scimgateway 6.2.4 → 6.2.5

package/CHANGELOG.md

@@ -1,5 +1,8 @@
 # Change Log
 
+### v6.2.5
+- **[Fixed]** jwt config key `azureTenantId` not detected.
+
 ### v6.2.4
 - **[Improved]** `plugin-entra-id` now support reset users MFA capabilites and user will be forced to re-register MFA.
 

package/README.md

@@ -90,7 +90,7 @@ SCIM Gateway is a user provisioning bridge built with [Bun](https://bun.sh/) and
 - **v6.0.0** — API method response bodies returned as-is; new `publicApi()` method for unauthenticated `/pub/api` routes; `bearerJwtAzure.tenantIdGUID` replaced by `bearerJwt.azureTenantId`
 - **Federated Identity Credentials** (Entra ID) — access Microsoft-protected resources without managing secrets, via internal JWKS
 - **External JWKS** support for JWT authentication
-- **Azure Relay** — secure outbound-only tunnel with one minute of setup (~$10/month per listener)
+- **Azure Relay** — secure outbound-only tunnel with one minute of setup
 - **ETag** and **Bulk Operations** support (SCIM RFC 7644)
 - **Remote real-time log subscription** via browser, curl, or custom client at `https://<host>/logger`
 - **Gateway chaining** — chain `gateway1 → gateway2 → gateway3 → endpoint` with reverse-proxy-style auth validation

package/lib/plugin-entra-id.ts

@@ -641,7 +641,12 @@ scimgateway.modifyUser = async (baseEntity, id, attrObj, ctx) => {
   if (Object.hasOwn(parsedAttrObj, 'mfa')) {
     if (parsedAttrObj.mfa.reset === true) {
       if (!permission[baseEntity]?.mfa || !permission[baseEntity]?.eligible) throw new Error(`${action} error: MFA reset is not supported by the endpoint - missing permissions.`)
-      const currentRoles = await getUserRoles(baseEntity, id, [], true, ctx)
+      const res = await scimgateway.getGroups(baseEntity, { attribute: 'members.value', operator: 'eq', value: id }, ['id', 'displayName'], ctx)
+      let userGroups: Record<string, any>[] = []
+      if (res?.Resources && Array.isArray(res.Resources)) {
+        userGroups = res.Resources.map((r: Record<string, any>) => { return { value: r.id } })
+      }
+      const currentRoles = await getUserRoles(baseEntity, id, userGroups, true, ctx)
       const isPrivileged = currentRoles.some(r => isPrivilegedRole(r.value))
       if (isPrivileged) throw new Error(`${action} error: MFA reset is not allowed for users with high-privilege roles for security reasons.`)
       await resetUserMfa(baseEntity, id, ctx)

package/lib/scimgateway.ts

@@ -4405,7 +4405,7 @@ Content-Transfer-Encoding: quoted-printable
       // found logic
       if (lastKey === 'password' && key.startsWith('scimgateway.auth.basic')) foundBasic = true
       else if (lastKey === 'token' && key.startsWith('scimgateway.auth.bearerToken')) foundBearerToken = true
-      else if ((lastKey === 'publicKey' || lastKey === 'secret' || lastKey === 'wellKnownUri' || 'azureTenantId') && key.startsWith('scimgateway.auth.bearerJwt')) foundBearerJwt = true
+      else if ((lastKey === 'publicKey' || lastKey === 'secret' || lastKey === 'wellKnownUri' || lastKey === 'azureTenantId') && key.startsWith('scimgateway.auth.bearerJwt')) foundBearerJwt = true
       else if (lastKey === 'clientSecret' && key.startsWith('scimgateway.auth.bearerOAuth')) foundBearerOAuth = true
 
       // certificate full path

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scimgateway",
-  "version": "6.2.4",
+  "version": "6.2.5",
   "type": "module",
   "description": "Using SCIM protocol as a gateway for user provisioning to other endpoints",
   "author": "Jarle Elshaug <jarle.elshaug@gmail.com> (https://elshaug.xyz)",