Discovery:

GET http://localhost:8880/ServiceProviderConfigs
Specification compliance, authentication schemes, data models.

GET http://localhost:8880/Schemas
Introspect resources and attribute extensions.

Note:

- userName (mandatory) = UserID
- id (mandatory) = Unique id. Could be set to the same as UserID but don't have to.

SAP Hana endpoint

Get all users (explore):
select USER_NAME from SYS.USERS where IS_SAML_ENABLED like 'TRUE';

Get a specific user:
select USER_NAME, USER_DEACTIVATED from SYS.USERS where USER_NAME like '';

Create User:
CREATE USER WITH IDENTITY '' FOR SAML PROVIDER ;

Delete user:
DROP USER ;

Modify user (enable user):
ALTER USER ACTIVATE;

Modify user (disable user):
ALTER USER DEACTIVATE;

Postinstallation:

cd c:\my-scimgateway
npm install hdb --save

Only SAML users will be explored and managed

Supported template attributes:

- User Name (UserID)
- Suspended (Enabled/Disabled)

Currently no other attributes needed. Trying to update other attributes will then give an error message. The SCIM Provisioning template should therefore not include any other global user attribute references.

SAP Hana converts UserID to uppercase. Provisioning use default lowercase. Provisioning template should therefore also convert to uppercase.

User Name = %$$TOUPPER(%AC%)%

Azure Active Directory endpoint

For testing purposes we could get an Azure free account and in addition the free Office 365 for testing license management through Azure.

There are two alternative ways of configuring Azure AD. Alternative #1 is probably best and easiest

$3

- Logon to Azure as global administrator
- Azure Active Directory - App registrations
- Click "New registration"
- Name = SCIM Gateway Inbound
- Select: Accounts in this organizational directory only
- Click "Register"
- Overview:
- Copy "Application (client) ID"
- Copy "Directory (tentant) ID"
- Certificates & secrets:
- Click "New client secret"
- Description = SCIM Gateway Inbound secret#1
- Select an appropriate "Expires"
- Click "Add"
- Copy "Value" of the new secret that was created
- API permissions: - Add a permission - Microsoft Graph - Application permissions
- Optionally remove any defaults included e.g. User.Read
- Click "Add a permission"
- Microsoft Graph
- Application permissions
- Directory - Directory.ReadWriteAll
- Organization - Organization.ReadWrite.All
- Click "Add permissions"
Note, we also have to go to Enterprise application to grant these consents
- Azure Active Directory - Enterprise applications - SCIM Gateway Inbound
- Permissions:
- Click "Grant admin consent for [tenant name]"
- In the logon dialog, logon as global administrator
- In permissions request dialog, click "Accept"
- Click "Refresh", directory and organization permissions are now listed and OK

For some odd reasons Application needs to be member of "User administrator" for having privileges to manage office/mobile phone on users that is member of any administrator roles

Also note, enable/disable user (accountEnabled - through Graph API) will fail if user have an "Administrator" role other than above mentioned "User Administrator" e.g. "Group Administrator"/"Application Administrator". To be sure we can enable/disable all users, application needs to be member of "Global administrator" - 62e90394-69f5-4237-9190-012177145e10.

- Azure Active Directory - Roles and administration
- Click on role "User administrator"
- Click "Add assignments"
- Search: SCIM Gateway Inbound (application name)
- Select the application that shows up and click "Add"

$3

Edit index.js
Uncomment startup of plugin-azure-ad, other plugins could be comment out if not needed

const azureAD = require('./lib/plugin-azure-ad')

Edit plugin-azure-ad.json

Note, for Symantec/Broadcom/CA Provisioning we have to use SCIM version 1.1

scimgateway: {
"scim": {
"version": "1.1"
},

username and password used to connect the SCIM Gateway must be defined.

"auth": {
"basic": [
{
"username": "gwadmin",
"password": "password",
"readOnly": false
}
],

Update tenantIdGUID, clientID and clientSecret according to what you copied from the previous Azure AD configuration.

If using proxy, set proxy.host to "http://:" e.g "http://proxy.mycompany.com:3128"

"endpoint": {
"entity": {
"undefined": {
"tenantIdGUID": "DomainName or DirectoryID (GUID)",
"clientId": "Application ID",
"clientSecret": "Generated application key value",
"proxy": {
"host": null,
"username": null,
"password": null
}
}
}
}

Note, clientSecret and any proxy.password will become encrypted in this file on the first Azure connection.

For multi-tenant or multi-endpoint support, we may add several entities:

"endpoint": {
"entity": {
"undefined": {
...
},
"clientA": {
...
},
"clientB": {
...
}
}
}

For additional details, see baseEntity description.

Note, we should normally use certificate (https) for communicating with SCIM Gateway unless we install gateway locally on the manager (e.g. on the CA Connector Server). When installed on the manager, we could use http://localhost:port or http://127.0.0.1:port which will not be passed down to the data link layer for transmission. We could then also set {"localhostonly": true}

$3

- Start SCIM Gateway
- "const azureAD" must be uncomment in index.js
- username, password and port defined in plugin-azure-ad.json must also be known
- Start ConnectorXpress
- Setup Data Sources
- Add
- Layer7 (this is SCIM)
- Name = SCIM Gateway-8881
- Base URL = http://localhost:8881 (SCIM Gateway installed locally on Connector Server)
- Add the new "Azure - ScimGateway" endpoint type
- Metadata - Import - "my-scimgateway\node_modules\scimgateway\config\resources\Azure - ScimGateway.xml"
- Select the datasource we created - SCIM Gateway-8881
- Enter password for the user defined in datasource (e.g. gwadmin/password)
- On the right - expand Provisioning Servers - your server - and logon
- Right Click "Endpoint Types", Create New Endpoint Type
- You may use default name "Azure - ScimGateway" and click "OK" to create endpoint

Note, metafile "Azure - ScimGateway.xml" is based on CA "Azure - WSL7" with some minor adjustments like using Microsoft Graph API attributes instead of Azure AD Graph attributes.

Provisioning Manager configuration

Endpoint type = Azure - ScimGateway (DYN Endpoint)

Endpoint configuration example:

Endpoint Name = AzureAD-8881
User Name = gwadmin
Password = password
SCIM Authentication Method = HTTP Basic Authentication
SCIM Based URL = http://localhost:8881
or
SCIM Based URL = http://localhost:8881/

For details, please see section "CA Identity Manager as IdP using SCIM Gateway"

Azure Active Directory as IdP using SCIM Gateway

Azure AD could do automatic user provisioning by synchronizing users towards SCIM Gateway, and gateway plugins will update endpoints.

Plugin configuration file must include SCIM Version "2.0" (scimgateway.scim.version) and either Bearer Token (scimgateway.auth.bearerToken[x].token) or Azure Tenant ID GUID (scimgateway.auth.bearerJwtAzure[x].tenantIdGUID) or both:

scimgateway: {
"scim": {
"version": "2.0",
...
},
...
"auth": {
"bearerToken": [
{
"token": "shared-secret"
}
],
"bearerJwtAzure": [
{
"tenantIdGUID": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
}
]
}
...
}

token configuration must correspond with "Secret Token" defined in Azure AD
tenantIdGUID configuration must correspond with Azure Active Directory Tenant ID

In Azure Portal:
Azure-Azure Active Directory-Enterprise Application--Provisioning-Secret Token
Note, when "Secret Token" is left blank, Azure will use JWT (tenantIdGUID)

Azure-Azure Active Directory-Overview-Tenant ID

User mappings attributes between AD and SCIM also needs to be configured

Azure-Azure Active Directory-Enterprise Application--Provisioning-Edit attribute mappings-Mappings

Azure AD default SCIM attribute mapping for USER must have:

userPrincipalName mapped to userName (matching precedence #1)

Azure AD default SCIM attribute mapping for GROUP must have:

displayName mapped to displayName (matching precedence #1)
members mapped to members

Some notes related to Azure AD:

- Azure Active Directory SCIM documentation

- For using OAuth/JWT credentials, Azure configuration "Secret Token" (bearer token) should be blank. Plugin configuration must then include bearerJwtAzure.tenantIdGUID. Click "Test Connection" in Azure to verify

- Azure AD do a regular check for a "none" existing user/group. This check seems to be a "keep alive" to verify connection.

- Azure AD first checks if user/group exists, if not exist they will be created (no explore of all users like CA Identity Manager)

- Deleting a user in Azure AD sends a modify user {"active":"False"} which means user should be disabled. This logic is default set in attribute mappings expression rule Switch([IsSoftDeleted], , "False", "True", "True", "False"). Standard SCIM "DELETE" method seems not to be used.

API Gateway

Gateway also works as an API Gateway when using url /api or //api

Following methods for the none SCIM based api-plugin are supported:

GET /api
GET /api?queries
GET /api/{id}
POST /api + body
PUT /api/{id} + body
PATCH /api/{id} + body
DELETE /api/{id}

Please see example plugin: plugin-api.js

How to build your own plugins

Preparation:

* Copy "best matching" example plugin e.g. lib\plugin-loki.js and config\plugin-loki.json and rename both copies to your plugin name prefix e.g. plugin-mine.js and plugin-mine.json (for SOAP Webservice endpoint we might use plugin-forwardinc as a template)
* Edit plugin-mine.json and define a unique port number for the gateway setting
* Edit index.js and add a new line for starting your plugin e.g. let mine = require('./lib/plugin-mine');
* Start SCIM Gateway and verify. If using CA Provisioning you could setup a SCIM endpoint using the port number you defined

Now we are ready for custom coding by editing plugin-mine.js
Coding should be done step by step and each step should be verified and tested before starting the next (they are all highlighted by comments in existing code).

1. Turn off group functionality in getGroup, getGroupMembers, getGroupUsers and modifyGroupMembers
Please see callback definitions in plugin-saphana that do not use groups.
2. exploreUsers (test provisioning explore users)
3. getUser (test provisioning retrieve account)
4. createUser (test provisioning new account)
5. deleteUser (test provisioning delete account)
6. modifyUser (test provisioning modify account)
7. exploreGroups (test provisioning explore groups)
8. Turn on group functionality (if supporting groups)
8. getGroup (test provisioning group list groups)
9. getGroupMembers (test provisioning retrieve account - group list groups)
10. modifyGroupMembers (test provisioning retrieve account - group add/remove groups)
11. getGroupUsers (if using "groups member of user")
12. createGroup (test provisioning new group)

Template used by CA Provisioning role should only include endpoint supported attributes defined in our plugin. Template should therefore have no links to global user for none supported attributes (e.g. remove %UT% from "Job Title" if our endpoint/code do not support title)

CA Provisioning using default SCIM endpoint do not support SCIM Enterprise User Schema Extension (having attributes like employeeNumber, costCenter, organization, division, department and manager). If we need these or other attributes not found in CA Provisioning, we could define our own by using the free-text "type" definition in the multivalue entitlements or roles attribute. In the template entitlements definition, we could for example define type=Company and set value to %UCOMP%. Please see plugin-forwardinc.js using Company as a multivalue "type" definition.

Using CA Connector Xpress we could create a new SCIM endpoint type based on the original SCIM. We could then add/remove attributes and change from default assign "user to groups" to assign "groups to user". There are also other predefined endpoints based on the original SCIM. You may take a look at "ServiceNow - WSL7" and "Zendesk - WSL7".

For project setup:

* Datasource = Layer7 (CA API) - this is SCIM
* Layer7 Base URL = SCIM Gateway url and port (SCIM Base URL)
* Authentication = Basic Authentication
(connect using gwadmin/password defined in plugin config-file)

$3

Using Connector Xpress based on the original SCIM endpoint.

Delete defaults:
Group - Associations - with User Account
Group - Attributes - members
User Account - Attributes - Group Membership

Create new attribute:
User Account - Attributes: Groups - Flexi DN - Multivalue - groups

Create User - Group associations:
User Account - Accociations - Direct association with = Group
User Account - Accociations - with Group

Note, "Include a Reverse Association" - not needed if we don't need Group object functionality e.g list/add/remove group members

User Attribute = Physical Attribute = Groups
Match Group = By Attribute = ID

Objects Must Exist
Use DNs in Attribute = activated (toggled on)

Include a Reverse Association (if needed)
Group Attribute = Virtual Attribute = User Membership
Match User Account = By Attribute = User Name

Note, groups should be capability attribute (updated when account is synchronized with template):
advanced options - Synchronized = enabled (toggled on)

Methods

Plugins should have following initialization:

// mandatory plugin initialization - start
const path = require('path')
let ScimGateway = null
try {
ScimGateway = require('scimgateway')
} catch (err) {
ScimGateway = require('./scimgateway')
}
let scimgateway = new ScimGateway()
let pluginName = path.basename(__filename, '.js')
let configDir = path.join(__dirname, '..', 'config')
let configFile = path.join(${configDir}, ${pluginName}.json)
let config = require(configFile).endpoint
let validScimAttr = [] // empty array - all attrbutes are supported by endpoint
// add any external config process.env and process.file
config = scimgateway.processExtConfig(pluginName, config)
// mandatory plugin initialization - end

$3

scimgateway.exploreUsers = async (baseEntity, attributes, startIndex, count) => {
let ret = {
"Resources": [],
"totalResults": null
}
...
return ret
}

* baseEntity = Optional for multi-tenant or multi-endpoint support (defined in base url e.g. /client1 gives baseEntity=client1)
* startIndex = Pagination - The 1-based index of the first result in the current set of search results
* count = Pagination - Number of elements to be returned in the current set of search results
* ret:
ret.Resources = array filled with user objects containing user attributes where userName is mandatory e.g [{"userName":"bjensen"}, {"userName":"jsmith"}]
ret.totalResults = if supporting pagination, then attribute should be set to the total numbers of elements (users) at the endpoint, else set to null

$3

scimgateway.exploreGroups = async (baseEntity, attributes, startIndex, count) => {
let ret = {
"Resources": [],
"totalResults": null
}
...
return ret
}

* ret:
ret.Resources = array filled with group objects containing group attributes where displayName is mandatory e.g [{"displayName":"Admins"}, {"displayName":"Employees"}]
ret.totalResults = if supporting pagination attribute should be set to the total numbers of elements (groups) at the endpoint else set to null

$3

scimgateway.getUser = async (baseEntity, getObj, attributes) => {
...
return userObj
}

* getObj = { filter: , identifier: }
e.g: getObj = { "filter": "userName", "identifier": "bjensen"}
filter: userName and id must be supported
* attributes = scim attributes to be returned. If no attributes defined, all should be returned.
* return userObj: userObj containing scim userattributes/values
eg:
{"id":"bjensen","name":{"formatted":"Ms. Barbara J Jensen III","familyName":"Jensen","givenName":"Barbara"}}

Note, the value of the id attribute returned will be used by modifyUser and deleteUser

$3

scimgateway.createUser = async (baseEntity, userObj) => {
...
return null
}

* userObj = user object containing userattributes according to scim standard
Note, multi-value attributes excluding user attribute 'groups' are customized from array to object based on type
* return null: null if OK, else throw error

$3

scimgateway.deleteUser = async (baseEntity, id) => {
...
return null
}

* id = user id to be deleted
* return null: null if OK, else throw error

$3

scimgateway.modifyUser = async (baseEntity, id, attrObj) => {
...
return null
}

* id = user id
* attrObj = object containing userattributes to be modified according to scim standard
Note, multi-value attributes excluding user attribute 'groups' are customized from array to object based on type
* return null: null if OK, else throw error

$3

scimgateway.getGroup = async (baseEntity, getObj, attributes) => {
...
return retObj
}

* getObj = { filter: , identifier: }
e.g: getObj = { "filter": "displayName", "identifier": "GroupA" }
filter: displayName and id must be supported
* attributes = scim attributes to be returned. If no attributes defined, all should be returned.
* return retObj: retObj containing group displayName and id (+ members if using default "users are member of group")

eg. using default "users are member of group":
{"displayName":"Admins","id":"Admins","members":[{"value":"bjensen","display":"bjensen"]}

eg. using "groups are member of user":
{"displayName":"Admins","id":"Admins"}

If we do not support groups, callback(null, null)

$3

scimgateway.getGroupMembers = async (baseEntity, id, attributes) => {
let arrRet = []
...
return arrRet
}

Retrieve all groups for user id WHEN "user member of groups". This setting is default SCIM behaviour. This means Group having multivalue attribute members containing id of users.

* id = user id (eg. bjensen)
* attributes = scim attributes to be returned as object in array
* arrRet = array containing the objects of id, displayName and members where members value only include current user id on the format:
{ id: > , displayName: , members [{value: }] }

[
{"id": "Admins", "displayName: "Admins", "members": [{"value": "bjensen"}]},
{"id": "Employees", "displayName: "Employees", "members": [{"value": "bjensen"}]}
]

If "user member of groups" not supported, then return []

$3

scimgateway.getGroupUsers = async (baseEntity, id, attributes) => {
let arrRet = []
...
return arrRet
}

Retrieve all users for a spesific group id WHEN "group member of users". This means user having multivalue attribute groups having value set to group id

* id = group id (eg. UserGroup-1)
* attributes = scim attributes to be returned as object in array
* arrRet = array containing the objects of userName and groups.value e.g:

[
{"userName", "bjensen": [{"value": "UserGroup-1"}]},
{"userName", "jsmith"}: [{"value": "UserGroup-1"}]}
]

If "group member of users" not supported, then return []

$3

* groupObj = group object containing groupattributes according to scim standard
groupObj.displayName contains the group name to be created
* return null: null if OK, else throw error

$3

* id = group name (eg. Admins) to be deleted
* return null: null if OK, else throw error

$3

scimgateway.modifyGroup = async (baseEntity, id, attrObj) => {
...
return null
}

* id = group name (eg. Admins)
* attrObj = object containing groupattributes to be modified according to scim standard
attrObj.members (must be supported) = array of objects containing groupmembers modifications
eg: {"value":"bjensen"},{"operation":"delete","value":"jsmith"}
(adding bjensen and deliting jsmith from group)
* return null: null if OK, else throw error
If we do not support groups, then return null

Known limitations

* Installation gives error messages related to the module soap optional dependency to 'ursa' that also includes 'node-gyp'. These error messages can be ignored unless soap WSSecurityCert functionality is needed in custom plugin code.

* SCIM filtering only supports operator 'eq' returning unique object only, example:
/Users?filter=userName eq "bjensen"&attributes=userName,id,name.givenName
/Users?filter=emails.value eq "bjensen@example.com"&attributes=userName,phoneNumbers

License

Change log

$3

- plugin-ldap objectGUID introduced in v.3.2.7 had some missing logic

$3

- plugin-ldap supports using Active Directory objectGUID instead of dn mapped to id
configuration example:

"objectGUID": {
"mapTo": "id",
"type": "string"
}

[Fixed]

- Return 500 on GET handler error instead of 404
Thanks to Nipun Dayanath
- createUser/createRole response now includes id retrieved by getUser/getRole instead of using posted userName/displayName value

$3

- bearerJwt authentication missing public key handling
- plugin-azure-ad getGroup did not return all members when group had more than 100 members (Azure page size is 100). getGroup now using paging

$3

- default "type converted object" logic may fail on requests that includes a mix of type and blank type. Now blank type will be converted to type "undefined", and all types must be unique within the same request. "type converted object" logic can be turned off by configuration scim.skipTypeConvert = true
- plugin-loki supporting type = "undefined"

[Added]

- new configuration scim.skipTypeConvert allowing overriding the default behaviour "type converted object" when set to true. See attribute list for details
- scimgateway.isMultivalue used by plugin-loki have been changed, and custom plugins using this method must be updated

old syntax:
scimgateway.isMultivalue('User', key)

new syntax:
scimgateway.isMultiValueTypes(key)

$3

- plugin-loki some code cleanup

$3

- PUT was not according to the SCIM specification
- plugin-mssql broken after dependencies bump v3.1.0
- plugin-loki getUser using find instead of findOne to ensure returning unique user

$3

- plugins missing logic for handling the virtual readOnly user attribute groups (when "user member of groups") e.g. GET /Users/bjensen should return all user attributes including the virtual groups attribute. Now this user attribute will be automatically handled by scimgateway if not included in the plugin response.
- Pre and post actions onAddGroups/onRemoveGroups introduced in v.3.2.0 has been withdrawn

[Added]

- scimgateway will do plugin response filtering according to requested attributes/excludedAttributes

$3

- plugin-azure-ad updating businessPhones (Office phone) broken after v3.2.0
- plugin-azure-ad listing groups for user did also include Azure roles
- SCIM v2.0 none core schema attributes handling
- response not always including correct schemas

[Added]

- roles now using array instead of objects based on type. Note, this may break your custom plugins if roles logic are in use

$3

- ipAllowList for restricting access to allowlisted IP addresses or subnets e.g. Azure AD IP-range
Configuration example:

"ipAllowList": [
"13.66.60.119/32",
"13.66.143.220/30",
...
"2603:1056:2000::/48",
"2603:1057:2::/48"
]

- Example plugins now configured for SCIM v2.0 instead of v1.1

New configuration:

"scim": {
"version": "2.0"
}

Old configuration:

"scim": {
"version": "1.1"
}

$3

- plugin-ldap a general LDAP plugin pre-configured for Microsoft Active Directory. Using endpointMapper logic (like plugin-azure-ad) for attribute flexibility
- Pre and post actions onAddGroups/onRemoveGroups can be configured and needed logic to be defined in plugin method pre_post_Action
- Dependencies bump

$3

- plugin-azure-ad delete account fails in v3.x

$3

- Using proxy configuration broken in v3.x

$3

- Dependencies bump

$3

- Pagination request having startIndex but no count, now sets count to default 200 and may be overridden by plugin.

$3

- GET /Users?startIndex=1&count=100 with no attributes filter included did not work

$3

- SCIM v2.0 PUT did not work.

$3

- getApi supports body (apiObj).

Old syntax:

scimgateway.getApi = async (baseEntity, id, apiQuery) => {

New syntax:

scimgateway.getApi = async (baseEntity, id, apiQuery, apiObj) => {

$3

- getUser/getGroup now using parameter getObj giving more flexibility
- deprecated modifyGroupMembers - now using modifyGroup
- deprecated configuration scimgateway.scim.customUniqueAttrMapping - replaced by getObj logic
- loglevel=off turns of logging
- Auth methods allowing more than one user/object including option for readOnly
- Includes latest versions of module dependencies

[UPGRADE]

Note, this is a major upgrade (^2.x.x => ^3.x.x) that will brake compatibility with any existing custom plugins. To force a major upgrade, suffix @latest must be include in the npm install command, but it's recommended to do a fresh install and copy any custom plugins instead of upgrading an existing package

Old syntax:

scimgateway.getUser = async (baseEntity, userName, attributes) => {
scimgateway.getGroup = async (baseEntity, displayName, attributes) => {
scimgateway.modifyGroupMembers = async (baseEntity, id, members) => {

New syntax:

scimgateway.getUser = async (baseEntity, getObj, attributes) => {
const userName = getObj.identifier // gives v2.x compatibility

scimgateway.getGroup = async (baseEntity, getObj, attributes) => {
const displayName = getObj.identifier // gives v2.x compatibility

scimgateway.modifyGroup = async (baseEntity, id, attrObj) => {
// attrObj.members corresponds to members in deprecated modifyGroupMembers

getUser comments:
getObj = { filter: , identifier: }
e.g: getObj = { filter: 'userName', identifier: 'bjensen'}
filter: userName and id must be supported

getGroup comments:
getObj = { filter: , identifier: }
e.g: getObj = { filter: 'displayName', identifier: 'GroupA' }
filter: displayName and id must be supported

Please see provided example plugins

Using the new getObj parameter gives more flexibility in the way of lookup a user e.g:
http://localhost:8880/Users?filter=emails.value eq "jsmith@example.com"&attributes=userName,name.givenName
getObj = { filter: 'emails.value', identifier: 'jsmith@example.com'}
attributes = 'userName,name.givenName'

Configuration file, auth settings have changed and now using arrays allowing more than one user/object to be set. "readOnly": true can also be set for allowing read only access for a spesific user (does not apply to bearerJwtAzure).

New syntax is:

"auth": {
"basic": [
{
"username": "gwadmin",
"password": "password",
"readOnly": false
}
],
"bearerToken": [
{
"token": null,
"readOnly": false
}
],
"bearerJwtAzure": [
{
"tenantIdGUID": null
}
],
"bearerJwt": [
{
"secret": null,
"publicKey": null,
"options": {
"issuer": null
},
"readOnly": false
}
]
}

$3

- Plugin configuration referring to an external configuration file using an array did not work.

$3

- Log masking of xml (SOAP) messages.

$3

- Log masking of custom defined attributes.
customMasking may include an array of attributes to be masked
e.g. "customMasking": ["SSN", "weight"]
- Note, configurationfiles must be changed (old syntax still supported)
old syntax:

"loglevel": {
"file": "debug",
"console": "error"
},
new syntax:

"log": {
"loglevel": {
"file": "debug",
"console": "error"
},
"customMasking": []
},
By default SCIM Gateway includes masking of standard attributes like password

$3

- AAD as IdP broken after content-type validation introduced in v2.1.7
- AAD as IdP, none gallery app support
- Incorrect SCIM 2.0 multivalue converting
- plugin-saphana not correctly ported to v2.x

Thanks to Luca Moretto

$3

- plugin-mssql not correctly ported to v2.x, and some config syntax for this plugin have also changed in newer releases of dependencies.

$3

- Validates content-type when body is included
- Case insensitive log-masking
- Plugins now don't using deprecated url.parse
- Misc cosmetics e.g. using const instead of let when not reassigned

$3

- plugin-azure-ad did not return correct error code (err.name = 'DuplicateKeyError') when failing on creating a duplicate user

[Added]

- Includes latest versions of module dependencies

$3

- Incorrect SCIM 2.0 error handling after v2.1.0
- For duplicate key error, setting err.name = 'DuplicateKeyError' now gives correct status code 409 instead of defult 500 (see plugin-loki.js)

$3

- Standardized the API Gateway response (not SCIM related)
- Not allowing plugins to return password
- Colorize option now automatically turned off when using stdout/stderr redirect (configuration file loglevel.colorize is not needed)

$3

- SCIM 2.0 may use Operations.value as array and none array (issue #16)

[Added]

- Option for replacing mandatory userName/displayName attribute by configuring customUniqueAttrMapping
- Includes latest versions of module dependencies

$3

- SCIM 2.0 may use Operations.value or Operation.value[] for PATCH syntax of the name object (issue #14)
- plugin-loki failed to modify a none existing object, e.g name object not included in Create User

$3

- Custom schema attributes can be added by plugin configuration scim.customSchema having value set to filename of a JSON schema-file located in /config/schemas

[UPGRADE]

- Configurationfiles for custom plugins should be changed
old syntax:

"scimversion": "1.1",
new syntax:

"scim": {
"version": "1.1",
"customSchema": null
},
Note, "1.1" is default, if using "2.0" the new syntax must be used.

$3

- SCIM 2.0 incorrect response for user not found
- Did not mask logentries ending with newline

$3

- Codebase moved from callback to async/await
- Koa replacing Express
- Some log enhancements
- Deprecated cipher methods have been replaced
- Plugin restful (REST) and
- forwardinc (SOAP) includes failover logic based on endpoints defined in array baseUrls/baseServiceEndpoints.

[UPGRADE]

Note, this is a major upgrade (^1.x.x => ^2.x.x) and will brake compatibility with any existing custom plugins. To force a major upgrade, suffix @latest must be include in the npm install command, but it's recommended to do a fresh install and copy any custom plugins instead of upgrading an existing package

cd c:\my-scimgateway
npm install scimgateway@latest

Custom plugins needs some changes (please see included example plugins)

- scimgateway.on(xxx, function (..., callback) replaced with scimgateway.xxx = async (...) returning a result or throwing an error
- Rest and SOAP using doRequest method having endpoint failover logic through array baseUrls/baseServiceEndpoints defined in corresponding plugin configuration file.
- Additional argument attributes included in exploreUsers and exploreGroups method
- Proxy configuration includes option for user/password
- Encrypted passwords in configuration files needs to be reset to clear text passwords

$3

- HTTP status code 200 and totalResults set to value of 0 when using SCIM 2.0 filter user/group and no resulted user/group found. SCIM 1.1 still using status code 404.

[UPGRADE]

- For custom plugins to be compliant with SCIM 2.0, the getUser and getGroup methods needs to be updated. If user/group not found then return callback(null, null) instead of callback(err)

$3

- Fix related to external configuration (ref. v1.0.18) when running multiple plugins

$3

- Includes latest versions of module dependencies
- Loglevel configuration for file and console now separated
- Loglevel colorize option (value false could be useful when redirecting console output)
- All configuration can be set based on environment variables
- All configuration can be set based on correspondig json-content in external file (supports also dot notation)

[UPGRADE]

- Configurationfiles for custom plugins should be changed
old syntax:

loglevel: "debug"
new syntax:

"loglevel": {
"file": "debug",
"console": "error",
"colorize": true
}

$3

- Some multiValued attributes not correctly handled (e.g. addresses)

$3

- plugin-azure-ad: New version of "Azure - ScimGateway.xml" fixing CA IM RoleDefGenerator problem (related to creating and importing screens in CA IM)

[UPGRADE]

- Use CA ConnectorXpress, import "Azure - ScimGateway.xml" and deploy/redeploy endpoint

$3

- Incorrect logging of Express stream messages (type info) when running multiple plugins

$3

- plugin-azure-ad: proxy configuration did not work

$3

- An issue with pagination fixed

$3

- Cosmetics, changed emailOnError logic - now emitted by logger

$3

- Support health monitoring using the "/ping" URL with a "hello" response, e.g. http://localhost:8880/ping. Useful for frontend load balancing/failover functionality
- Option for error notifications by email

[UPGRADE]

- Configuration files for custom plugins must include the emailOnError object for enabling error notifications by email. Please see the syntax in provided example plugins and details described in the "Configuration" section of this document.

$3

- Docker now using node v.9.10.0 instead of v.6.9.2
- Minor log cosmetics

$3

- Azure AD plugin, failed to create user when licenses (app Service plans) was included

$3

-