Class BowireScimOptions

Namespace

Kuestenlogik.Bowire.Scim

Assembly

Kuestenlogik.Bowire.Scim.dll

What an install has said about letting an identity provider manage its user list (#96, #28 Phase C). Bound from Bowire:Scim.

public sealed class BowireScimOptions

Inheritance

object

BowireScimOptions

Inherited Members

object.GetType()

object.ToString()

object.Equals(object)

object.Equals(object, object)

object.ReferenceEquals(object, object)

object.GetHashCode()

Constructors

BowireScimOptions()

public BowireScimOptions()

Properties

AdminGroup

The group whose members Bowire treats as administrators.

public string AdminGroup { get; set; }

Property Value

string

Remarks

Named rather than assumed: an IdP's group for this is called whatever the operator's directory calls it, and hard-coding admin would make provisioning work only for directories that happen to agree.

BasePath

Where the endpoints mount. /scim/v2 by default.

public string BasePath { get; set; }

Property Value

string

Remarks

Outside the workbench's route group on purpose. Those routes are gated by the workbench's own auth provider, and an IdP's provisioning connector has a shared secret, not a user session — it could never get through that gate.

DefaultPageSize

How many resources a list response returns when the caller does not say. RFC 7644 §3.4.2.4 leaves this to the service provider.

public int DefaultPageSize { get; set; }

Property Value

int

Enabled

Whether the SCIM endpoints are mounted at all. Off by default.

public bool Enabled { get; set; }

Property Value

bool

Remarks

A provisioning API is an administrative surface reachable with one shared secret. It exists when an operator asks for it and not a moment before — least of all as a side effect of upgrading.

EnforceActive

Whether a deactivated identity is refused at the door.

public bool EnforceActive { get; set; }

Property Value

bool

Remarks

On by default, because it is the difference between provisioning and bookkeeping: an install where deprovisioning records a flag that nothing reads has not deprovisioned anybody. Turn it off only when something in front of Bowire already enforces the same thing.

MaxPageSize

The largest page a caller can ask for.

public int MaxPageSize { get; set; }

Property Value

int

PurgeAfter

How long a deprovisioned identity's state is kept before it is deleted. 30 days by default; Zero deletes immediately.

public TimeSpan PurgeAfter { get; set; }

Property Value

TimeSpan

Remarks

The window exists because deprovisioning is routinely undone — someone changes team, an IdP sync misfires, a contract is extended. Deleting on the DELETE call makes those recoverable only from a backup, if there is one.

RequireProvisioned

Whether an identity the directory has never heard of is refused.

public bool RequireProvisioned { get; set; }

Property Value

bool

Remarks

Off by default, and the default is the careful one: an IdP that has not finished its first sync would otherwise lock out the operator who just turned provisioning on, including their way back in to turn it off. Installs that want the directory to be the allow-list rather than an additional check set this once the first sync has landed.

Token

The bearer token the identity provider presents.

public string? Token { get; set; }

Property Value

string

Remarks

Enabling without one is refused at startup rather than served open: an unauthenticated provisioning endpoint is a way for anyone who can reach the host to create identities.

TraceProvisioning

Record every SCIM request to scim/trace.jsonl (#639). Off by default.

public bool TraceProvisioning { get; set; }

Property Value

bool

Remarks

For a provisioning round-trip against a real identity provider, where the questions are about the connector rather than about Bowire: how it pages a directory, what it sends that Bowire does not model, which PATCH dialect it actually uses, how long it takes to notice a deactivation. events.jsonl cannot answer those — it records mutations and their outcome, so a provider's reads leave no trace, and the reads are most of what a round-trip is for.

Off by default because the lines contain what the connector sent: user names, e-mail addresses, the filters a directory walk used. Personal data about people who did not agree to be in a debug file, wanted for a bounded exercise rather than for normal operation. Turn it on for the exercise, and off again after.