mitol-django-scim 2025.3.31__tar.gz

mitol_django_scim-2025.3.31/.gitignore

@@ -0,0 +1,73 @@
+# Temporary Python files
+*.pyc
+*.egg-info
+__pycache__
+.ipynb_checkpoints
+
+# Temporary OS files
+Icon*
+
+# Temporary virtual environment files
+.cache/
+*venv/
+
+# Temporary server files
+.env
+*.pid
+
+# Testing and coverage results
+.coverage
+.coverage.*
+coverage.*
+htmlcov/
+
+# Build and release directories
+build/
+dist/
+*.spec
+
+# Sublime Text
+*.sublime-workspace
+
+# Eclipse
+.settings
+
+# Pycharm/IDEA
+.idea/
+
+# OSX
+*.DS_Store
+
+# vscode
+.vscode/
+
+#pyenv
+.python-version
+
+# pytest
+.pytest_cache/
+
+# tox
+.tox
+coverage/
+
+# poetry
+pip-wheel-metadata/
+setup.py
+
+# django
+db.sqlite3
+testapp/settings/dev.py
+
+# mypy
+.mypy_cache/
+
+# Pants workspace files
+/.pants.d/
+/dist/
+/.pids
+/.pants.workdir.file_lock*
+*.pex
+
+# SSH keys/etc.
+ssh/*

mitol_django_scim-2025.3.31/CHANGELOG.md

@@ -0,0 +1,16 @@
+# Changelog
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project uses date-based versioning.
+
+<!-- scriv-insert-here -->
+
+<a id='changelog-2025.3.31'></a>
+## [2025.3.31] - 2025-03-31
+
+### Added
+
+- Add the mitol-django-scim app
+
+- Added a minimum version for pyparsing.

mitol_django_scim-2025.3.31/PKG-INFO

@@ -0,0 +1,51 @@
+Metadata-Version: 2.4
+Name: mitol-django-scim
+Version: 2025.3.31
+Summary: Django application for SCIM integrations
+License-Expression: BSD-3-Clause
+Requires-Python: >=3.10
+Requires-Dist: django-scim2>=0.19.1
+Requires-Dist: django-stubs>=1.13.1
+Requires-Dist: django>=3.0
+Requires-Dist: mitol-django-common
+Requires-Dist: pyparsing>=3.2
+Requires-Dist: strenum>=0.4.15
+Requires-Dist: strenum>=0.4.15; python_version < '3.11'
+Description-Content-Type: text/markdown
+
+## SCIM
+
+## Prerequisites
+
+- You need the following a local [Keycloak](https://www.keycloak.org/) instance running. Note which major version you are running (should be at least 26.x).
+  - You should have custom user profile fields setup on your `olapps` realm:
+    - `fullName`: required, otherwise defaults
+    - `emailOptIn`: defaults
+
+## Install the scim-for-keycloak plugin
+
+Sign up for an account on https://scim-for-keycloak.de and follow the instructions here: https://scim-for-keycloak.de/documentation/installation/install
+
+## Configure SCIM
+
+In the SCIM admin console, do the following:
+
+### Configure Remote SCIM Provider
+
+- In django-admin, go to OAuth Toolkit and create a new access token
+- Go to Remote SCIM Provider
+- Click the `+` button
+- Specify a base URL for your learn API backend: `http://<IP_OR_HOSTNAME>:8063/scim/v2/`
+- At the bottom of the page, click "Use default configuration"
+- Add a new authentication method:
+  - Type: Long Life Bearer Token
+  - Bearer Token: the access token you created above
+- On the Schemas tab, edit the User schema and add these custom attributes:
+  - Add a `fullName` attribute and set the Custom Attribute Name to `fullName`
+  - Add an attribute named `emailOptIn` with the following settings:
+    - Type: integer
+    - Custom Attribute Name: `emailOptIn`
+- On the Realm Assignments tab, assign to the `olapps` realm
+- Go to the Synchronization tab and perform one:
+  - Identifier attribute: email
+  - Synchronization strategy: Search and Bulk

mitol_django_scim-2025.3.31/README.md

@@ -0,0 +1,36 @@
+## SCIM
+
+## Prerequisites
+
+- You need the following a local [Keycloak](https://www.keycloak.org/) instance running. Note which major version you are running (should be at least 26.x).
+  - You should have custom user profile fields setup on your `olapps` realm:
+    - `fullName`: required, otherwise defaults
+    - `emailOptIn`: defaults
+
+## Install the scim-for-keycloak plugin
+
+Sign up for an account on https://scim-for-keycloak.de and follow the instructions here: https://scim-for-keycloak.de/documentation/installation/install
+
+## Configure SCIM
+
+In the SCIM admin console, do the following:
+
+### Configure Remote SCIM Provider
+
+- In django-admin, go to OAuth Toolkit and create a new access token
+- Go to Remote SCIM Provider
+- Click the `+` button
+- Specify a base URL for your learn API backend: `http://<IP_OR_HOSTNAME>:8063/scim/v2/`
+- At the bottom of the page, click "Use default configuration"
+- Add a new authentication method:
+  - Type: Long Life Bearer Token
+  - Bearer Token: the access token you created above
+- On the Schemas tab, edit the User schema and add these custom attributes:
+  - Add a `fullName` attribute and set the Custom Attribute Name to `fullName`
+  - Add an attribute named `emailOptIn` with the following settings:
+    - Type: integer
+    - Custom Attribute Name: `emailOptIn`
+- On the Realm Assignments tab, assign to the `olapps` realm
+- Go to the Synchronization tab and perform one:
+  - Identifier attribute: email
+  - Synchronization strategy: Search and Bulk

mitol_django_scim-2025.3.31/mitol/__init__.py

@@ -0,0 +1 @@
+__import__("pkg_resources").declare_namespace(__name__)

mitol_django_scim-2025.3.31/mitol/scim/README.md

@@ -0,0 +1,36 @@
+## SCIM
+
+## Prerequisites
+
+- You need the following a local [Keycloak](https://www.keycloak.org/) instance running. Note which major version you are running (should be at least 26.x).
+  - You should have custom user profile fields setup on your `olapps` realm:
+    - `fullName`: required, otherwise defaults
+    - `emailOptIn`: defaults
+
+## Install the scim-for-keycloak plugin
+
+Sign up for an account on https://scim-for-keycloak.de and follow the instructions here: https://scim-for-keycloak.de/documentation/installation/install
+
+## Configure SCIM
+
+In the SCIM admin console, do the following:
+
+### Configure Remote SCIM Provider
+
+- In django-admin, go to OAuth Toolkit and create a new access token
+- Go to Remote SCIM Provider
+- Click the `+` button
+- Specify a base URL for your learn API backend: `http://<IP_OR_HOSTNAME>:8063/scim/v2/`
+- At the bottom of the page, click "Use default configuration"
+- Add a new authentication method:
+  - Type: Long Life Bearer Token
+  - Bearer Token: the access token you created above
+- On the Schemas tab, edit the User schema and add these custom attributes:
+  - Add a `fullName` attribute and set the Custom Attribute Name to `fullName`
+  - Add an attribute named `emailOptIn` with the following settings:
+    - Type: integer
+    - Custom Attribute Name: `emailOptIn`
+- On the Realm Assignments tab, assign to the `olapps` realm
+- Go to the Synchronization tab and perform one:
+  - Identifier attribute: email
+  - Synchronization strategy: Search and Bulk

mitol_django_scim-2025.3.31/mitol/scim/__init__.py

@@ -0,0 +1,6 @@
+"""mitol.scim"""
+
+default_app_config = "mitol.scim.apps.ScimApp"
+
+__version__ = "2025.3.31"
+__distributionname__ = "mitol-django-scim"

mitol_django_scim-2025.3.31/mitol/scim/adapters.py

@@ -0,0 +1,263 @@
+import json
+import logging
+from typing import Optional, Union
+
+from django.contrib.auth import get_user_model
+from django.db import transaction
+from django_scim import constants
+from django_scim.adapters import SCIMUser
+from scim2_filter_parser.attr_paths import AttrPath
+
+User = get_user_model()
+
+
+logger = logging.getLogger(__name__)
+
+
+def get_user_model_for_scim():
+    """
+    Get function for the django_scim library configuration (USER_MODEL_GETTER).
+
+    Returns:
+        model: User model.
+    """
+    return User
+
+
+class UserAdapter(SCIMUser):
+    """
+    Custom adapter to extend django_scim library.
+    """
+
+    password_changed = False
+    activity_changed = False
+
+    resource_type = "User"
+
+    id_field = "scim_id"
+
+    ATTR_MAP = {
+        ("active", None, None): "is_active",
+        ("name", "givenName", None): "first_name",
+        ("name", "familyName", None): "last_name",
+        ("userName", None, None): "username",
+    }
+
+    IGNORED_PATHS = {
+        ("schemas", None, None),
+    }
+
+    @property
+    def is_new_user(self):
+        """
+
+        Returns:
+            bool: True is the user does not currently exist,
+            False if the user already exists.
+        """
+        return not bool(self.obj.id)
+
+    @property
+    def id(self):
+        """
+        Return the SCIM id
+        """
+        return self.obj.scim_id
+
+    @property
+    def emails(self):
+        """
+        Return the email of the user per the SCIM spec.
+        """
+        return [{"value": self.obj.email, "primary": True}]
+
+    @property
+    def display_name(self):
+        """
+        Return the displayName of the user per the SCIM spec.
+        """
+        return f"{self.obj.first_name} {self.obj.last_name}"
+
+    @property
+    def meta(self):
+        """
+        Return the meta object of the user per the SCIM spec.
+        """
+        return {
+            "resourceType": self.resource_type,
+            "created": self.obj.created_on.isoformat(timespec="milliseconds"),
+            "lastModified": self.obj.updated_on.isoformat(timespec="milliseconds"),
+            "location": self.location,
+        }
+
+    def to_dict(self):
+        """
+        Return a ``dict`` conforming to the SCIM User Schema,
+        ready for conversion to a JSON object.
+        """
+        return {
+            "id": self.id,
+            "externalId": self.obj.scim_external_id,
+            "schemas": [constants.SchemaURI.USER],
+            "userName": self.obj.username,
+            "name": {
+                "givenName": self.obj.first_name,
+                "familyName": self.obj.last_name,
+            },
+            "displayName": self.display_name,
+            "emails": self.emails,
+            "active": self.obj.is_active,
+            "groups": [],
+            "meta": self.meta,
+        }
+
+    def from_dict(self, d):
+        """
+        Consume a ``dict`` conforming to the SCIM User Schema, updating the
+        internal user object with data from the ``dict``.
+
+        Please note, the user object is not saved within this method. To
+        persist the changes made by this method, please call ``.save()`` on the
+        adapter. Eg::
+
+            scim_user.from_dict(d)
+            scim_user.save()
+        """
+        self.parse_emails(d.get("emails"))
+
+        self.obj.is_active = d.get("active", True)
+        self.obj.username = d.get("userName")
+        self.obj.first_name = d.get("name", {}).get("givenName", "")
+        self.obj.last_name = d.get("name", {}).get("familyName", "")
+        self.obj.scim_username = d.get("userName")
+        self.obj.scim_external_id = d.get("externalId")
+
+    def _save_user(self):
+        self.obj.save()
+
+    def _save_related(self):
+        pass
+
+    def save(self):
+        """
+        Save instances of the Profile and User models.
+        """
+        with transaction.atomic():
+            # user must be saved first due to FK Profile -> User
+            self._save_user()
+            self._save_related()
+            logger.info("User saved. User id %i", self.obj.id)
+
+    def delete(self):
+        """
+        Update User's is_active to False.
+        """
+        self.obj.is_active = False
+        self.obj.save()
+        logger.info("Deactivated user id %i", self.obj.id)
+
+    def handle_add(
+        self,
+        path: Optional[AttrPath],
+        value: Union[str, list, dict],
+        operation: dict,  # noqa: ARG002
+    ):
+        """
+        Handle add operations per:
+        https://tools.ietf.org/html/rfc7644#section-3.5.2.1
+
+        Args:
+            path (AttrPath)
+            value (Union[str, list, dict])
+        """
+        if path is None:
+            return
+
+        if path.first_path == ("externalId", None, None):
+            self.obj.scim_external_id = value
+            self.obj.save()
+
+    def parse_scim_for_keycloak_payload(self, payload: str) -> dict:
+        """
+        Parse the payload sent from scim-for-keycloak and normalize it
+        """
+        result = {}
+
+        for key, value in json.loads(payload).items():
+            if key == "schema":
+                continue
+
+            if isinstance(value, dict):
+                for nested_key, nested_value in value.items():
+                    result[self.split_path(f"{key}.{nested_key}")] = nested_value
+            else:
+                result[key] = value
+
+        return result
+
+    def parse_path_and_values(
+        self, path: Optional[str], value: Union[str, list, dict]
+    ) -> list:
+        """Parse the incoming value(s)"""
+        if isinstance(value, str):
+            # scim-for-keycloak sends this as a noncompliant JSON-encoded string
+            if path is None:
+                val = json.loads(value)
+            else:
+                msg = "Called with a non-null path and a str value"
+                raise ValueError(msg)
+        else:
+            val = value
+
+        results = []
+
+        for attr_path, attr_value in val.items():
+            if isinstance(attr_value, dict):
+                # nested object, we want to recursively flatten it to `first.second`
+                results.extend(self.parse_path_and_values(attr_path, attr_value))
+            else:
+                flattened_path = (
+                    f"{path}.{attr_path}" if path is not None else attr_path
+                )
+                new_path = self.split_path(flattened_path)
+                new_value = attr_value
+                results.append((new_path, new_value))
+
+        return results
+
+    def _handle_resplace_nested_path(self, nested_path, nested_value):
+        """Handle processing a nested path"""
+        if nested_path.first_path in self.ATTR_MAP:
+            setattr(self.obj, self.ATTR_MAP[nested_path.first_path], nested_value)
+        elif nested_path.first_path == ("emails", None, None):
+            self.parse_emails(nested_value)
+        else:
+            return False
+        return True
+
+    def handle_replace(
+        self,
+        path: Optional[AttrPath],
+        value: Union[str, list, dict],
+        operation: dict,  # noqa: ARG002
+    ):
+        """
+        Handle the replace operations.
+
+        All operations happen within an atomic transaction.
+        """
+
+        if not isinstance(value, dict):
+            # Restructure for use in loop below.
+            value = {path: value}
+
+        for nested_path, nested_value in (value or {}).items():
+            if (
+                not self._handle_resplace_nested_path(nested_path, nested_value)
+                and nested_path.first_path not in self.IGNORED_PATHS
+            ):
+                logger.debug(
+                    "Ignoring SCIM update for path: %s", nested_path.first_path
+                )
+
+        self.save()

mitol_django_scim-2025.3.31/mitol/scim/apps.py

@@ -0,0 +1,14 @@
+import os
+
+from django.apps import AppConfig
+
+
+class ScimApp(AppConfig):
+    name = "mitol.scim"
+    label = "scim"
+    verbose_name = "SCIM"
+
+    required_settings = []
+
+    # necessary because this is a namespaced app
+    path = os.path.dirname(os.path.abspath(__file__))  # noqa: PTH100, PTH120

mitol_django_scim-2025.3.31/mitol/scim/config.py

@@ -0,0 +1,13 @@
+from django_scim.models import SCIMServiceProviderConfig
+
+
+class LearnSCIMServiceProviderConfig(SCIMServiceProviderConfig):
+    """Custom provider config"""
+
+    def to_dict(self):
+        result = super().to_dict()
+
+        result["bulk"]["supported"] = True
+        result["filter"]["supported"] = True
+
+        return result

mitol_django_scim-2025.3.31/mitol/scim/constants.py

@@ -0,0 +1,16 @@
+"""SCIM constants"""
+
+
+class SchemaURI:
+    BULK_REQUEST = "urn:ietf:params:scim:api:messages:2.0:BulkRequest"
+
+    BULK_RESPONSE = "urn:ietf:params:scim:api:messages:2.0:BulkResponse"
+
+
+SORT_MAPPING = {
+    "id": "id",
+    "userName": "username",
+    "email": "email",
+}
+
+VALID_SORTS = SORT_MAPPING.keys()

mitol_django_scim-2025.3.31/mitol/scim/filters.py

@@ -0,0 +1,125 @@
+import operator
+from collections.abc import Callable
+from typing import Optional
+
+from django.contrib.auth import get_user_model
+from django.db.models import Model, Q
+from pyparsing import ParseResults
+
+from mitol.scim.parser import Filters, TermType
+
+
+class FilterQuery:
+    """Filters for users"""
+
+    model_cls: type[Model]
+
+    attr_map: dict[tuple[str, Optional[str]], tuple[str, ...]]
+
+    related_selects: list[str] = []
+
+    dj_op_mapping = {
+        "eq": "exact",
+        "ne": "exact",
+        "gt": "gt",
+        "ge": "gte",
+        "lt": "lt",
+        "le": "lte",
+        "pr": "isnull",
+        "co": "contains",
+        "sw": "startswith",
+        "ew": "endswith",
+    }
+
+    dj_negated_ops = ("ne", "pr")
+
+    @classmethod
+    def _filter_expr(cls, parsed: ParseResults) -> Q:
+        if parsed is None:
+            msg = "Expected a filter, got: None"
+            raise ValueError(msg)
+
+        if parsed.term_type == TermType.attr_expr:
+            return cls._attr_expr(parsed)
+
+        msg = f"Unsupported term type: {parsed.term_type}"
+        raise ValueError(msg)
+
+    @classmethod
+    def _attr_expr(cls, parsed: ParseResults) -> Q:
+        dj_op = cls.dj_op_mapping[parsed.comparison_operator.lower()]
+
+        scim_keys = (parsed.attr_name, parsed.sub_attr)
+
+        path_parts = list(
+            filter(
+                lambda part: part is not None,
+                (
+                    *cls.attr_map.get(scim_keys, scim_keys),
+                    dj_op,
+                ),
+            )
+        )
+        path = "__".join(path_parts)
+
+        q = Q(**{path: parsed.value})
+
+        if parsed.comparison_operator in cls.dj_negated_ops:
+            q = ~q
+
+        return q
+
+    @classmethod
+    def _filters(cls, parsed: ParseResults) -> Q:
+        parsed_iter = iter(parsed)
+        q = cls._filter_expr(next(parsed_iter))
+
+        try:
+            while operator := cls._logical_op(next(parsed_iter)):
+                filter_q = cls._filter_expr(next(parsed_iter))
+
+                # combine the previous and next Q() objects using the bitwise operator
+                q = operator(q, filter_q)
+        except StopIteration:
+            pass
+
+        return q
+
+    @classmethod
+    def _logical_op(cls, parsed: ParseResults) -> Callable[[Q, Q], Q] | None:
+        """Convert a defined operator to the corresponding bitwise operator"""
+        if parsed is None:
+            return None
+
+        if parsed.logical_operator.lower() == "and":
+            return operator.and_
+        elif parsed.logical_operator.lower() == "or":
+            return operator.or_
+        else:
+            msg = f"Unexpected operator: {parsed.operator}"
+            raise ValueError(msg)
+
+    @classmethod
+    def search(cls, filter_query, request=None):  # noqa: ARG003
+        """Create a search query"""
+        parsed = Filters.parse_string(filter_query, parse_all=True)
+
+        return cls.model_cls.objects.select_related(*cls.related_selects).filter(
+            cls._filters(parsed)
+        )
+
+
+class UserFilterQuery(FilterQuery):
+    """FilterQuery for User"""
+
+    attr_map: dict[tuple[str, Optional[str]], tuple[str, ...]] = {
+        ("userName", None): ("username",),
+        ("emails", "value"): ("email",),
+        ("active", None): ("is_active",),
+        ("name", "givenName"): ("first_name",),
+        ("name", "familyName"): ("last_name",),
+    }
+
+    related_selects = []
+
+    model_cls = get_user_model()

mitol_django_scim-2025.3.31/mitol/scim/parser.py

@@ -0,0 +1,194 @@
+"""
+SCIM filter parsers
+    + _tag_term_type(TermType.attr_name)
+
+This module aims to compliantly parse SCIM filter queries per the spec:
+https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2
+
+Note that this implementation defines things slightly differently
+because a naive implementation exactly matching the filter grammar will
+result in hitting Python's recursion limit because the grammar defines
+logical lists (AND/OR chains) as a recursive relationship.
+
+This implementation avoids that by defining separately FilterExpr and
+Filter. As a result of this, some definitions are collapsed and removed
+(e.g. valFilter => FilterExpr).
+"""
+
+from enum import auto
+
+try:
+    from enum import StrEnum
+except ImportError:
+    from strenum import StrEnum
+
+from pyparsing import (
+    CaselessKeyword,
+    Char,
+    Combine,
+    DelimitedList,
+    FollowedBy,
+    Forward,
+    Group,
+    Literal,
+    Suppress,
+    Tag,
+    alphanums,
+    alphas,
+    common,
+    dbl_quoted_string,
+    nested_expr,
+    one_of,
+    remove_quotes,
+    ungroup,
+)
+
+
+class TagName(StrEnum):
+    """Tag names"""
+
+    term_type = auto()
+    value_type = auto()
+
+
+class TermType(StrEnum):
+    """Tag term type"""
+
+    urn = auto()
+    attr_name = auto()
+    attr_path = auto()
+    attr_expr = auto()
+    value_path = auto()
+    presence = auto()
+
+    logical_op = auto()
+    compare_op = auto()
+    negation_op = auto()
+
+    filter_expr = auto()
+    filters = auto()
+
+
+class ValueType(StrEnum):
+    """Tag value_type"""
+
+    boolean = auto()
+    number = auto()
+    string = auto()
+    null = auto()
+
+
+def _tag_term_type(term_type: TermType) -> Tag:
+    return Tag(TagName.term_type.name, term_type)
+
+
+def _tag_value_type(value_type: ValueType) -> Tag:
+    return Tag(TagName.value_type.name, value_type)
+
+
+NameChar = Char(alphanums + "_-")
+AttrName = Combine(
+    Char(alphas)
+    + NameChar[...]
+    # ensure we're not somehow parsing an URN
+    + ~FollowedBy(":")
+).set_results_name("attr_name") + _tag_term_type(TermType.attr_name)
+
+# Example URN-qualifed attr:
+# urn:ietf:params:scim:schemas:core:2.0:User:userName
+# |--------------- URN --------------------|:| attr |
+UrnAttr = Combine(
+    Combine(
+        Literal("urn:")
+        + DelimitedList(
+            # characters ONLY if followed by colon
+            Char(alphanums + ".-_")[1, ...] + FollowedBy(":"),
+            # separator
+            Literal(":"),
+            # combine everything back into a singular token
+            combine=True,
+        )[1, ...]
+    ).set_results_name("urn")
+    # separator between URN and attribute name
+    + Literal(":")
+    + AttrName
+    + _tag_term_type(TermType.urn)
+)
+
+
+SubAttr = ungroup(Combine(Suppress(".") + AttrName)).set_results_name("sub_attr") ^ (
+    Tag("sub_attr", None)
+)
+
+AttrPath = (
+    (
+        # match on UrnAttr first
+        UrnAttr ^ AttrName
+    )
+    + SubAttr
+    + _tag_term_type(TermType.attr_path)
+)
+
+ComparisonOperator = one_of(
+    ["eq", "ne", "co", "sw", "ew", "gt", "lt", "ge", "le"],
+    caseless=True,
+    as_keyword=True,
+).set_results_name("comparison_operator") + _tag_term_type(TermType.compare_op)
+
+LogicalOperator = Group(
+    one_of(["or", "and"], caseless=True).set_results_name("logical_operator")
+    + _tag_term_type(TermType.logical_op)
+)
+
+NegationOperator = Group(
+    (
+        CaselessKeyword("not")
+        + _tag_term_type(TermType.negation_op)
+        + Tag("negated", True)  # noqa: FBT003
+    )[..., 1]
+    ^ Tag("negated", False)  # noqa: FBT003
+)
+
+ValueTrue = Literal("true").set_parse_action(lambda: True) + _tag_value_type(
+    ValueType.boolean
+)
+ValueFalse = Literal("false").set_parse_action(lambda: False) + _tag_value_type(
+    ValueType.boolean
+)
+ValueNull = Literal("null").set_parse_action(lambda: None) + _tag_value_type(
+    ValueType.null
+)
+ValueNumber = (common.integer | common.fnumber) + _tag_value_type(ValueType.number)
+ValueString = dbl_quoted_string.set_parse_action(remove_quotes) + _tag_value_type(
+    ValueType.string
+)
+
+ComparisonValue = ungroup(
+    ValueTrue | ValueFalse | ValueNull | ValueNumber | ValueString
+).set_results_name("value")
+
+AttrPresence = Group(
+    AttrPath + Literal("pr").set_results_name("presence").set_parse_action(lambda: True)
+) + _tag_term_type(TermType.presence)
+AttrExpression = AttrPresence | Group(
+    AttrPath + ComparisonOperator + ComparisonValue + _tag_term_type(TermType.attr_expr)
+)
+
+# these are forward references, so that we can have
+# parsers circularly reference themselves
+FilterExpr = Forward()
+Filters = Forward()
+
+ValuePath = Group(AttrPath + nested_expr("[", "]", Filters)).set_results_name(
+    "value_path"
+) + _tag_term_type(TermType.value_path)
+
+FilterExpr <<= (
+    AttrExpression | ValuePath | (NegationOperator + nested_expr("(", ")", Filters))
+) + _tag_term_type(TermType.filter_expr)
+
+Filters <<= (
+    # comment to force it to wrap the below for operator precedence
+    (FilterExpr + (LogicalOperator + FilterExpr)[...])
+    + _tag_term_type(TermType.filters)
+)

mitol_django_scim-2025.3.31/mitol/scim/settings/scim.py

@@ -0,0 +1,20 @@
+SCIM_SERVICE_PROVIDER = {
+    "SCHEME": "https",
+    # use default value,
+    # this will be overridden by value returned by BASE_LOCATION_GETTER
+    "NETLOC": "localhost",
+    "AUTHENTICATION_SCHEMES": [
+        {
+            "type": "oauth2",
+            "name": "OAuth 2",
+            "description": "Oauth 2 implemented with bearer token",
+            "specUri": "",
+            "documentationUri": "",
+        },
+    ],
+    "SERVICE_PROVIDER_CONFIG_MODEL": "mitol.scim.config.LearnSCIMServiceProviderConfig",
+    "USER_ADAPTER": "mitol.scim.adapters.UserAdapter",
+    "USER_MODEL_GETTER": "mitol.scim.adapters.get_user_model_for_scim",
+    "USER_FILTER_PARSER": "mitol.scim.filters.UserFilterQuery",
+    "GET_IS_AUTHENTICATED_PREDICATE": "mitol.scim.utils.is_authenticated_predicate",
+}

mitol_django_scim-2025.3.31/mitol/scim/urls.py

@@ -0,0 +1,18 @@
+"""URL configurations for SCIM"""
+
+from django.urls import include, re_path
+
+from mitol.scim import views
+
+ol_scim_urls = (
+    [
+        re_path(r"^Bulk$", views.BulkView.as_view(), name="bulk"),
+        re_path(r"^Users/\.search$", views.SearchView.as_view(), name="users-search"),
+    ],
+    "ol-scim",
+)
+
+urlpatterns = [
+    re_path(r"^scim/v2/", include(ol_scim_urls)),
+    re_path(r"^scim/v2/", include("django_scim.urls", namespace="scim")),
+]

mitol_django_scim-2025.3.31/mitol/scim/utils.py

@@ -0,0 +1,6 @@
+"""Utils"""
+
+
+def is_authenticated_predicate(user):
+    """Verify that the user is active and staff"""
+    return user.is_authenticated and user.is_active and user.is_staff

mitol_django_scim-2025.3.31/mitol/scim/views.py

@@ -0,0 +1,214 @@
+"""SCIM view customizations"""
+
+import copy
+import json
+import logging
+from http import HTTPStatus
+from urllib.parse import urljoin, urlparse
+
+from django.http import HttpRequest, HttpResponse
+from django.urls import Resolver404, resolve, reverse
+from django_scim import constants as djs_constants
+from django_scim import exceptions
+from django_scim import views as djs_views
+from django_scim.utils import get_base_scim_location_getter
+
+from mitol.scim import constants
+
+log = logging.getLogger()
+
+
+class InMemoryHttpRequest(HttpRequest):
+    """
+    A spoofed HttpRequest that only exists in-memory.
+    It does not implement all features of HttpRequest and is only used
+    for the bulk SCIM operations here so we can reuse view implementations.
+    """
+
+    def __init__(self, request, path, method, body):
+        super().__init__()
+
+        self.META = copy.deepcopy(
+            {
+                key: value
+                for key, value in request.META.items()
+                if not key.startswith(("wsgi", "uwsgi"))
+            }
+        )
+        self.path = path
+        self.method = method
+        self.content_type = djs_constants.SCIM_CONTENT_TYPE
+
+        # normally HttpRequest would read this in, but we already have the value
+        self._body = body
+
+
+class BulkView(djs_views.SCIMView):
+    http_method_names = ["post"]
+
+    def post(self, request, *args, **kwargs):  # noqa: ARG002
+        body = self.load_body(request.body)
+
+        if body.get("schemas") != [constants.SchemaURI.BULK_REQUEST]:
+            msg = "Invalid schema uri. Must be SearchRequest."
+            raise exceptions.BadRequestError(msg)
+
+        fail_on_errors = body.get("failOnErrors", None)
+
+        if fail_on_errors is not None and isinstance(int, fail_on_errors):
+            msg = "Invalid failOnErrors. Must be an integer."
+            raise exceptions.BaseRequestError(msg)
+
+        operations = body.get("Operations")
+
+        results = self._attempt_operations(request, operations, fail_on_errors)
+
+        response = {
+            "schemas": [constants.SchemaURI.BULK_RESPONSE],
+            "Operations": results,
+        }
+
+        content = json.dumps(response)
+
+        return HttpResponse(
+            content=content,
+            content_type=djs_constants.SCIM_CONTENT_TYPE,
+            status=HTTPStatus.OK,
+        )
+
+    def _attempt_operations(self, request, operations, fail_on_errors):
+        """Attempt to run the operations that were passed"""
+        responses = []
+        num_errors = 0
+
+        for operation in operations:
+            # per-spec,if we've hit the error threshold stop processing and return
+            if fail_on_errors is not None and num_errors >= fail_on_errors:
+                break
+
+            op_response = self._attempt_operation(request, operation)
+
+            # if the operation returned a non-2xx status code, record it as a failure
+            if int(op_response.get("status")) >= HTTPStatus.MULTIPLE_CHOICES:
+                num_errors += 1
+
+            responses.append(op_response)
+
+        return responses
+
+    def _attempt_operation(self, bulk_request, operation):
+        """Attempt an operation as part of a bulk request"""
+
+        method = operation.get("method")
+        bulk_id = operation.get("bulkId")
+        path = operation.get("path")
+        data = operation.get("data")
+
+        try:
+            url_match = resolve(path, urlconf="django_scim.urls")
+        except Resolver404:
+            return self._operation_error(
+                bulk_id,
+                HTTPStatus.NOT_IMPLEMENTED,
+                "Endpoint is not supported for /Bulk",
+            )
+
+        # this is an ephemeral request not tied to the real request directly
+        op_request = InMemoryHttpRequest(
+            bulk_request, path, method, json.dumps(data).encode(djs_constants.ENCODING)
+        )
+
+        op_response = url_match.func(op_request, *url_match.args, **url_match.kwargs)
+        result = {
+            "method": method,
+            "bulkId": bulk_id,
+            "status": str(op_response.status_code),
+        }
+
+        location = None
+
+        if op_response.status_code >= HTTPStatus.BAD_REQUEST and op_response.content:
+            result["response"] = json.loads(op_response.content.decode("utf-8"))
+
+        location = op_response.headers.get("Location", None)
+
+        if location is not None:
+            result["location"] = location
+            # this is a custom field that the scim-for-keycloak plugin requires
+            try:
+                path = urlparse(location).path
+                location_match = resolve(path)
+                # this URL will be something like /scim/v2/Users/12345
+                # resolving it gives the uuid
+                result["id"] = location_match.kwargs["uuid"]
+            except Resolver404:
+                log.exception("Unable to resolve resource url: %s", location)
+
+        return result
+
+    def _operation_error(self, method, bulk_id, status_code, detail):
+        """Return a failure response"""
+        status_code = str(status_code)
+        return {
+            "method": method,
+            "status": status_code,
+            "bulkId": bulk_id,
+            "response": {
+                "schemas": [djs_constants.SchemaURI.ERROR],
+                "status": status_code,
+                "detail": detail,
+            },
+        }
+
+
+class SearchView(djs_views.UserSearchView):
+    """
+    View for /.search endpoint
+    """
+
+    def post(self, request, *args, **kwargs):  # noqa: ARG002
+        body = self.load_body(request.body)
+        if body.get("schemas") != [djs_constants.SchemaURI.SERACH_REQUEST]:
+            msg = "Invalid schema uri. Must be SearchRequest."
+            raise exceptions.BadRequestError(msg)
+
+        # cast to ints because scim-for-keycloak sends strings
+        start = int(body.get("startIndex", 1))
+        count = int(body.get("count", 50))
+        sort_by = body.get("sortBy", "id")
+        sort_order = body.get("sortOrder", "ascending")
+        query = body.get("filter", None)
+
+        if sort_by not in constants.VALID_SORTS:
+            msg = f"Sorting only supports: {', '.join(constants.VALID_SORTS)}"
+            raise exceptions.BadRequestError(msg)
+        else:
+            sort_by = constants.SORT_MAPPING[sort_by]
+
+        if sort_order not in ("ascending", "descending"):
+            msg = "Sorting only supports ascending or descending"
+            raise exceptions.BadRequestError(msg)
+
+        if not query:
+            msg = "No filter query specified"
+            raise exceptions.BadRequestError(msg)
+
+        try:
+            qs = self.__class__.parser_getter().search(query, request)
+        except ValueError as e:
+            msg = "Invalid filter/search query: " + str(e)
+            raise exceptions.BadRequestError(msg) from e
+
+        qs = qs.order_by(sort_by)
+
+        if sort_order == "descending":
+            qs = qs.reverse()
+
+        response = self._build_response(request, qs, start, count)
+
+        path = reverse(self.scim_adapter.url_name)
+        url = urljoin(get_base_scim_location_getter()(request=request), path).rstrip(
+            "/"
+        )
+        response["Location"] = url + "/.search"
+        return response

mitol_django_scim-2025.3.31/pyproject.toml

@@ -0,0 +1,41 @@
+[project]
+name = "mitol-django-scim"
+version = "2025.3.31"
+description = "Django application for SCIM integrations"
+dependencies = [
+  "django-stubs>=1.13.1",
+  "django>=3.0",
+  "django_scim2>=0.19.1",
+  "mitol-django-common",
+  "pyparsing>=3.2",
+  # Remove this why py310 support is dropped
+  "StrEnum>=0.4.15 ; python_version < '3.11'",
+  "strenum>=0.4.15",
+]
+readme = "README.md"
+license = "BSD-3-Clause"
+requires-python = ">=3.10"
+
+[tool.bumpver]
+current_version = "2025.3.31"
+version_pattern = "YYYY.MM.DD[.INC0]"
+
+[tool.bumpver.file_patterns]
+"pyproject.toml" = [
+    'version = "{version}"',
+]
+"mitol/scim/__init__.py" = [
+    '__version__ = "{version}"',
+]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.sdist]
+include = ["CHANGELOG.md", "README.md", "py.typed", "**/*.py"]
+exclude = ["BUILD", "pyproject.toml"]
+
+[tool.hatch.build.targets.wheel]
+include = ["CHANGELOG.md", "README.md", "py.typed", "**/*.py"]
+exclude = ["BUILD", "pyproject.toml"]