Supports Google Workspace

[kwent]

Supports Google Workspace

I know it's a bit out of scope and we should probably not support it but Google Workspace scim is using the wrong mime type ( application/json ) ( and not configurable ) and so library is returning 406.

For whoever ran into this issue in the future here is a monkeypatch below

# config/initializers/scimitar.rb
module Scimitar
  class ApplicationController
    private

    # Only difference with upstream is adding support for Google. request.user_agent == "Google-Auto-Provisioning"

    def require_scim
      scim_mime_type = Mime::Type.lookup_by_extension(:scim).to_s

      if request.media_type.nil? || request.media_type.empty?
        request.format = :scim
        request.headers["CONTENT_TYPE"] = scim_mime_type
      elsif request.user_agent == "Google-Auto-Provisioning"
        request.format = :scim
        request.headers["CONTENT_TYPE"] = scim_mime_type
      elsif request.media_type.downcase == scim_mime_type
        request.format = :scim
      elsif request.format == :scim
        request.headers["CONTENT_TYPE"] = scim_mime_type
      else
        handle_scim_error(ErrorResponse.new(status: 406, detail: "Only #{scim_mime_type} type is accepted."))
      end
    end
  end
end

[jeremybdk]

Hey @kwent ,
Thanks for the patch, I was wondering if you had a guide/doc to share on how to use SCIM with google workspace.
From my understanding it was only by creating a custom app with validation from Google.

Is this still the case? I would love to use this :)

[pond]

@kwent / @jeremybdk Yeah, I mean, at the very least I think I'd be happy to have this as a PR and get it merged (even at the risk of maybe making some strict validators fail due to the permissiveness, but it could be later patched to switch it on or off via env.var for those that cared if so). I'd do it myself, but since RIPA failed and Scimitar lives at https://github.com/pond/scimitar/, I'm not so keen on self-reviewing my own code and bypassing branch protections to merge 😂

[kwent]

@jeremybdk

Google Workspace only supports SCIM for a few apps for reasons i'm not aware about. Fortunately enough we can take advantage of those to make it work.

Add a new Web and Mobile apps

Then add Adobe App

In the next form fill out all fields with

• https://dummy.com/saml

• When it comes to configure auto-provisioning, copy the SCIM token

• Endpoint url to configure is https://your-service.com/scim

• Select a group of user you want to import into or leave empty.

• Finally enabled the application. The sync should kick in shortly.

[pond]

I'm considering this code:

• 09b2847...1ddbf6e

...which is an adaptation of yours which:

• Checks Google last out of all options to avoid wasting CPU time on string comparisons for what is hopefully an edge case
• Is a bit more permissive about user agent

...are you able to maybe copy that approach in your monkey patch and see if it works? Or do you think it should work just by inspection?

[pond]

Incorporated in #161. For the release version, I'll add a brief note in the read-me to link to @kwent's brief overview of setup from March 5th so that this very helpful info isn't lost.

[pond]

@kwent This is released in v2.12.0, now on RubyGems.

For the rest of the changes, please see the CHANGELOG.md notes.