scimgateway 6.2.5 → 6.2.7

package/lib/azure-license-mapping.json

@@ -27,16 +27,24 @@
 "Microsoft_365_F1":{"displayName":"Microsoft 365 F1","category":"Microsoft 365","licenseCategory":"Paid","isBillable":true,"priceUSD":2.25,"includes":["EXCHANGESTANDARD","SHAREPOINTSTANDARD","MCOSTANDARD","ONEDRIVESTANDARD"],"derivedIncludes":["EXCHANGESTANDARD","SHAREPOINTSTANDARD","MCOSTANDARD","ONEDRIVESTANDARD"]},
 "ENTRA_IDENTITY_PROTECTION":{"displayName":"Microsoft Entra ID Protection","category":"Entra","licenseCategory":"Paid","isBillable":true,"priceUSD":6,"includes":["AAD_PREMIUM_P2"],"derivedIncludes":["AAD_PREMIUM_P2","AAD_PREMIUM"]},
 "ENTRA_IDENTITY_GOVERNANCE_STEPUP":{"displayName":"Microsoft Entra ID Governance Step-Up","category":"Entra","licenseCategory":"Paid","isBillable":true,"priceUSD":4,"includes":["AAD_PREMIUM_P1"],"derivedIncludes":["AAD_PREMIUM_P1"]},
+"M365_E5_SECURITY":{"displayName":"Microsoft 365 E5 Security","category":"Security","licenseCategory":"Paid","isBillable":true,"priceUSD":12,"includes":["MDE_ADVANCED","DEFENDER_OFFICE_365","IDENTITY_THREAT_PROTECTION","DEFENDER_CLOUD_APPS"],"derivedIncludes":["MDE_ADVANCED","DEFENDER_OFFICE_365","IDENTITY_THREAT_PROTECTION","DEFENDER_CLOUD_APPS"]},
+"M365_E5_COMPLIANCE":{"displayName":"Microsoft 365 E5 Compliance","category":"Security","licenseCategory":"Paid","isBillable":true,"priceUSD":10,"includes":[]},
 "ENTRA_PERMISSIONS_MANAGEMENT":{"displayName":"Microsoft Entra Permissions Management","category":"Entra","licenseCategory":"Paid","isBillable":true,"priceUSD":10,"includes":[]},
+"ENTRA_WORKLOAD_ID":{"displayName":"Microsoft Entra Workload ID","category":"Entra","licenseCategory":"Paid","isBillable":true,"priceUSD":3,"includes":[]},
+"ENTRA_VERIFIED_ID":{"displayName":"Microsoft Entra Verified ID","category":"Entra","licenseCategory":"Consumption","isBillable":true,"priceUSD":0,"includes":[]},
 "AAD_PREMIUM_P1":{"displayName":"Microsoft Entra ID P1","category":"Entra","licenseCategory":"Paid","isBillable":true,"priceUSD":6,"includes":[]},
 "AAD_B2C":{"displayName":"Azure AD B2C","category":"Entra","licenseCategory":"Consumption","isBillable":true,"priceUSD":0,"includes":[]},
 "AAD_BASIC_EDU":{"displayName":"Azure Active Directory Basic (Education)","category":"Entra","licenseCategory":"Free","isBillable":false,"priceUSD":0,"includes":[]},
 "M365_DEFENDER_IDENTITY":{"displayName":"Microsoft 365 Defender for Identity","category":"Security","licenseCategory":"Paid","isBillable":true,"priceUSD":6,"includes":[]},
+"TEAMS_PREMIUM":{"displayName":"Microsoft Teams Premium","category":"Collaboration","licenseCategory":"Paid","isBillable":true,"priceUSD":10,"includes":[]},
 "Microsoft_Teams_EEA_New": { "displayName": "Microsoft Teams EEA New", "category": "Collaboration", "licenseCategory": "Paid", "isBillable": true, "priceUSD": 4.00, "includes": [] },
+"MCOEV_VIRTUALUSER":{"displayName":"Teams Phone Resource Account License","category":"Collaboration","licenseCategory":"Paid","isBillable":true,"priceUSD":0,"includes":[]},
+"TEAMS_AUDIO_CONF":{"displayName":"Microsoft Teams Audio Conferencing","category":"Collaboration","licenseCategory":"Paid","isBillable":true,"priceUSD":4,"includes":[]},
 "POWERAPPS_DEV": { "displayName": "Power Apps Developer Plan", "category": "Power Platform", "licenseCategory": "Free", "isBillable": false, "priceUSD": 0.00, "includes": [] },
 "EXCHANGESTANDARD":{"displayName":"Exchange Online Plan 1","category":"Exchange","licenseCategory":"Paid","isBillable":true,"priceUSD":4,"includes":[]},
 "EXCHANGEENTERPRISE":{"displayName":"Exchange Online Plan 2","category":"Exchange","licenseCategory":"Paid","isBillable":true,"priceUSD":8,"includes":[]},
 "EXCHANGEARCHIVE_ADDON":{"displayName":"Exchange Online Archiving","category":"Exchange","licenseCategory":"Paid","isBillable":true,"priceUSD":3,"includes":[]},
+"EXCHANGE_KIOSK":{"displayName":"Exchange Online Kiosk","category":"Exchange","licenseCategory":"Paid","isBillable":true,"priceUSD":2,"includes":[]},
 "SHAREPOINTSTANDARD":{"displayName":"SharePoint Online Plan 1","category":"SharePoint","licenseCategory":"Paid","isBillable":true,"priceUSD":5,"includes":[]},
 "SHAREPOINTENTERPRISE":{"displayName":"SharePoint Online Plan 2","category":"SharePoint","licenseCategory":"Paid","isBillable":true,"priceUSD":10,"includes":[]},
 "MCOSTANDARD":{"displayName":"Microsoft Teams","category":"Collaboration","licenseCategory":"Paid","isBillable":true,"priceUSD":5,"includes":[]},
@@ -44,6 +52,8 @@
 "PHONESYSTEM_VIRTUALUSER":{"displayName":"Microsoft Teams Phone Resource Account","category":"Collaboration","licenseCategory":"Paid","isBillable":true,"priceUSD":0,"includes":[]},
 "MCOPSTN1":{"displayName":"Microsoft Teams Domestic Calling Plan","category":"Collaboration","licenseCategory":"Paid","isBillable":true,"priceUSD":8,"includes":[]},
 "MCOPSTN2":{"displayName":"Microsoft Teams International Calling Plan","category":"Collaboration","licenseCategory":"Paid","isBillable":true,"priceUSD":12,"includes":[]},
+"POWER_AUTOMATE_PER_FLOW":{"displayName":"Power Automate Per Flow","category":"Power Platform","licenseCategory":"Paid","isBillable":true,"priceUSD":100,"includes":[]},
+"POWER_PAGES":{"displayName":"Power Pages","category":"Power Platform","licenseCategory":"Consumption","isBillable":true,"priceUSD":0,"includes":[]},
 "POWER_BI_STANDARD":{"displayName":"Microsoft Fabric (Free)","category":"Power Platform","licenseCategory":"Free","isBillable":false,"priceUSD":0,"includes":[]},
 "POWER_BI_PRO":{"displayName":"Power BI Pro","category":"Power Platform","licenseCategory":"Paid","isBillable":true,"priceUSD":13,"includes":[]},
 "POWERAPPS_PER_USER":{"displayName":"Power Apps Per User","category":"Power Platform","licenseCategory":"Paid","isBillable":true,"priceUSD":10,"includes":[]},
@@ -58,10 +68,15 @@
 "VISIO_P2":{"displayName":"Visio Plan 2","category":"Visio","licenseCategory":"Paid","isBillable":true,"priceUSD":12,"includes":[]},
 "MDE_ADVANCED":{"displayName":"Microsoft Defender for Endpoint","category":"Security","licenseCategory":"Paid","isBillable":true,"priceUSD":8,"includes":[]},
 "DEFENDER_OFFICE_365":{"displayName":"Microsoft Defender for Office 365","category":"Security","licenseCategory":"Paid","isBillable":true,"priceUSD":5,"includes":[]},
+"DEFENDER_ENDPOINT_P1":{"displayName":"Microsoft Defender for Endpoint Plan 1","category":"Security","licenseCategory":"Paid","isBillable":true,"priceUSD":3,"includes":[]},
+"DEFENDER_ENDPOINT_P2":{"displayName":"Microsoft Defender for Endpoint Plan 2","category":"Security","licenseCategory":"Paid","isBillable":true,"priceUSD":5,"includes":[]},
+"DEFENDER_IDENTITY_STANDALONE":{"displayName":"Microsoft Defender for Identity (Standalone)","category":"Security","licenseCategory":"Paid","isBillable":true,"priceUSD":6,"includes":[]},
 "IDENTITY_THREAT_PROTECTION":{"displayName":"Microsoft Defender for Identity","category":"Security","licenseCategory":"Paid","isBillable":true,"priceUSD":6,"includes":[]},
 "DEFENDER_CLOUD_APPS":{"displayName":"Microsoft Defender for Cloud Apps","category":"Security","licenseCategory":"Paid","isBillable":true,"priceUSD":7,"includes":[]},
 "M365_COPILOT":{"displayName":"Microsoft 365 Copilot","category":"AI","licenseCategory":"Paid","isBillable":true,"priceUSD":30,"includes":[]},
 "COPILOT_STUDIO":{"displayName":"Copilot Studio","category":"AI","licenseCategory":"Paid","isBillable":true,"priceUSD":20,"includes":[]},
+"GITHUB_COPILOT":{"displayName":"GitHub Copilot Business","category":"AI","licenseCategory":"Paid","isBillable":true,"priceUSD":19,"includes":[]},
+"DYNAMICS_COPILOT":{"displayName":"Dynamics 365 Copilot","category":"AI","licenseCategory":"Paid","isBillable":true,"priceUSD":0,"includes":[]},
 "VIVA_CONNECTIONS":{"displayName":"Microsoft Viva Connections","category":"Viva","licenseCategory":"Paid","isBillable":true,"priceUSD":3,"includes":[]},
 "VIVA_INSIGHTS":{"displayName":"Microsoft Viva Insights","category":"Viva","licenseCategory":"Paid","isBillable":true,"priceUSD":3,"includes":[]},
 "VIVA_LEARNING":{"displayName":"Microsoft Viva Learning","category":"Viva","licenseCategory":"Paid","isBillable":true,"priceUSD":4,"includes":[]},
@@ -76,6 +91,8 @@
 "ENTRA_PRIVATE_ACCESS":{"displayName":"Microsoft Entra Private Access","category":"Entra","licenseCategory":"Paid","isBillable":true,"priceUSD":8,"includes":[]},
 "ENTRA_INTERNET_ACCESS":{"displayName":"Microsoft Entra Internet Access","category":"Entra","licenseCategory":"Paid","isBillable":true,"priceUSD":5,"includes":[]},
 "WINDOWS_STORE":{"displayName":"Microsoft Store for Business","category":"Windows","licenseCategory":"Free","isBillable":false,"priceUSD":0,"includes":[]},
+"WINDOWS_E3":{"displayName":"Windows Enterprise E3","category":"Windows","licenseCategory":"Paid","isBillable":true,"priceUSD":7,"includes":[]},
+"WINDOWS_E5":{"displayName":"Windows Enterprise E5","category":"Windows","licenseCategory":"Paid","isBillable":true,"priceUSD":11,"includes":[]},
 "WIN_DEF_ATP":{"displayName":"Windows Defender ATP","category":"Security","licenseCategory":"Paid","isBillable":true,"priceUSD":5,"includes":[]},
 "RMS_S_ENTERPRISE":{"displayName":"Azure Information Protection Premium P1","category":"Security","licenseCategory":"Paid","isBillable":true,"priceUSD":6,"includes":[]},
 "INTUNE_A":{"displayName":"Microsoft Intune","category":"Device Management","licenseCategory":"Paid","isBillable":true,"priceUSD":8,"includes":[]},

package/lib/helper-rest.ts

@@ -59,6 +59,35 @@ export class HelperRest {
         }
       }
     }
+
+    ;(async () => {
+      // housekeeping - odata pagination
+      while (true) {
+        await new Promise(resolve => setTimeout(resolve, 5 * 60 * 1000)) // 5 minutes
+        for (const baseEntity in this.config_entity) {
+          if (!this._serviceClient[baseEntity]?.index) continue
+          for (const index in this._serviceClient[baseEntity].index) {
+            const parsed = parseInt(index, 10)
+            if (Number.isNaN(parsed)) continue
+            if (Object.keys(this._serviceClient[baseEntity].index[parsed]).length === 0) {
+              delete this._serviceClient[baseEntity].index[parsed]
+              continue
+            }
+            for (const optionsUrl in this._serviceClient[baseEntity].index[parsed]) {
+              const validTo = this._serviceClient[baseEntity].index[parsed][optionsUrl].validTo
+              if (Number.isNaN(validTo)) {
+                delete this._serviceClient[baseEntity].index[parsed][optionsUrl]
+                continue
+              }
+              const now = Math.floor(Date.now() / 1000)
+              if (now > validTo) {
+                delete this._serviceClient[baseEntity].index[parsed][optionsUrl]
+              }
+            }
+          }
+        }
+      }
+    })()
   }
 
   /**
@@ -659,28 +688,25 @@ export class HelperRest {
           options.body = dataString
         } else if (options.headers) delete options.headers['Content-Type']
 
-        if (this._serviceClient[baseEntity]?.nextLink[options.url]) {
-          if (ctx?.paging?.startIndex && ctx.paging.startIndex > 1) {
-            if (ctx.paging.startIndex === this._serviceClient[baseEntity]?.nextLink[options.url].startIndex) {
-              options.url = this._serviceClient[baseEntity]?.nextLink[options.url]['@odata.nextLink']
-            } else {
-              if (!ctx) ctx = {}
-              if (!ctx.paging) ctx.paging = {}
-              if (this._serviceClient[baseEntity]?.nextLink[options.url].totalResults
-                && ctx.paging.startIndex > this._serviceClient[baseEntity]?.nextLink[options.url].totalResults) {
-                ctx.paging.totalResults = this._serviceClient[baseEntity]?.nextLink[options.url].totalResults
-                return { body: { value: [] } }
-              } else {
-                // reset the paging cursor - none expected startIndex sequence, using default none paged url
-                ctx.paging.startIndex = 1 // caller should check and return this new startIndex in final response
-                delete this._serviceClient[baseEntity].nextLink[options.url]
-              }
+        const optionsUrl = options.url
+        const startIndex: number = ctx?.paging?.startIndex || 0
+        if (startIndex > 1) {
+          if (this._serviceClient[baseEntity].index && this._serviceClient[baseEntity].index[startIndex]
+            && this._serviceClient[baseEntity].index[startIndex][optionsUrl] && this._serviceClient[baseEntity].index[startIndex][optionsUrl].nextLink) {
+            options.url = this._serviceClient[baseEntity].index[startIndex][optionsUrl].nextLink
+          } else {
+            let max = 0
+            for (const key in this._serviceClient[baseEntity].index) {
+              const parsed = parseInt(key, 10)
+              if (Number.isNaN(parsed)) continue
+              if (!this._serviceClient[baseEntity].index[parsed][optionsUrl]?.totalResults) continue
+              if (parsed > max) max = parsed
             }
-          }
-        } else {
-          if (ctx?.paging?.startIndex > 1 && !this._serviceClient[baseEntity]?.nextLink[options.url]) { // no previous paging and invalid startIndex
-            ctx.paging.totalResults = ctx.paging.startIndex - 1
-            return { body: { value: [] } }
+            if (max > 0) {
+              ctx.paging.totalResults = this._serviceClient[baseEntity].index[max][optionsUrl].totalResults
+              if (startIndex > ctx.paging.totalResults) return { body: { value: [] } }
+            }
+            throw new Error(`Strict sequencing is required; startIndex=${ctx.paging.startIndex} is not the expected value.`)
           }
         }
 
@@ -721,38 +747,56 @@ export class HelperRest {
         //   if (!ctx) ctx = { paging }
         //   else ctx.paging = paging
         if (result.body && typeof result.body === 'object') {
-          if (result.body['@odata.nextLink']) { // {"@odata.nextLink": "https://graph.microsoft.com/v1.0/users?$top=100&$skiptoken=xxx"}
+          if (result.body['@odata.nextLink']) { // {"@odata.nextLink": "https://graph.microsoft.com/beta/users?$top=100&$skiptoken=xxx"}
             if (!ctx) ctx = {}
             if (!ctx.paging) ctx.paging = {}
-            const nextLinkBase = decodeURIComponent(result.body['@odata.nextLink'].substring(0, result.body['@odata.nextLink'].indexOf('$skiptoken') - 1))
             const count = result.body['@odata.count']
             if (count !== undefined) {
               ctx.paging.totalResults = count
             }
-            let totalResults = ctx.paging.totalResults
-            if (!totalResults) totalResults = (this._serviceClient[baseEntity].nextLink[nextLinkBase]?.totalResults)
-            let isCount = this._serviceClient[baseEntity].nextLink[nextLinkBase]?.isCount || count !== undefined
             const itemsPerPage = result.body.value.length
-            this._serviceClient[baseEntity].nextLink[nextLinkBase] = {}
-            this._serviceClient[baseEntity].nextLink[nextLinkBase]['startIndex'] = ctx.paging.startIndex ? ctx.paging.startIndex + itemsPerPage : itemsPerPage + 1
-            this._serviceClient[baseEntity].nextLink[nextLinkBase]['@odata.nextLink'] = result.body['@odata.nextLink']
-            this._serviceClient[baseEntity].nextLink[nextLinkBase]['isCount'] = isCount
-            if (isCount) {
-              this._serviceClient[baseEntity].nextLink[nextLinkBase]['totalResults'] = totalResults // count=true ignored when using nextLink
+            const nextStartIndex = ctx.paging.startIndex ? ctx.paging.startIndex + itemsPerPage : itemsPerPage + 1
+            let totalResults = ctx.paging.totalResults
+            if (ctx.paging.startIndex && this._serviceClient[baseEntity].index && this._serviceClient[baseEntity].index[ctx.paging.startIndex]) {
+              if (this._serviceClient[baseEntity].index[ctx.paging.startIndex][optionsUrl]) {
+                if (!totalResults) totalResults = this._serviceClient[baseEntity].index[ctx.paging.startIndex][optionsUrl].totalResults
+              }
+              delete this._serviceClient[baseEntity].index[ctx.paging.startIndex] // could consider not to delte prior and let houskeeping do the cleanup
+            }
+
+            if (!this._serviceClient[baseEntity].index) this._serviceClient[baseEntity].index = {}
+            if (!this._serviceClient[baseEntity].index[nextStartIndex]) this._serviceClient[baseEntity].index[nextStartIndex] = {}
+            if (!this._serviceClient[baseEntity].index[nextStartIndex][optionsUrl]) this._serviceClient[baseEntity].index[nextStartIndex][optionsUrl] = {}
+            this._serviceClient[baseEntity].index[nextStartIndex][optionsUrl].nextLink = result.body['@odata.nextLink']
+            ctx.paging.nextLink = result.body['@odata.nextLink'] // gives client option to auto-paginate without using startIndex
+            if (ctx.paging.nextLink.startsWith(this._serviceClient[baseEntity].baseUrl)) {
+              ctx.paging.nextLink = ctx.paging.nextLink.slice(this._serviceClient[baseEntity].baseUrl.length)
+              if (!ctx.paging.nextLink.startsWith('/')) ctx.paging.nextLink = '/' + ctx.paging.nextLink
+            }
+
+            if (count) {
+              this._serviceClient[baseEntity].index[nextStartIndex][optionsUrl].totalResults = totalResults // count=true ignored when using nextLink
               ctx.paging.totalResults = totalResults
             } else {
               const totalResults = ctx.paging.startIndex - 1 + (itemsPerPage * 2) // ensure new client paging
-              this._serviceClient[baseEntity].nextLink[nextLinkBase]['totalResults'] = totalResults
+              this._serviceClient[baseEntity].index[nextStartIndex][optionsUrl].totalResults = totalResults
               ctx.paging.totalResults = totalResults
             }
+            const d = Math.floor((Date.now() + 5 * 60 * 1000) / 1000)// now + 5 minutes
+            this._serviceClient[baseEntity].index[nextStartIndex][optionsUrl].validTo = d
           } else { // no more paging
-            const linkBase = decodeURIComponent(options.url?.substring(0, options.url?.indexOf('$skiptoken') - 1))
-            if (ctx?.paging?.startIndex && ctx.paging.startIndex > 1 && this._serviceClient[baseEntity]?.nextLink[linkBase]) {
-              if (!this._serviceClient[baseEntity]?.nextLink[linkBase].isCount) { // final no count page
+            if (ctx?.paging) {
+              if (ctx.paging.nextLink) delete ctx.paging.nextLink
+              if (ctx.paging.startIndex) {
                 const itemsPerPage = result.body.value.length
                 const totalResults = ctx.paging.startIndex - 1 + itemsPerPage
-                this._serviceClient[baseEntity].nextLink[linkBase]['totalResults'] = totalResults
-                ctx.paging.totalResults = totalResults
+                if (this._serviceClient[baseEntity].index && this._serviceClient[baseEntity].index[ctx.paging.startIndex] && this._serviceClient[baseEntity].index[ctx.paging.startIndex][optionsUrl]) {
+                // keeping the last one with updated totalResults to catch startIndex > totalResults, houskeeping will clean up after 5 minutes
+                  this._serviceClient[baseEntity].index[ctx.paging.startIndex][optionsUrl].totalResults = totalResults // update the last one with correct totalResults
+                  ctx.paging.totalResults = totalResults
+                  const d = Math.floor((Date.now() + 5 * 60 * 1000) / 1000)
+                  this._serviceClient[baseEntity].index[ctx.paging.startIndex][optionsUrl].validTo = d
+                }
               }
             }
           }
@@ -769,12 +813,6 @@ export class HelperRest {
         if (!retryAfter) retryAfter = 60
       }
 
-      if (retryAfter) {
-        this.scimgateway.logDebug(baseEntity, `doRequest ${method} ${path} throttle/ratelimit error - awaiting ${retryAfter} seconds before automatic retry`)
-        await new Promise(resolve => setTimeout(resolve, retryAfter * 1000))
-      }
-
-      if (!retryCount) retryCount = 0
       let urlObj
       try { urlObj = new URL(path) } catch (err) { void 0 }
       let isServiceClient = !urlObj && this._serviceClient[baseEntity] && !this.lock.isLocked() // !isLocked to avoid retry ongoing doRequest with failing getAccessToken()
@@ -782,12 +820,25 @@ export class HelperRest {
 
       if (isServiceClient && (err.code === 'ECONNREFUSED' || err.code === 'ENOTFOUND' || err.code === 'ABORT_ERR' || err.code === 'ETIMEDOUT' || statusCode === 504 || oAuthTokeErr || retryAfter)) {
         this.scimgateway.logDebug(baseEntity, `doRequest ${method} ${path} Body = ${JSON.stringify(body)} Error Response = ${err.message}`)
-        if (retryCount < connectionObj.baseUrls.length) {
-          retryCount++
-          if (isServiceClient) {
-            this.updateServiceClient(baseEntity, { baseUrl: connectionObj.baseUrls[retryCount - 1] })
-            this.scimgateway.logDebug(baseEntity, `${(connectionObj.baseUrls.length > 1) ? 'failover ' : ''}retry[${retryCount}] using baseUrl = ${this._serviceClient[baseEntity].baseUrl}`)
+
+        let maxRetry = connectionObj.baseUrls.length
+        if (!retryCount) retryCount = 0
+        if (retryAfter) {
+          const delta = retryCount - maxRetry
+          if (delta >= 0 && delta < 2) maxRetry += delta + 1 // allow 3 retry for the same initial throttle
+        }
+
+        if (retryCount < maxRetry) {
+          if (retryAfter) {
+            this.scimgateway.logDebug(baseEntity, `doRequest ${method} ${path} throttle/ratelimit error - awaiting ${retryAfter} seconds before automatic retry`)
+            await new Promise(resolve => setTimeout(resolve, retryAfter * 1000))
           }
+          const index = retryCount < connectionObj.baseUrls.length ? retryCount : connectionObj.baseUrls.length - 1
+          retryCount++
+
+          this.updateServiceClient(baseEntity, { baseUrl: connectionObj.baseUrls[index] })
+          this.scimgateway.logDebug(baseEntity, `${(connectionObj.baseUrls.length > 1) ? 'failover ' : ''}retry[${retryCount}] using baseUrl = ${this._serviceClient[baseEntity].baseUrl}`)
+
           if (oAuthTokeErr) {
             delete this._serviceClient[baseEntity] // ensure new getAccessToken request - token used should not have been expired, but rejected for other reason e.g. token server restart and no persistent token store?
           }
@@ -868,7 +919,7 @@ export class HelperRest {
   * {
   *   "type": "oauth",
   *   "options": {
-  *     "azureTenantId": "<Entra ID azureTenantId", // Entra ID authentication - if baseUrls not defined, baseUrls automatically set to [https://graph.microsoft.com/v1.0]
+  *     "azureTenantId": "<Entra ID azureTenantId", // Entra ID authentication - if baseUrls not defined, baseUrls automatically set to [https://graph.microsoft.com/beta]
   *     "tokenUrl": "<tokenUrl>", // must be set if not using azureTenantId
   *     "clientId": "<clientId>",
   *     "clientSecret": "<clientSecret>"
@@ -927,7 +978,7 @@ export class HelperRest {
   * {
   *   "type": "oauthJwtBearer",
   *   "options": {
-  *     "azureTenantId": "<Entra ID azureTenantId", // Entra ID authentication, if baseUrls not defined, baseUrls automatically set to [https://graph.microsoft.com/v1.0]
+  *     "azureTenantId": "<Entra ID azureTenantId", // Entra ID authentication, if baseUrls not defined, baseUrls automatically set to [https://graph.microsoft.com/beta]
   *     "clientId": "<clientId>",
   *     "tls": { // files located in ./config/certs
   *       "key": "key.pem",

package/lib/plugin-entra-id.ts

@@ -76,7 +76,7 @@
 import path from 'node:path'
 
 // start - mandatory plugin initialization
-import { ScimGateway, HelperRest } from 'scimgateway'
+import { ScimGateway, HelperRest, LicenseData } from 'scimgateway'
 const scimgateway = new ScimGateway()
 const helper = new HelperRest(scimgateway)
 const config = scimgateway.getConfig()
@@ -84,7 +84,6 @@ scimgateway.authPassThroughAllowed = false
 scimgateway.pluginAndOrFilterEnabled = true
 // end - mandatory plugin initialization
 
-const newHelper = new HelperRest(scimgateway)
 const entitlementsByValues: Record<string, any> = {}
 const rolesByValues: Record<string, any> = {}
 const rolesAssignments: Record<string, any> = {}
@@ -94,18 +93,14 @@ const permission: Record<string, any> = {}
 
 // load Azure license mapping JSON-file having skuPartNumber and corresponding user-friendly name
 let fs: typeof import('fs')
-let licenseMapping: Record<string, any> = {}
+let licenseMapping: Record<string, any> = LicenseData
 async function loadLicenseMapping() {
   try {
     if (!fs) fs = (await import('fs'))
+    // runtime override: if file exists in pluginDir, use it instead of the embedded default
     let mappingPath = path.join(scimgateway.pluginDir, 'azure-license-mapping.json')
     if (fs.existsSync(mappingPath)) {
       licenseMapping = JSON.parse(fs.readFileSync(mappingPath, 'utf8'))
-    } else {
-      mappingPath = path.join(scimgateway.gwDir, 'azure-license-mapping.json')
-      if (fs.existsSync(mappingPath)) {
-        licenseMapping = JSON.parse(fs.readFileSync(mappingPath, 'utf8'))
-      }
     }
   } catch (err) {
     scimgateway.logDebug('plugin-entra-id', `Error loading license mapping: ${err}`)
@@ -252,7 +247,7 @@ scimgateway.getUsers = async (baseEntity, getObj, attributes, ctx) => {
     }
   } else selectAttributes = userSelectAttributes
 
-  if (!permission[baseEntity]?.signInActivity) { // remove signInActivity
+  if (permission[baseEntity]?.signInActivity === false) { // remove signInActivity
     const index = selectAttributes.indexOf('signInActivity')
     if (index > -1) {
       selectAttributes.splice(index, 1)
@@ -941,15 +936,14 @@ scimgateway.getGroups = async (baseEntity, getObj, attributes, ctx) => {
     if (getObj.operator === 'eq' && ['id', 'displayName', 'externalId'].includes(getObj.attribute)) {
       // mandatory - unique filtering - single unique user to be returned - correspond to getUser() in versions < 4.x.x
       if (getObj.attribute === 'id') {
-        if (includeMembers) path = `/groups/${getObj.value}?$select=${attrs.join()}&$expand=members($select=id,displayName)`
-        else path = `/groups/${getObj.value}?$select=${attrs.join()}`
+        path = `/groups/${getObj.value}?$select=${attrs.join()}`
       } else {
-        if (includeMembers) path = `/groups?$filter=${getObj.attribute} eq '${getObj.value}'&$select=${attrs.join()}&$expand=members($select=id,displayName)`
-        else path = `/groups?$filter=${getObj.attribute} eq '${getObj.value}'&$select=${attrs.join()}`
+        path = `/groups?$filter=${getObj.attribute} eq '${getObj.value}'&$select=${attrs.join()}`
       }
     } else if (isUserMemberOf) {
       // mandatory - return all groups the user 'id' (getObj.value) is member of - correspond to getGroupMembers() in versions < 4.x.x
       // Resources = [{ id: <id-group>> , displayName: <displayName-group>, members [{value: <id-user>}] }]
+      includeMembers = false
       path = `/users/${getObj.value}/transitiveMemberOf/microsoft.graph.group?$top=${getObj.count}&$count=true&$select=id,displayName`
     } else {
       // optional - simpel filtering
@@ -961,8 +955,7 @@ scimgateway.getGroups = async (baseEntity, getObj, attributes, ctx) => {
     throw new Error(`${action} error: not supporting advanced filtering: ${getObj.rawFilter}`)
   } else {
     // mandatory - no filtering (!getObj.operator && !getObj.rawFilter) - all groups to be returned - correspond to exploreGroups() in versions < 4.x.x
-    if (includeMembers) path = `/groups?$top=${getObj.count}&$count=true&$select=${attrs.join()}&$expand=members($select=id,displayName)`
-    else path = `/groups?$top=${getObj.count}&$count=true&$select=${attrs.join()}`
+    path = `/groups?$top=${getObj.count}&$count=true&$select=${attrs.join()}`
   }
   if (getObj.and || getObj.or) {
     // plugin have enabled 'scimgateway.pluginAndOrFilterEnabled' and the query includes an additonal and/or getObj that must to be handled and combined with the initial getObj
@@ -984,7 +977,7 @@ scimgateway.getGroups = async (baseEntity, getObj, attributes, ctx) => {
   if (!ctx) ctx = { paging }
   else ctx.paging = paging
 
-  const newCtx = { ...ctx }
+  const newCtx: Record<string, any> = ctx?.headers ? { headers: ctx?.headers } : {}
   newCtx.paging = { startIndex: 1 }
 
   try {
@@ -993,11 +986,11 @@ scimgateway.getGroups = async (baseEntity, getObj, attributes, ctx) => {
     if (!isUserMemberOf) response = await helper.doRequest(baseEntity, method, path, body, ctx, options)
     else {
       // request both the default transitiveMemberOf (includes nested groups) and memberOf because we want to distinguish SCIM type=direct/indirect
-      const pathMemberOf = `/users/${getObj.value}/memberOf/microsoft.graph.group?$top=${getObj.count}&$count=true&$select=id,displayName`
+      let pathMemberOf = `/users/${getObj.value}/memberOf/microsoft.graph.group?$count=true&$select=id,displayName`
       const allErrors: string[] = []
       const results = await Promise.allSettled([
         helper.doRequest(baseEntity, method, path, body, ctx, options),
-        newHelper.doRequest(baseEntity, method, pathMemberOf, body, newCtx, options), // using newHelper to avoid shared internal helperRest paging 
+        helper.doRequest(baseEntity, method, pathMemberOf, body, newCtx, options),
       ])
       const errors = results
         .filter(r => r.status === 'rejected')
@@ -1010,30 +1003,23 @@ scimgateway.getGroups = async (baseEntity, getObj, attributes, ctx) => {
       }
 
       response = (results[0] as PromiseFulfilledResult<any>).value // includes all groups (also nested)
-      responseMemberOf = (results[1] as PromiseFulfilledResult<any>).value // do not include nested groups
-
-      let nextStartIndex = scimgateway.getNextStartIndex(responseMemberOf.body.value.length * 2, newCtx.paging.startIndex, responseMemberOf.body.value.length)
-      if (nextStartIndex > newCtx.paging.startIndex && responseMemberOf && responseMemberOf.body.value && Array.isArray(responseMemberOf.body.value)) {
-        // use paging to ensure responseMemberOf is complete 
-        let totalResults = responseMemberOf.body.value.length
-        let startIndex = 1
+      responseMemberOf = (results[1] as PromiseFulfilledResult<any>).value // does not include nested groups
+      while (newCtx.paging.nextLink) {
         let res: any
-        do {
-          try {
-            startIndex = nextStartIndex
-            newCtx.paging.startIndex = startIndex
-            res = await newHelper.doRequest(baseEntity, method, pathMemberOf, body, newCtx, options)
-          } catch (err) { void 0 }
-          if (res?.body && res.body.value && Array.isArray(res.body.value) && res.body.value.length > 0) {
-            const count = res.body.value.length
-            totalResults += count
-            nextStartIndex = scimgateway.getNextStartIndex(totalResults + count, startIndex, count)
-            for (let i = 0; i < res.body.value.length; i++) {
-              if (!res.body.value[i].id) continue
-              responseMemberOf.body.value.push(res.body.value[i])
-            }
+        pathMemberOf = newCtx.paging.nextLink
+        delete newCtx.paging.nextLink
+        try {
+          res = await helper.doRequest(baseEntity, method, pathMemberOf, body, newCtx, options)
+        } catch (err: any) {
+          delete newCtx.paging.nextLink
+          break
+        }
+        if (res?.body && res.body.value && Array.isArray(res.body.value) && res.body.value.length > 0) {
+          for (let i = 0; i < res.body.value.length; i++) {
+            if (!res.body.value[i].id) continue
+            responseMemberOf.body.value.push(res.body.value[i])
           }
-        } while (nextStartIndex > startIndex)
+        }
       }
 
       if (response.body && response.body.value && Array.isArray(response.body.value)) {
@@ -1047,6 +1033,7 @@ scimgateway.getGroups = async (baseEntity, getObj, attributes, ctx) => {
         })
       }
     }
+
     if (!response.body) {
       throw new Error(`invalid response: ${JSON.stringify(response)}`)
     }
@@ -1056,6 +1043,22 @@ scimgateway.getGroups = async (baseEntity, getObj, attributes, ctx) => {
     }
 
     for (let i = 0; i < response.body.value.length; ++i) {
+      if (includeMembers) {
+        const id = response.body.value[i].id
+        if (!id) break
+        let path = `/groups/${id}/members?$select=id,displayName`
+        const newCtx: Record<string, any> = ctx?.headers ? { headers: ctx?.headers } : {}
+        newCtx.paging = { startIndex: 1 }
+        const r = await helper.doRequest(baseEntity, 'GET', path, null, newCtx, options)
+        response.body.value[i].members = r.body?.value || []
+        while (newCtx.paging.nextLink) {
+          const path = newCtx.paging.nextLink
+          delete newCtx.paging.nextLink
+          const r = await helper.doRequest(baseEntity, 'GET', path, null, newCtx, options)
+          response.body.value[i].members.push(...r.body?.value || [])
+        }
+      }
+
       let members: any
       if (response.body.value[i].members) {
         members = response.body.value[i].members.reduce((acc: any[], el: Record<string, any>) => {

package/lib/saml/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+ 
+Copyright (c) 2015 Auth0, Inc. <support@auth0.com> (http://auth0.com)
+ 
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+ 
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+ 
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/lib/saml/README.md

@@ -0,0 +1,66 @@
+# Local `saml` Package
+
+This folder contains a local copy of the [node-saml](https://github.com/auth0/node-saml) package (v4.0.0), originally authored by Auth0.  
+Licensed under the MIT License — see [LICENSE](./LICENSE).
+
+## Why This Exists
+
+When compiling scimgateway plugins to standalone binaries using `bun build --compile`, the original `saml` npm package fails at runtime on any machine other than the build machine.
+
+**Root cause:** The original `saml` package uses `fs.readFileSync` with `__dirname`-resolved paths to load XML template files (`saml11.template` and `saml20.template`) at module initialization:
+
+```js
+// Original saml/lib/saml11.js
+var newSaml11Document = utils.factoryForNode(path.join(__dirname, 'saml11.template'));
+```
+
+```js
+// Original saml/lib/utils.js
+exports.factoryForNode = function factoryForNode(pathToTemplate) {
+  const template = fs.readFileSync(pathToTemplate);  // fails in compiled binary
+  ...
+};
+```
+
+When Bun compiles the binary, `__dirname` gets baked in as the **absolute path from the build machine** (e.g. `/Users/xxx/.../node_modules/saml/lib/`). The `.template` files are not embedded in the binary, so the `readFileSync` call fails with `ENOENT` when the binary runs elsewhere.
+
+## What Was Changed
+
+Only one functional change was made — **templates are inlined as string constants** instead of being read from disk at runtime.
+
+### `utils.js`
+- Removed `const fs = require('fs')` — no longer needed
+- Changed `factoryForNode(pathToTemplate)` to `factoryForNode(templateString)` — accepts an XML string directly instead of a file path
+
+### `saml11.js` and `saml20.js`
+- Removed `path.join(__dirname, '*.template')` file references
+- Template XML is inlined as a string constant passed to `factoryForNode()`
+- Removed `var path = require('path')` (no longer needed)
+
+### `xml/encrypt.js` and `xml/sign.js`
+- Copied unchanged from the original package
+
+### `index.js`
+- Copied unchanged from the original package
+
+## Import Change
+
+In `lib/samlAssertion.ts`:
+```diff
+-import { Saml20 as saml } from 'saml'
++import { Saml20 as saml } from './saml/index.js'
+```
+
+## Dependencies
+
+The sub-dependencies used by this code remain as npm packages (not copied):
+- `@xmldom/xmldom`
+- `moment`
+- `xml-crypto`
+- `xml-encryption`
+- `valid-url`
+- `xml-name-validator`
+- `async`
+- `xpath`
+
+The `saml` entry in `package.json` must be kept — it provides the sub-dependencies (@xmldom/xmldom, moment, xml-crypto, etc.) that this local copy requires.

package/lib/saml/index.js

@@ -0,0 +1,2 @@
+exports.Saml11 = require('./saml11');
+exports.Saml20 = require('./saml20');