SCIM 2.0 SDK for Spring

SCIM, or System for Cross-domain Identity Management, is an IETF standard that defines an extensible schema mechanism and REST API for managing users and other identity data. SCIM is used by a variety of vendors — including Okta, Slack and Microsoft.

The BetterCloud SCIM 2.0 SDK provides a set of libraries for creating new SCIM services quickly utilizing Spring. The SDK is branched from the Ping Identity SCIM 2.0 SDK.

Table of Contents

• SDK Components
• Installing the Spring Boot Starter
• Configuring the ServiceProviderConfig
• Adding Resources
• Version History
• Development
• License
• Other Notes

SDK Components

Installing the Spring Boot Starter

The starter is available from Maven Central, for all modern Java build systems.

Gradle:

dependencies {
    compile('com.bettercloud:spring-boot-starter-scim2:1.0.0')
}

Maven:

<dependency>
    <groupId>com.bettercloud</groupId>
    <artifactId>spring-boot-starter-scim2</artifactId>
    <version>1.0.0</version>
</dependency>

Configuring the ServiceProviderConfig

Every SCIM 2.0 service must support the /ServiceProviderConfig API. The spring-boot-starter-scim2 will autoconfigure a Spring Web MVC endpoint given the following properties are provided.

scim2.service-provider-config.authenticationSchemes is a multi-valued property with the following properties defined:

Sample Configuration

scim2:
  resourcesPackage: com.bettercloud.core.config.server.controller
  baseUrl: https://app.bettercloud.com
  service-provider-config:
    documentationUri: http://www.simplecloud.info
    patch:
      supported: true
    bulk:
      supported: false
      maxOperations: 1000
      maxPayloadSize: 10000
    filter:
      supported: true
      maxResults: 25
    change-password:
      supported: true
    sort:
      supported: true
    etag:
      supported: true
    authenticationSchemes:
    	- name: OAuth Bearer Token
          description: Authentication Scheme using OAuth Bearer Token Standard
          specUri: http://tools.ietf.org/html/draft-ietf-oauth-v2-bearer-01
          documentationUri: http://example.com/help/oauth.html
          type: oauthbearertoken
          primary: true

Adding Resources

Any controller annotated with @ScimResource and @RequestMapping will be detected and will be auto configured as a ResourceTypeDefinition. If the resource is discoverable the /ResourceTypes and /Schemas discovery APIs will be automatically configured to serve these resource.
Example

@RestController
@ScimResource(description = "Access User Resources", name = "User", schema = UserResource.class)
@RequestMapping("/user")
public class UserController {
	// CRUD APIs...
}

Version History

Note that changes to the major version (i.e. the first number) represent possible breaking changes, and may require modifications in your code to migrate. Changes to the minor version (i.e. the second number) should represent non-breaking changes. The third number represents any very minor bugfix patches.

• 1.0.0: Initial public release. Support for auto configuring ServiceProviderConfig, ResourceType, and Schema discovery APIs.

Development

Pull requests are welcomed for bugfixes or enhancements that do not alter the external facing class and method signatures. For any breaking changes that would alter the contract provided by this driver, please open up an issue to discuss it first.

All code changes should include unit test. Unit tests are any thatcan be run in isolation, with no external dependencies.

Unit tests are located under the src/test directory, and can be run with the Grade test task.

License

The BetterCloud SCIM 2.0 SDK contains code branched from the Ping Identity SCIM 2.0 SDK.

The UnboundID SCIM2 SDK is available under three licenses: the GNU General Public License version 2 (GPLv2), the GNU Lesser General Public License version 2.1 (LGPLv2.1), and a free-right-to-use license created by UnboundID Corp. See the LICENSE file for more info.

BetterCloud contributions are licensed under the MIT License (MIT)

Copyright (c) 2019-2022 BetterCloud

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.