[EC-261] SCIM (#2105)

* scim project stub * some scim models and v2 controllers * implement some v2 scim endpoints * fix spacing * api key auth * EC-261 - SCIM Org API Key and connection type config * EC-261 - Fix lint errors/formatting * updates for okta implementation testing * fix var ref * updates from testing with Okta * implement scim context via provider parsing * support single and list of ids for add/remove groups * log ops not handled * touch up scim context * group list filtering * EC-261 - Additional SCIM provider types * EC-265 - UseScim flag and license update * EC-265 - SCIM provider type of default (0) * EC-265 - Add Scim URL and update connection validation * EC-265 - Model validation and cleanup for SCIM keys * implement scim org connection * EC-265 - Ensure ServiceUrl is not persisted to DB * EC-265 - Exclude provider type from DB if not configured * EC-261 - EF Migrations for SCIM * add docker builds for scim * EC-261 - Fix failing permissions tests * EC-261 - Fix unit tests and pgsql migrations * Formatting fixes from linter * EC-265 - Remove service URL from scim config * EC-265 - Fix unit tests, removed wayward validation * EC-265 - Require self-hosted for billing sync org conn * EC-265 - Fix formatting issues - whitespace * EC-261 - PR feedback and cleanup * scim constants rename * no scim settings right now * update project name * delete package lock * update appsettings configs for scim * use default scim provider for context Co-authored-by: Kyle Spearrin <kyle.spearrin@gmail.com>
2025-06-30 23:52:50 -05:00 · 2022-07-14 15:58:48 -04:00
parent c5852db6ed
commit 19b8d8281a
117 changed files with 8553 additions and 169 deletions
--- a/src/Api/Controllers/OrganizationConnectionsController.cs
+++ b/src/Api/Controllers/OrganizationConnectionsController.cs
@ -9,13 +9,11 @@ using Bit.Core.OrganizationFeatures.OrganizationConnections.Interfaces;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Core.Settings;
-using Bit.Core.Utilities;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;

 namespace Bit.Api.Controllers
 {
-    [SelfHosted(SelfHostedOnly = true)]
    [Authorize("Application")]
    [Route("organizations/connections")]
    public class OrganizationConnectionsController : Controller
@ -57,10 +55,10 @@ namespace Bit.Api.Controllers
        {
            if (!await HasPermissionAsync(model?.OrganizationId))
            {
-                throw new BadRequestException("Only the owner of an organization can create a connection.");
+                throw new BadRequestException($"You do not have permission to create a connection of type {model.Type}.");
            }

-            if (await HasConnectionTypeAsync(model))
+            if (await HasConnectionTypeAsync(model, null, model.Type))
            {
                throw new BadRequestException($"The requested organization already has a connection of type {model.Type}. Only one of each connection type may exist per organization.");
            }
@ -68,15 +66,9 @@ namespace Bit.Api.Controllers
            switch (model.Type)
            {
                case OrganizationConnectionType.CloudBillingSync:
-                    var typedModel = new OrganizationConnectionRequestModel<BillingSyncConfig>(model);
-                    var license = await _licensingService.ReadOrganizationLicenseAsync(model.OrganizationId);
-                    if (!_licensingService.VerifyLicense(license))
-                    {
-                        throw new BadRequestException("Cannot verify license file.");
-                    }
-                    typedModel.ParsedConfig.CloudOrganizationId = license.Id;
-                    var connection = await _createOrganizationConnectionCommand.CreateAsync(typedModel.ToData());
-                    return new OrganizationConnectionResponseModel(connection, typeof(BillingSyncConfig));
+                    return await CreateOrUpdateOrganizationConnectionAsync<BillingSyncConfig>(null, model, ValidateBillingSyncConfig);
+                case OrganizationConnectionType.Scim:
+                    return await CreateOrUpdateOrganizationConnectionAsync<ScimConfig>(null, model);
                default:
                    throw new BadRequestException($"Unknown Organization connection Type: {model.Type}");
            }
@ -91,12 +83,12 @@ namespace Bit.Api.Controllers
                throw new NotFoundException();
            }

-            if (!await HasPermissionAsync(model?.OrganizationId))
+            if (!await HasPermissionAsync(model?.OrganizationId, model?.Type))
            {
-                throw new BadRequestException("Only the owner of an organization can update a connection.");
+                throw new BadRequestException("You do not have permission to update this connection.");
            }

-            if (await HasConnectionTypeAsync(model, organizationConnectionId))
+            if (await HasConnectionTypeAsync(model, organizationConnectionId, model.Type))
            {
                throw new BadRequestException($"The requested organization already has a connection of type {model.Type}. Only one of each connection type may exist per organization.");
            }
@ -104,11 +96,9 @@ namespace Bit.Api.Controllers
            switch (model.Type)
            {
                case OrganizationConnectionType.CloudBillingSync:
-                    var typedModel = new OrganizationConnectionRequestModel<BillingSyncConfig>(model);
-                    // We don't allow overwriting or changing the CloudOrganizationId so save it from the existing connection
-                    typedModel.ParsedConfig.CloudOrganizationId = existingOrganizationConnection.GetConfig<BillingSyncConfig>().CloudOrganizationId;
-                    var connection = await _updateOrganizationConnectionCommand.UpdateAsync(typedModel.ToData(organizationConnectionId));
-                    return new OrganizationConnectionResponseModel(connection, typeof(BillingSyncConfig));
+                    return await CreateOrUpdateOrganizationConnectionAsync<BillingSyncConfig>(organizationConnectionId, model);
+                case OrganizationConnectionType.Scim:
+                    return await CreateOrUpdateOrganizationConnectionAsync<ScimConfig>(organizationConnectionId, model);
                default:
                    throw new BadRequestException($"Unkown Organization connection Type: {model.Type}");
            }
@ -117,22 +107,27 @@ namespace Bit.Api.Controllers
        [HttpGet("{organizationId}/{type}")]
        public async Task<OrganizationConnectionResponseModel> GetConnection(Guid organizationId, OrganizationConnectionType type)
        {
-            if (!await HasPermissionAsync(organizationId))
+            if (!await HasPermissionAsync(organizationId, type))
            {
-                throw new BadRequestException("Only the owner of an organization can retrieve a connection.");
+                throw new BadRequestException($"You do not have permission to retrieve a connection of type {type}.");
            }

-            var connections = await GetConnectionsAsync(organizationId);
+            var connections = await GetConnectionsAsync(organizationId, type);
            var connection = connections.FirstOrDefault(c => c.Type == type);

            switch (type)
            {
                case OrganizationConnectionType.CloudBillingSync:
+                    if (!_globalSettings.SelfHosted)
+                    {
+                        throw new BadRequestException($"Cannot get a {type} connection outside of a self-hosted instance.");
+                    }
                    return new OrganizationConnectionResponseModel(connection, typeof(BillingSyncConfig));
+                case OrganizationConnectionType.Scim:
+                    return new OrganizationConnectionResponseModel(connection, typeof(ScimConfig));
                default:
                    throw new BadRequestException($"Unkown Organization connection Type: {type}");
            }
-
        }

        [HttpDelete("{organizationConnectionId}")]
@ -146,25 +141,70 @@ namespace Bit.Api.Controllers
                throw new NotFoundException();
            }

-            if (!await HasPermissionAsync(connection.OrganizationId))
+            if (!await HasPermissionAsync(connection.OrganizationId, connection.Type))
            {
-                throw new BadRequestException("Only the owner of an organization can remove a connection.");
+                throw new BadRequestException($"You do not have permission to remove this connection of type {connection.Type}.");
            }

            await _deleteOrganizationConnectionCommand.DeleteAsync(connection);
        }

-        private async Task<ICollection<OrganizationConnection>> GetConnectionsAsync(Guid organizationId) =>
-            await _organizationConnectionRepository.GetByOrganizationIdTypeAsync(organizationId, OrganizationConnectionType.CloudBillingSync);
+        private async Task<ICollection<OrganizationConnection>> GetConnectionsAsync(Guid organizationId, OrganizationConnectionType type) =>
+            await _organizationConnectionRepository.GetByOrganizationIdTypeAsync(organizationId, type);

-        private async Task<bool> HasConnectionTypeAsync(OrganizationConnectionRequestModel model, Guid? connectionId = null)
+        private async Task<bool> HasConnectionTypeAsync(OrganizationConnectionRequestModel model, Guid? connectionId,
+            OrganizationConnectionType type)
        {
-            var existingConnections = await GetConnectionsAsync(model.OrganizationId);
+            var existingConnections = await GetConnectionsAsync(model.OrganizationId, type);

            return existingConnections.Any(c => c.Type == model.Type && (!connectionId.HasValue || c.Id != connectionId.Value));
        }

-        private async Task<bool> HasPermissionAsync(Guid? organizationId) =>
-            organizationId.HasValue && await _currentContext.OrganizationOwner(organizationId.Value);
+        private async Task<bool> HasPermissionAsync(Guid? organizationId, OrganizationConnectionType? type = null)
+        {
+            if (!organizationId.HasValue)
+            {
+                return false;
+            }
+            return type switch
+            {
+                OrganizationConnectionType.Scim => await _currentContext.ManageScim(organizationId.Value),
+                _ => await _currentContext.OrganizationOwner(organizationId.Value),
+            };
+        }
+
+        private async Task ValidateBillingSyncConfig(OrganizationConnectionRequestModel<BillingSyncConfig> typedModel)
+        {
+            if (!_globalSettings.SelfHosted)
+            {
+                throw new BadRequestException($"Cannot create a {typedModel.Type} connection outside of a self-hosted instance.");
+            }
+            var license = await _licensingService.ReadOrganizationLicenseAsync(typedModel.OrganizationId);
+            if (!_licensingService.VerifyLicense(license))
+            {
+                throw new BadRequestException("Cannot verify license file.");
+            }
+            typedModel.ParsedConfig.CloudOrganizationId = license.Id;
+        }
+
+        private async Task<OrganizationConnectionResponseModel> CreateOrUpdateOrganizationConnectionAsync<T>(
+            Guid? organizationConnectionId,
+            OrganizationConnectionRequestModel model,
+            Func<OrganizationConnectionRequestModel<T>, Task> validateAction = null)
+            where T : new()
+        {
+            var typedModel = new OrganizationConnectionRequestModel<T>(model);
+            if (validateAction != null)
+            {
+                await validateAction(typedModel);
+            }
+
+            var data = typedModel.ToData(organizationConnectionId);
+            var connection = organizationConnectionId.HasValue
+                ? await _updateOrganizationConnectionCommand.UpdateAsync(data)
+                : await _createOrganizationConnectionCommand.CreateAsync(data);
+
+            return new OrganizationConnectionResponseModel(connection, typeof(T));
+        }
    }
 }
--- a/src/Api/Controllers/OrganizationsController.cs
+++ b/src/Api/Controllers/OrganizationsController.cs
@ -493,7 +493,7 @@ namespace Bit.Api.Controllers
        public async Task<ApiKeyResponseModel> ApiKey(string id, [FromBody] OrganizationApiKeyRequestModel model)
        {
            var orgIdGuid = new Guid(id);
-            if (!await _currentContext.OrganizationOwner(orgIdGuid))
+            if (!await HasApiKeyAccessAsync(orgIdGuid, model.Type))
            {
                throw new NotFoundException();
            }
@ -504,9 +504,9 @@ namespace Bit.Api.Controllers
                throw new NotFoundException();
            }

-            if (model.Type == OrganizationApiKeyType.BillingSync)
+            if (model.Type == OrganizationApiKeyType.BillingSync || model.Type == OrganizationApiKeyType.Scim)
            {
-                // Non-enterprise orgs should not be able to create or view an apikey of billing sync key type
+                // Non-enterprise orgs should not be able to create or view an apikey of billing sync/scim key types
                var plan = StaticStore.GetPlan(organization.PlanType);
                if (plan.Product != ProductType.Enterprise)
                {
@ -523,7 +523,8 @@ namespace Bit.Api.Controllers
                throw new UnauthorizedAccessException();
            }

-            if (!await _userService.VerifySecretAsync(user, model.Secret))
+            if (model.Type != OrganizationApiKeyType.Scim
+                && !await _userService.VerifySecretAsync(user, model.Secret))
            {
                await Task.Delay(2000);
                throw new BadRequestException("MasterPasswordHash", "Invalid password.");
@ -535,15 +536,15 @@ namespace Bit.Api.Controllers
            }
        }

-        [HttpGet("{id}/api-key-information")]
-        public async Task<ListResponseModel<OrganizationApiKeyInformation>> ApiKeyInformation(Guid id)
+        [HttpGet("{id}/api-key-information/{type?}")]
+        public async Task<ListResponseModel<OrganizationApiKeyInformation>> ApiKeyInformation(Guid id, OrganizationApiKeyType? type)
        {
-            if (!await _currentContext.OrganizationOwner(id))
+            if (!await HasApiKeyAccessAsync(id, type))
            {
                throw new NotFoundException();
            }

-            var apiKeys = await _organizationApiKeyRepository.GetManyByOrganizationIdTypeAsync(id);
+            var apiKeys = await _organizationApiKeyRepository.GetManyByOrganizationIdTypeAsync(id, type);

            return new ListResponseModel<OrganizationApiKeyInformation>(
                apiKeys.Select(k => new OrganizationApiKeyInformation(k)));
@ -553,7 +554,7 @@ namespace Bit.Api.Controllers
        public async Task<ApiKeyResponseModel> RotateApiKey(string id, [FromBody] OrganizationApiKeyRequestModel model)
        {
            var orgIdGuid = new Guid(id);
-            if (!await _currentContext.OrganizationOwner(orgIdGuid))
+            if (!await HasApiKeyAccessAsync(orgIdGuid, model.Type))
            {
                throw new NotFoundException();
            }
@ -573,7 +574,8 @@ namespace Bit.Api.Controllers
                throw new UnauthorizedAccessException();
            }

-            if (!await _userService.VerifySecretAsync(user, model.Secret))
+            if (model.Type != OrganizationApiKeyType.Scim
+                && !await _userService.VerifySecretAsync(user, model.Secret))
            {
                await Task.Delay(2000);
                throw new BadRequestException("MasterPasswordHash", "Invalid password.");
@ -586,6 +588,15 @@ namespace Bit.Api.Controllers
            }
        }

+        private async Task<bool> HasApiKeyAccessAsync(Guid orgId, OrganizationApiKeyType? type)
+        {
+            return type switch
+            {
+                OrganizationApiKeyType.Scim => await _currentContext.ManageScim(orgId),
+                _ => await _currentContext.OrganizationOwner(orgId),
+            };
+        }
+
        [HttpGet("{id}/tax")]
        [SelfHosted(NotSelfHostedOnly = true)]
        public async Task<TaxInfoResponseModel> GetTaxInfo(string id)
--- a/src/Api/Models/Response/Organizations/OrganizationResponseModel.cs
+++ b/src/Api/Models/Response/Organizations/OrganizationResponseModel.cs
@ -35,6 +35,7 @@ namespace Bit.Api.Models.Response.Organizations
            UsePolicies = organization.UsePolicies;
            UseSso = organization.UseSso;
            UseKeyConnector = organization.UseKeyConnector;
+            UseScim = organization.UseScim;
            UseGroups = organization.UseGroups;
            UseDirectory = organization.UseDirectory;
            UseEvents = organization.UseEvents;
@ -66,6 +67,7 @@ namespace Bit.Api.Models.Response.Organizations
        public bool UsePolicies { get; set; }
        public bool UseSso { get; set; }
        public bool UseKeyConnector { get; set; }
+        public bool UseScim { get; set; }
        public bool UseGroups { get; set; }
        public bool UseDirectory { get; set; }
        public bool UseEvents { get; set; }
--- a/src/Api/Models/Response/ProfileOrganizationResponseModel.cs
+++ b/src/Api/Models/Response/ProfileOrganizationResponseModel.cs
@ -17,6 +17,7 @@ namespace Bit.Api.Models.Response
            UsePolicies = organization.UsePolicies;
            UseSso = organization.UseSso;
            UseKeyConnector = organization.UseKeyConnector;
+            UseScim = organization.UseScim;
            UseGroups = organization.UseGroups;
            UseDirectory = organization.UseDirectory;
            UseEvents = organization.UseEvents;
@ -63,6 +64,7 @@ namespace Bit.Api.Models.Response
        public bool UsePolicies { get; set; }
        public bool UseSso { get; set; }
        public bool UseKeyConnector { get; set; }
+        public bool UseScim { get; set; }
        public bool UseGroups { get; set; }
        public bool UseDirectory { get; set; }
        public bool UseEvents { get; set; }
--- a/src/Api/Models/Response/ProfileProviderOrganizationResponseModel.cs
+++ b/src/Api/Models/Response/ProfileProviderOrganizationResponseModel.cs
@ -13,6 +13,7 @@ namespace Bit.Api.Models.Response
            UsePolicies = organization.UsePolicies;
            UseSso = organization.UseSso;
            UseKeyConnector = organization.UseKeyConnector;
+            UseScim = organization.UseScim;
            UseGroups = organization.UseGroups;
            UseDirectory = organization.UseDirectory;
            UseEvents = organization.UseEvents;
--- a/src/Api/appsettings.Development.json
+++ b/src/Api/appsettings.Development.json
@ -12,7 +12,8 @@
      "internalIdentity": "http://localhost:33656",
      "internalApi": "http://localhost:4000",
      "internalVault": "https://localhost:8080",
-      "internalSso": "http://localhost:51822"
+      "internalSso": "http://localhost:51822",
+      "internalScim": "http://localhost:44559"
    },
    "mail": {
      "smtp": {
--- a/src/Api/appsettings.Production.json
+++ b/src/Api/appsettings.Production.json
@ -12,7 +12,8 @@
      "internalIdentity": "https://identity.bitwarden.com",
      "internalApi": "https://api.bitwarden.com",
      "internalVault": "https://vault.bitwarden.com",
-      "internalSso": "https://sso.bitwarden.com"
+      "internalSso": "https://sso.bitwarden.com",
+      "internalScim": "https://scim.bitwarden.com"
    },
    "braintree": {
      "production": true
--- a/src/Api/appsettings.QA.json
+++ b/src/Api/appsettings.QA.json
@ -12,7 +12,8 @@
      "internalIdentity": "https://identity.qa.bitwarden.pw",
      "internalApi": "https://api.qa.bitwarden.pw",
      "internalVault": "https://vault.qa.bitwarden.pw",
-      "internalSso": "https://sso.qa.bitwarden.pw"
+      "internalSso": "https://sso.qa.bitwarden.pw",
+      "internalScim": "https://scim.qa.bitwarden.pw"
    },
    "braintree": {
      "production": false
--- a/src/Api/appsettings.SelfHosted.json
+++ b/src/Api/appsettings.SelfHosted.json
@ -12,7 +12,8 @@
      "internalIdentity": null,
      "internalApi": null,
      "internalVault": null,
-      "internalSso": null
+      "internalSso": null,
+      "internalScim": null
    }
  }
 }