elimity-com / scim

Golang Implementation of the SCIM v2 Specification
MIT License
177 stars 55 forks source link

Azure's noncompliance of standard #163

Closed landron closed 7 months ago

landron commented 10 months ago

Azure's (Microsoft Entra ID) non-compliance with the SCIM standard on PATCH requests has been causing some issues:

Ideally, for values like active, it would be great if the library could support multiple types (allowing it to be a boolean like the standard, but also a string like Azure). There are workarounds, such as adding the same attribute multiple times and having the first one be matched, but this doesn't seem like the best solution.

icamys commented 8 months ago

I also started to look into this package and apparently what it does, is transform HTTP requests into Golang structures that are described by the SCIM specifications and vice-versa. This package is intended to be SCIM-compliant, so ideally it should not be changed frequently, as the RFC does not change significantly, and should not depend on anything except the RFC.

There are many SCIM clients out there that may be incompatible with SCIM spec in their unique way. Also, with time they can change or get fixes for their incompatibilities. Considering this client's changing nature, I think adding code to this repository that will solve those unpredictable issues does not make much sense. Instead, it's better to write middleware adapters that will solve the incompatibility, add them to your application, and remove them, when the incompatibility is fixed by the SCIM client vendor. In this way, you have a library that does not change, which is good, as this minimizes the risk of breaking changes and service disruption, and you have adapters, that you implement and manage depending on the SCIM clients that you want to support.

landron commented 8 months ago

I disagree because EntraID (formerly Azure) is not just another SCIM client. The library could support named commercial clients or clearly state that it doesn't.

There are many SCIM clients out there that may be incompatible.

Can you, please, name a couple?

better to write middleware adapters

Instead the library could support the recommended adapters in one way or another (like an extended schema), ensuring that "you have a library that does not change."

when the incompatibility is resolved by the SCIM client

I believe there isn't much hope since the other incompatibilities were solved five years ago (here).

Anyway, at least this active value type is addressed "by appending the URL parameter ?aadOptscim062020 after the tenant URL input" (SO question).

q-uint commented 8 months ago

We were not planning to support "string values", but since the demand is high I am probably will add the option to enable this (non-compliant) behavior.