Class BowireScimExtensions

Namespace

Kuestenlogik.Bowire.Scim

Assembly

Kuestenlogik.Bowire.Scim.dll

Wires SCIM provisioning into a host (#96).

public static class BowireScimExtensions

Inheritance

object

BowireScimExtensions

Inherited Members

object.GetType()

object.MemberwiseClone()

object.ToString()

object.Equals(object)

object.Equals(object, object)

object.ReferenceEquals(object, object)

object.GetHashCode()

Methods

AddBowireScim(IServiceCollection, IConfiguration, Action<BowireScimOptions>?)

Register the provisioning services. Reads Bowire:Scim; configure wins over the configuration file.

public static IServiceCollection AddBowireScim(this IServiceCollection services, IConfiguration configuration, Action<BowireScimOptions>? configure = null)

Parameters

services IServiceCollection

configuration IConfiguration

configure Action<BowireScimOptions>

Returns

IServiceCollection

MapBowireScim(IEndpointRouteBuilder)

Mount the SCIM endpoints.

public static IEndpointRouteBuilder MapBowireScim(this IEndpointRouteBuilder endpoints)

Parameters

endpoints IEndpointRouteBuilder

Returns

IEndpointRouteBuilder

Remarks

Outside the workbench's route group deliberately. Those routes are gated by whatever auth provider the operator configured, and a provisioning connector holds a shared secret rather than a user session — it could never pass that gate. SCIM authenticates itself, with its own token, on its own path.

No-op unless Enabled is set.

Exceptions

InvalidOperationException

Provisioning is enabled with no token. Serving it open would let anyone who can reach the host create identities.

UseBowireScim(IApplicationBuilder)

Refuse a request from an identity the directory has deprovisioned, and remember which token subject each provisioned identity turns out to be.

public static IApplicationBuilder UseBowireScim(this IApplicationBuilder app)

Parameters

app IApplicationBuilder

Returns

IApplicationBuilder

Remarks

This is what separates provisioning from bookkeeping. An install where deactivating in Okta sets a flag that nothing reads has not deprovisioned anybody — the person keeps working until someone notices.

It also does the binding no other code can. Provisioning knows a userName and an externalId; a token carries a subject. The first request from a provisioned identity is the only moment both are in the same place, so that is where the two get tied together — and after that, deprovisioning knows exactly whose slot to archive.