harrykodden/scim-server

By harrykodden

•Updated over 3 years ago

This image offers a fully functional SCIM Server.

Image

184

Overview Tags

harrykodden/scim-server repository overview

Docker Pulls

⁠SCIM-Server

This image offers a SCIM Server. The data provisioned to this SCIM Server will be stored in both a database backend as well as a LDAP Server. The database backend is used for storing all attributes that match with the SCIM Schema's configured for both the User and de Group resources.

In the LDAP backend a subset of the attributes will be stored. The LDAP may then be used as an identity source for your authentication and authorization needs.

The effective schemas used by this SCIM Server may be adjusted. You can do that by overwriting the /schemas/user.json or /schemas/group.json with a file that suits your needs. Of course you should comply with the SCIM Core 2.0 syntax. refer https://www.rfc-editor.org/rfc/rfc7643.html⁠

⁠How to use?

Starting the SCIM Server:

docker run --rm \
    -e SERVER_URL="http://localhost" \
    -e BASE_PATH=/api/v2 \
    -e API_TOKEN=123456789 \
    -e DATABASE_URL="postgresql://username:password@localhost:5432/database "\
    -e LDAP_HOST=localhost \
    -e LDAP_BASE="ou=scim,dc=example,dc=org" \
    -e LDAP_BIND="cn=admin,dc=example,dc=org" \
    -e LDAP_HOST=secret \
    -p 80:80 \
    harrykodden/scim-server

⁠Environment variables

This image uses environment variables for configuration.

Available variables	Description	Example
`SERVER_URL`	The FQDN of this SCIM server	http://localhost⁠
`BASE_PATH`	Uri prefix of API endpoints	/api/v2
`API_TOKEN`	The Bearer token that allows access to the API endpoints	123456789
`DATABASE_URL`	The full database URL to connect with	postgresql://username:password@localhost:5432/database
`LDAP_HOST`	the hostname of the ldap server	localhost
`LDAP_BASE`	base dn	ou=scim,dc=example,dc=org
`LDAP_BIND`	bind username	cn=admin,dc=example,dc=org
`LDAP_PASS`	bind password	secret
`CONFIG_PATH`	file system directory where Schemas and ResourceTypes subdirectories are located	defaults to /app/config

⁠API Endpoints

The following endpoints are offered by the SCIM Server

Endpoint	Description
`/api/v2/swagger.json`	API details
`/api/v2/doc`	Swagger API DOC
`/api/v2/Health`	Health information
`/api/v2/ServiceProviderConfig`	Capabilities of this SCIM Server
`/api/v2/ResourceTypes`	List the resource types: User plus Group
`/api/v2/ResourceTypes/<id>`	List/Update User or Group resource type
`/api/v2/Schemas`	List/Store the configured Schemas
`/api/v2/Schemas/<id>`	List a specific the configured Schemas
`/api/v2/Users`	List/Create Users
`/api/v2/Users/<id>`	List/Update/Delete a specific user
`/api/v2/Groups`	List/Create Groups
`/api/v2/Groups/<id>`	List/Update/Delete a specific group

⁠Swagger

This application offers a Swagger API User Interface so that you can make yourself comfortable with the API endpoints. When the application is launched, visit:

<SERVER_URL>/<BASE_PATH>/doc

so for example:

http://localhost/api/v2/doc

⁠LDAP

The Receive SCIM data willl be immediately pushed to the configured LDAP backend. The mapping between SCIM attributes and LDAP attributes follows a mapping translation. The standard mapping translation is:

{
  "User": {
    "userName": "inetOrgPerson.uid",
    "displayName": "inetOrgPerson.displayName",
    "name": {
      "familyName": "inetOrgPerson.sn",
      "givenName": "inetOrgPerson.givenName"
    },
    "x509Certificates": {
      "value": "[ldapPublicKey.sshPublicKey]"
    },
    "emails": {
      "value": "[inetOrgPerson.mail]"
    },
    "active": "voPerson.voPersonStatus",
    "urn:mace:surf.nl:sram:scim:extension:User": {
      "eduPersonScopedAffiliation": "[eduPerson.eduPersonScopedAffiliation]",
      "eduPersonUniqueId": "eduPerson.eduPersonUniqueId",
      "voPersonExternalAffiliation": "voPerson.voPersonExternalAffiliation",
      "voPersonExternalId": "voPerson.voPersonExternalID"
    }
  },
  "Group": {
    "displayName": "extensibleObject.displayName",
    "urn:mace:surf.nl:sram:scim:extension:Group": {
      "description": "groupOfMembers.description",
      "urn": "extensibleObject.uniqueidentifier",
      "labels": "[groupOfMembers.businessCategory]"
    }
  }
}

The keys identity the SCIM attributes according to the provided hierarchy. The LDAP attributes are qualified with the objectclass name. (Off course the used objectclasses are to be available and configured on the LDAP backend in advance) The LDAP attributes in brackets '[' .. ']' are specifying a multi-valued LDAP attribute.

⁠SCIM Record Types

The preloaded Record for User and Group make use of a SRAM scheme extension.

⁠User

{
  "description": "Defined resource types for the User schema",
  "endpoint": "/Users",
  "id": "User",
  "meta": {
    "location": "/ResourceTypes/User",
    "resourceType": "ResourceType"
  },
  "name": "User",
  "schema": "urn:ietf:params:scim:schemas:core:2.0:User",
  "schemaExtensions": [
    {
      "required": false,
      "schema": "urn:mace:surf.nl:sram:scim:extension:User"
    }
  ],
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:ResourceType"]
}

⁠Group

{
  "description": "Defined resource types for the Group schema",
  "endpoint": "/Groups",
  "id": "Group",
  "meta": {
    "location": "/ResourceTypes/Group",
    "resourceType": "ResourceType"
  },
  "name": "Group",
  "schema": "urn:ietf:params:scim:schemas:core:2.0:Group",
  "schemaExtensions": [
    {
      "required": false,
      "schema": "urn:mace:surf.nl:sram:scim:extension:Group"
    }
  ],
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:ResourceType"]
}

⁠SCIM Schemes

The referenced schemes in the Record Types are available in th config/Schemes folder

Tag summary

Recent tags

Content type

Image

Digest

sha256:5e83d73d4…

Size

51.8 MB

Last updated

over 3 years ago

docker pull harrykodden/scim-server