Class ScimUserDirectory

Namespace

Kuestenlogik.Bowire.Scim

Assembly

Kuestenlogik.Bowire.Scim.dll

Answers "who is this, and do they administer the install" from the provisioned directory (#98, on top of #96).

public sealed class ScimUserDirectory : IBowireUserDirectory

Inheritance

object

ScimUserDirectory

Implements

IBowireUserDirectory

Inherited Members

object.GetType()

object.ToString()

object.Equals(object)

object.Equals(object, object)

object.ReferenceEquals(object, object)

object.GetHashCode()

Remarks

The token knows what the person authenticated with; the directory knows what their organisation says about them. This takes the token first for anything the person would recognise as their own — a name is fresher in a token than in a record synced overnight — and the directory for the one thing a token cannot be trusted to carry here: whether they are an administrator.

That distinction is the point. A role claim in a token is only as good as the mapping that produced it, and Bowire has no way to check that mapping; group membership in the provisioned directory is something the operator configured deliberately and can audit.

Constructors

ScimUserDirectory(BowireScimStore, BowireScimOptions)

Answers "who is this, and do they administer the install" from the provisioned directory (#98, on top of #96).

public ScimUserDirectory(BowireScimStore store, BowireScimOptions options)

Parameters

store BowireScimStore

options BowireScimOptions

Remarks

The token knows what the person authenticated with; the directory knows what their organisation says about them. This takes the token first for anything the person would recognise as their own — a name is fresher in a token than in a record synced overnight — and the directory for the one thing a token cannot be trusted to carry here: whether they are an administrator.

That distinction is the point. A role claim in a token is only as good as the mapping that produced it, and Bowire has no way to check that mapping; group membership in the provisioned directory is something the operator configured deliberately and can audit.

Methods

Describe(ClaimsPrincipal?, string)

Describe the caller. principal is the token, subject the value their storage is keyed on.

public BowireUserProfile Describe(ClaimsPrincipal? principal, string subject)

Parameters

principal ClaimsPrincipal

subject string

Returns

BowireUserProfile

Search(string?, int)

Identities matching term, for a picker.

public IReadOnlyList<BowireUserProfile> Search(string? term, int limit)

Parameters

term string

limit int

Returns

IReadOnlyList<BowireUserProfile>

Remarks

Empty when nothing in this install knows who else exists — which is the honest answer, and the one that keeps a picker from offering a list it made up.