGateway {
     return utils.extendObj(obj, src)
   }
 
+  /**
+  * getNextStartIndex returns the next SCIM pagination startIndex based on current result set
+  * @param totalResults current totalResults
+  * @param startIndex: current startIndex
+  * @param count: current count
+  * @returns next startIndex
+  **/
+  getNextStartIndex(totalResults: number, startIndex: number, itemsPerPage: number): number {
+    return utilsScim.getNextStartIndex(totalResults, startIndex, itemsPerPage)
+  }
+
   /**
   * Lock for mutual exclusion
   * - const lock = new scimgateway.Lock()

package/lib/utils-scim.ts

@@ -26,7 +26,7 @@ type SCIMBulkOperation = {
 */
 export function convertedScim(obj: any, multiValueTypes: string[]): any {
   let err: any = null
-  const scimdata: any = utils.copyObj(obj)
+  const scimdata: any = structuredClone(obj)
   if (scimdata.schemas) delete scimdata.schemas
   const newMulti: Record<string, any> = {}
   if (!multiValueTypes) multiValueTypes = []
@@ -156,7 +156,7 @@ export function convertedScim(obj: any, multiValueTypes: string[]): any {
 export function convertedScim20(obj: any, multiValueTypes: string[]): any {
   if (!obj.Operations || !Array.isArray(obj.Operations)) return {}
   let scimdata: { [key: string]: any } = { meta: { attributes: [] } } // meta is used for deleted attributes
-  const o: any = utils.copyObj(obj)
+  const o: any = structuredClone(obj)
   const arrPrimaryDone: any = []
   const primaryOrgType: any = {}
 
@@ -199,7 +199,7 @@ export function convertedScim20(obj: any, multiValueTypes: string[]): any {
             typeElement = arrMatches[3] // streetAddress
 
             if (type === 'primary' && !arrPrimaryDone.includes(arrMatches[1])) { // make sure primary is included
-              const pObj: any = utils.copyObj(element)
+              const pObj: any = structuredClone(element)
               pObj.path = pObj.path.substring(0, pObj.path.lastIndexOf('.')) + '.primary'
               pObj.value = primaryValue
               o.Operations.push(pObj)

package/lib/utils.ts

@@ -192,7 +192,8 @@ export const copyObj = (o: any): any => { // deep copy/clone faster than JSON.pa
     if (typeof v === 'object' && v !== null) {
       const objProp = Object.getPrototypeOf(v) // e.g. HttpsProxyAgent {}
       if (objProp !== null && objProp !== Object.getPrototypeOf({}) && objProp !== Object.getPrototypeOf([])) {
-        output[key] = Object.assign(Object.create(v), v) // e.g. { HttpsProxyAgent {...} }
+        const proto = Object.getPrototypeOf(v)
+        output[key] = Object.assign(Object.create(proto), v) // e.g. { HttpsProxyAgent {...} }
       } else output[key] = copyObj(v)
     } else output[key] = v
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scimgateway",
-  "version": "6.1.9",
+  "version": "6.1.10",
   "type": "module",
   "description": "Using SCIM protocol as a gateway for user provisioning to other endpoints",
   "author": "Jarle Elshaug <jarle.elshaug@gmail.com> (https://elshaug.xyz)",