Browse Source
Groundwork for SCIM v2 provisioning (RFC 7643/7644), targeting Entra ID: - New scim_api_key table (sqlite/mysql/postgresql migrations) storing a sha256 digest of a per-organization static bearer secret. An active row doubles as per-org SCIM enablement; org deletion cleans it up. - ScimToken request guard modeled on PublicToken: pre-auth rate limiting, scim_enabled gate, token format scim_v1.<org>.<secret>, token-org vs path-org check before any DB work, constant-time digest compare with a dummy compare on miss. All failure causes log server-side and surface as one uniform SCIM-enveloped 401. - SCIM error envelope + catchers so every response under /scim (400/401/ 404/429/500) is application/scim+json. - Discovery endpoints (ServiceProviderConfig, ResourceTypes, Schemas). - Admin-session management endpoints under /api: generate/rotate (plaintext shown once), delete, and status; guarded by AdminHeaders plus password or OTP re-auth, mirroring rotate_api_key. - Config: scim_enabled (default off) and SCIM rate limiter settings. - Test infrastructure: hermetic pre-main env bootstrap (test-support crate, keeps CONFIG away from the developer's .env and data), Rocket local-client harness on temp sqlite, authz matrix asserting byte-identical 401 bodies, rate limiter drain test. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>pull/7443/head
David Croft
4 days ago
25 changed files with 1011 additions and 2 deletions
@ -0,0 +1 @@ |
|||||
|
DROP TABLE scim_api_key; |
||||
@ -0,0 +1,8 @@ |
|||||
|
CREATE TABLE scim_api_key ( |
||||
|
uuid CHAR(36) NOT NULL PRIMARY KEY, |
||||
|
org_uuid CHAR(36) NOT NULL UNIQUE REFERENCES organizations(uuid), |
||||
|
key_hash VARCHAR(255) NOT NULL, |
||||
|
enabled BOOLEAN NOT NULL DEFAULT TRUE, |
||||
|
created_at DATETIME NOT NULL, |
||||
|
revision_date DATETIME NOT NULL |
||||
|
); |
||||
@ -0,0 +1 @@ |
|||||
|
DROP TABLE scim_api_key; |
||||
@ -0,0 +1,8 @@ |
|||||
|
CREATE TABLE scim_api_key ( |
||||
|
uuid CHAR(36) NOT NULL PRIMARY KEY, |
||||
|
org_uuid CHAR(36) NOT NULL UNIQUE REFERENCES organizations(uuid), |
||||
|
key_hash TEXT NOT NULL, |
||||
|
enabled BOOLEAN NOT NULL DEFAULT true, |
||||
|
created_at TIMESTAMP NOT NULL, |
||||
|
revision_date TIMESTAMP NOT NULL |
||||
|
); |
||||
@ -0,0 +1 @@ |
|||||
|
DROP TABLE scim_api_key; |
||||
@ -0,0 +1,9 @@ |
|||||
|
CREATE TABLE scim_api_key ( |
||||
|
uuid TEXT NOT NULL PRIMARY KEY, |
||||
|
org_uuid TEXT NOT NULL UNIQUE, |
||||
|
key_hash TEXT NOT NULL, |
||||
|
enabled BOOLEAN NOT NULL DEFAULT 1, |
||||
|
created_at DATETIME NOT NULL, |
||||
|
revision_date DATETIME NOT NULL, |
||||
|
FOREIGN KEY(org_uuid) REFERENCES organizations(uuid) |
||||
|
); |
||||
@ -0,0 +1,109 @@ |
|||||
|
//
|
||||
|
// SCIM discovery endpoints, RFC 7643 section 5 and RFC 7644 section 4.
|
||||
|
//
|
||||
|
// Static metadata, served behind the ScimToken guard like everything else
|
||||
|
// under /scim. Entra ID does not require these for Test Connection (that only
|
||||
|
// needs a 200 ListResponse on a userName filter), but other SCIM clients read
|
||||
|
// them, and they are cheap.
|
||||
|
//
|
||||
|
use rocket::Route; |
||||
|
use serde_json::Value; |
||||
|
|
||||
|
use crate::{ |
||||
|
CONFIG, |
||||
|
api::scim::{ScimResponse, guard::ScimToken}, |
||||
|
db::models::OrganizationId, |
||||
|
}; |
||||
|
|
||||
|
pub fn routes() -> Vec<Route> { |
||||
|
routes![service_provider_config, resource_types, schemas] |
||||
|
} |
||||
|
|
||||
|
const LIST_RESPONSE_URN: &str = "urn:ietf:params:scim:api:messages:2.0:ListResponse"; |
||||
|
pub const USER_SCHEMA_URN: &str = "urn:ietf:params:scim:schemas:core:2.0:User"; |
||||
|
pub const GROUP_SCHEMA_URN: &str = "urn:ietf:params:scim:schemas:core:2.0:Group"; |
||||
|
|
||||
|
fn scim_base(org_id: &OrganizationId) -> String { |
||||
|
format!("{}/scim/v2/{org_id}", CONFIG.domain()) |
||||
|
} |
||||
|
|
||||
|
fn list_response(resources: &[Value]) -> Value { |
||||
|
json!({ |
||||
|
"schemas": [LIST_RESPONSE_URN], |
||||
|
"totalResults": resources.len(), |
||||
|
"itemsPerPage": resources.len(), |
||||
|
"startIndex": 1, |
||||
|
"Resources": resources, |
||||
|
}) |
||||
|
} |
||||
|
|
||||
|
#[expect(clippy::needless_pass_by_value, reason = "Rocket request guards are taken by value")] |
||||
|
#[get("/v2/<_>/ServiceProviderConfig")] |
||||
|
fn service_provider_config(token: ScimToken) -> ScimResponse { |
||||
|
ScimResponse::ok(json!({ |
||||
|
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"], |
||||
|
"documentationUri": "https://github.com/croftinator/vaultwarden-scim-v2", |
||||
|
"patch": { "supported": true }, |
||||
|
"bulk": { "supported": false, "maxOperations": 0, "maxPayloadSize": 0 }, |
||||
|
"filter": { "supported": true, "maxResults": 200 }, |
||||
|
"changePassword": { "supported": false }, |
||||
|
"sort": { "supported": false }, |
||||
|
"etag": { "supported": false }, |
||||
|
"authenticationSchemes": [{ |
||||
|
"type": "oauthbearertoken", |
||||
|
"name": "OAuth Bearer Token", |
||||
|
"description": "Static bearer token generated per organization", |
||||
|
"primary": true, |
||||
|
}], |
||||
|
"meta": { |
||||
|
"resourceType": "ServiceProviderConfig", |
||||
|
"location": format!("{}/ServiceProviderConfig", scim_base(&token.org_uuid)), |
||||
|
}, |
||||
|
})) |
||||
|
} |
||||
|
|
||||
|
#[expect(clippy::needless_pass_by_value, reason = "Rocket request guards are taken by value")] |
||||
|
#[get("/v2/<_>/ResourceTypes")] |
||||
|
fn resource_types(token: ScimToken) -> ScimResponse { |
||||
|
let base = scim_base(&token.org_uuid); |
||||
|
ScimResponse::ok(list_response(&[ |
||||
|
json!({ |
||||
|
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:ResourceType"], |
||||
|
"id": "User", |
||||
|
"name": "User", |
||||
|
"endpoint": "/Users", |
||||
|
"description": "Organization member", |
||||
|
"schema": USER_SCHEMA_URN, |
||||
|
"meta": { "resourceType": "ResourceType", "location": format!("{base}/ResourceTypes/User") }, |
||||
|
}), |
||||
|
json!({ |
||||
|
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:ResourceType"], |
||||
|
"id": "Group", |
||||
|
"name": "Group", |
||||
|
"endpoint": "/Groups", |
||||
|
"description": "Organization group", |
||||
|
"schema": GROUP_SCHEMA_URN, |
||||
|
"meta": { "resourceType": "ResourceType", "location": format!("{base}/ResourceTypes/Group") }, |
||||
|
}), |
||||
|
])) |
||||
|
} |
||||
|
|
||||
|
#[expect(clippy::needless_pass_by_value, reason = "Rocket request guards are taken by value")] |
||||
|
#[get("/v2/<_>/Schemas")] |
||||
|
fn schemas(token: ScimToken) -> ScimResponse { |
||||
|
let base = scim_base(&token.org_uuid); |
||||
|
ScimResponse::ok(list_response(&[ |
||||
|
json!({ |
||||
|
"id": USER_SCHEMA_URN, |
||||
|
"name": "User", |
||||
|
"description": "SCIM core User. Supported attributes: userName, externalId, name, displayName, emails, active.", |
||||
|
"meta": { "resourceType": "Schema", "location": format!("{base}/Schemas/{USER_SCHEMA_URN}") }, |
||||
|
}), |
||||
|
json!({ |
||||
|
"id": GROUP_SCHEMA_URN, |
||||
|
"name": "Group", |
||||
|
"description": "SCIM core Group. Supported attributes: displayName, externalId, members.", |
||||
|
"meta": { "resourceType": "Schema", "location": format!("{base}/Schemas/{GROUP_SCHEMA_URN}") }, |
||||
|
}), |
||||
|
])) |
||||
|
} |
||||
@ -0,0 +1,93 @@ |
|||||
|
//
|
||||
|
// SCIM error envelope, RFC 7644 section 3.12.
|
||||
|
//
|
||||
|
// Every error leaving the /scim mount must use this shape. Auth failures are
|
||||
|
// deliberately uniform: the guard logs the specific cause server-side and the
|
||||
|
// caller always receives the same 401 body, so responses carry no signal about
|
||||
|
// which check failed.
|
||||
|
//
|
||||
|
use std::io::Cursor; |
||||
|
|
||||
|
use rocket::{ |
||||
|
http::{ContentType, Status}, |
||||
|
request::Request, |
||||
|
response::{self, Responder, Response}, |
||||
|
}; |
||||
|
|
||||
|
pub const SCIM_ERROR_URN: &str = "urn:ietf:params:scim:api:messages:2.0:Error"; |
||||
|
|
||||
|
#[derive(Debug)] |
||||
|
pub struct ScimError { |
||||
|
pub status: Status, |
||||
|
pub scim_type: Option<&'static str>, |
||||
|
pub detail: String, |
||||
|
} |
||||
|
|
||||
|
impl ScimError { |
||||
|
pub fn unauthorized() -> Self { |
||||
|
Self { |
||||
|
status: Status::Unauthorized, |
||||
|
scim_type: None, |
||||
|
detail: String::from("Unauthorized"), |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
pub fn too_many_requests() -> Self { |
||||
|
Self { |
||||
|
status: Status::TooManyRequests, |
||||
|
scim_type: None, |
||||
|
detail: String::from("Too many requests"), |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
pub fn not_found() -> Self { |
||||
|
Self { |
||||
|
status: Status::NotFound, |
||||
|
scim_type: None, |
||||
|
detail: String::from("Resource not found"), |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
pub fn bad_request(scim_type: &'static str, detail: &str) -> Self { |
||||
|
Self { |
||||
|
status: Status::BadRequest, |
||||
|
scim_type: Some(scim_type), |
||||
|
detail: String::from(detail), |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
pub fn internal() -> Self { |
||||
|
Self { |
||||
|
status: Status::InternalServerError, |
||||
|
scim_type: None, |
||||
|
detail: String::from("Internal server error"), |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
fn body(&self) -> String { |
||||
|
let mut body = json!({ |
||||
|
"schemas": [SCIM_ERROR_URN], |
||||
|
"status": self.status.code.to_string(), |
||||
|
"detail": self.detail, |
||||
|
}); |
||||
|
if let Some(scim_type) = self.scim_type { |
||||
|
body["scimType"] = json!(scim_type); |
||||
|
} |
||||
|
body.to_string() |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
pub fn scim_content_type() -> ContentType { |
||||
|
ContentType::new("application", "scim+json") |
||||
|
} |
||||
|
|
||||
|
impl Responder<'_, 'static> for ScimError { |
||||
|
fn respond_to(self, _: &Request<'_>) -> response::Result<'static> { |
||||
|
let body = self.body(); |
||||
|
Response::build() |
||||
|
.status(self.status) |
||||
|
.header(scim_content_type()) |
||||
|
.sized_body(Some(body.len()), Cursor::new(body)) |
||||
|
.ok() |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,142 @@ |
|||||
|
//
|
||||
|
// Request guard for the /scim/v2/<org_id> endpoints.
|
||||
|
//
|
||||
|
// The credential is a per-organization static bearer token of the form
|
||||
|
// scim_v1.<org_uuid>.<secret>
|
||||
|
// as configured in the IdP (Entra ID sends a static "Secret Token"; it cannot
|
||||
|
// drive an OAuth flow, which rules out the short-lived organization api-key
|
||||
|
// JWT used by /api/public). Only the sha256 digest of the secret is stored.
|
||||
|
//
|
||||
|
// Failure behaviour: every rejection logs its specific cause via err_handler!
|
||||
|
// (target "auth", server log only) and surfaces to the caller as a bare 401
|
||||
|
// that the scim catcher turns into one fixed SCIM error body. Rate limiting
|
||||
|
// runs before any parsing so unauthenticated floods are cut off first.
|
||||
|
//
|
||||
|
use rocket::{ |
||||
|
Request, |
||||
|
http::Status, |
||||
|
request::{FromRequest, Outcome}, |
||||
|
}; |
||||
|
|
||||
|
use crate::{ |
||||
|
CONFIG, |
||||
|
auth::ClientIp, |
||||
|
db::{ |
||||
|
DbConn, |
||||
|
models::{OrganizationId, ScimApiKey}, |
||||
|
}, |
||||
|
ratelimit, |
||||
|
}; |
||||
|
|
||||
|
// Digest compared when no key row exists, so a miss costs the same ct_eq as a
|
||||
|
// hit. The DB lookup itself still dominates timing; this is hygiene, not a
|
||||
|
// timing-safety guarantee.
|
||||
|
const DUMMY_DIGEST: &str = "0000000000000000000000000000000000000000000000000000000000000000"; |
||||
|
|
||||
|
// Handlers must scope every query to token.org_uuid, never to a path or body
|
||||
|
// value.
|
||||
|
pub struct ScimToken { |
||||
|
pub org_uuid: OrganizationId, |
||||
|
} |
||||
|
|
||||
|
impl ScimToken { |
||||
|
// Splits "scim_v1.<org_uuid>.<secret>" into (org_uuid, secret).
|
||||
|
fn parse_token(token: &str) -> Option<(&str, &str)> { |
||||
|
let rest = token.strip_prefix("scim_v1.")?; |
||||
|
let (org_uuid, secret) = rest.split_once('.')?; |
||||
|
if org_uuid.is_empty() || secret.is_empty() { |
||||
|
return None; |
||||
|
} |
||||
|
Some((org_uuid, secret)) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
#[rocket::async_trait] |
||||
|
impl<'r> FromRequest<'r> for ScimToken { |
||||
|
type Error = &'static str; |
||||
|
|
||||
|
async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> { |
||||
|
let Outcome::Success(ip) = ClientIp::from_request(request).await else { |
||||
|
err_handler!("Error getting Client IP") |
||||
|
}; |
||||
|
|
||||
|
// Rate limit before any parsing or database work.
|
||||
|
if ratelimit::check_limit_scim(&ip.ip).is_err() { |
||||
|
warn!(target: "auth", "SCIM rate limit exceeded. IP: {}", ip.ip); |
||||
|
return Outcome::Error((Status::TooManyRequests, "Too many requests")); |
||||
|
} |
||||
|
|
||||
|
if !CONFIG.scim_enabled() { |
||||
|
err_handler!("SCIM is disabled") |
||||
|
} |
||||
|
|
||||
|
let Some(auth_header) = request.headers().get_one("Authorization") else { |
||||
|
err_handler!("No access token provided") |
||||
|
}; |
||||
|
let Some(bearer) = auth_header.strip_prefix("Bearer ") else { |
||||
|
err_handler!("No access token provided") |
||||
|
}; |
||||
|
|
||||
|
let Some((token_org, secret)) = Self::parse_token(bearer) else { |
||||
|
err_handler!("Malformed SCIM token") |
||||
|
}; |
||||
|
|
||||
|
// The org embedded in the token must match the org in the request
|
||||
|
// path, before any database work. Route shape is /v2/<org_id>/...,
|
||||
|
// so the org id is path parameter index 1.
|
||||
|
let Some(Ok(path_org)) = request.param::<OrganizationId>(1) else { |
||||
|
err_handler!("Missing org_id in path") |
||||
|
}; |
||||
|
if token_org != &*path_org { |
||||
|
err_handler!("SCIM token does not match the requested organization", format!("IP: {}", ip.ip)) |
||||
|
} |
||||
|
|
||||
|
let Outcome::Success(conn) = DbConn::from_request(request).await else { |
||||
|
err_handler!("Error getting DB") |
||||
|
}; |
||||
|
|
||||
|
let org_uuid: OrganizationId = token_org.to_owned().into(); |
||||
|
let Some(scim_key) = ScimApiKey::find_active_by_org(&org_uuid, &conn).await else { |
||||
|
// Burn an equivalent comparison so a missing key row does not
|
||||
|
// return faster than a wrong secret.
|
||||
|
let _ = crate::crypto::ct_eq(DUMMY_DIGEST, crate::crypto::sha256_hex(secret.as_bytes())); |
||||
|
err_handler!("No active SCIM api key for organization", format!("IP: {}. Organization: {org_uuid}", ip.ip)) |
||||
|
}; |
||||
|
if !scim_key.check_valid_secret(secret) { |
||||
|
err_handler!("Invalid SCIM token secret", format!("IP: {}. Organization: {org_uuid}", ip.ip)) |
||||
|
} |
||||
|
|
||||
|
Outcome::Success(ScimToken { |
||||
|
org_uuid, |
||||
|
}) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
#[cfg(test)] |
||||
|
mod tests { |
||||
|
use super::*; |
||||
|
|
||||
|
#[test] |
||||
|
fn parse_token_valid() { |
||||
|
let parsed = ScimToken::parse_token("scim_v1.11111111-2222-3333-4444-555555555555.some-secret-value"); |
||||
|
assert_eq!(parsed, Some(("11111111-2222-3333-4444-555555555555", "some-secret-value"))); |
||||
|
} |
||||
|
|
||||
|
#[test] |
||||
|
fn parse_token_secret_may_contain_dots() { |
||||
|
// Only the first dot after the org uuid separates; the secret keeps the rest.
|
||||
|
let parsed = ScimToken::parse_token("scim_v1.org-uuid.part1.part2"); |
||||
|
assert_eq!(parsed, Some(("org-uuid", "part1.part2"))); |
||||
|
} |
||||
|
|
||||
|
#[test] |
||||
|
fn parse_token_rejects_bad_shapes() { |
||||
|
assert_eq!(ScimToken::parse_token(""), None); |
||||
|
assert_eq!(ScimToken::parse_token("scim_v1."), None); |
||||
|
assert_eq!(ScimToken::parse_token("scim_v1.orgonly"), None); |
||||
|
assert_eq!(ScimToken::parse_token("scim_v1..secret"), None); |
||||
|
assert_eq!(ScimToken::parse_token("scim_v1.org."), None); |
||||
|
assert_eq!(ScimToken::parse_token("scim_v2.org.secret"), None); |
||||
|
assert_eq!(ScimToken::parse_token("Bearer scim_v1.org.secret"), None); |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,95 @@ |
|||||
|
//
|
||||
|
// Management endpoints for the per-organization SCIM api key. These live
|
||||
|
// under /api (not /scim) and require an interactive admin session plus
|
||||
|
// password or OTP re-authentication, mirroring the existing organization
|
||||
|
// api-key rotation endpoints.
|
||||
|
//
|
||||
|
// The plaintext token is returned exactly once, from the generate/rotate
|
||||
|
// call. Only its sha256 digest is stored.
|
||||
|
//
|
||||
|
use rocket::{Route, serde::json::Json}; |
||||
|
|
||||
|
use crate::{ |
||||
|
CONFIG, |
||||
|
api::{EmptyResult, JsonResult, PasswordOrOtpData}, |
||||
|
auth::AdminHeaders, |
||||
|
crypto, |
||||
|
db::{ |
||||
|
DbConn, |
||||
|
models::{OrganizationId, ScimApiKey}, |
||||
|
}, |
||||
|
util::format_date, |
||||
|
}; |
||||
|
|
||||
|
pub fn routes() -> Vec<Route> { |
||||
|
routes![generate_scim_key, delete_scim_key, scim_status] |
||||
|
} |
||||
|
|
||||
|
fn check_scim_enabled() -> EmptyResult { |
||||
|
if !CONFIG.scim_enabled() { |
||||
|
err!("SCIM support is disabled") |
||||
|
} |
||||
|
Ok(()) |
||||
|
} |
||||
|
|
||||
|
#[post("/organizations/<org_id>/scim/api-key", data = "<data>")] |
||||
|
async fn generate_scim_key( |
||||
|
org_id: OrganizationId, |
||||
|
data: Json<PasswordOrOtpData>, |
||||
|
headers: AdminHeaders, |
||||
|
conn: DbConn, |
||||
|
) -> JsonResult { |
||||
|
if org_id != headers.org_id { |
||||
|
err!("Organization not found", "Organization id's do not match"); |
||||
|
} |
||||
|
check_scim_enabled()?; |
||||
|
data.into_inner().validate(&headers.user, true, &conn).await?; |
||||
|
|
||||
|
// 256-bit secret; the stored digest can only be brute-forced, not inverted.
|
||||
|
let secret = crypto::encode_random_bytes::<32>(&data_encoding::BASE64URL_NOPAD); |
||||
|
let key_hash = crypto::sha256_hex(secret.as_bytes()); |
||||
|
|
||||
|
// Rotation is replacement: any previous key stops working immediately.
|
||||
|
ScimApiKey::delete_all_by_organization(&org_id, &conn).await?; |
||||
|
let scim_key = ScimApiKey::new(org_id.clone(), key_hash); |
||||
|
scim_key.save(&conn).await?; |
||||
|
|
||||
|
Ok(Json(json!({ |
||||
|
"object": "scim-api-key", |
||||
|
"token": format!("scim_v1.{org_id}.{secret}"), |
||||
|
"scimBaseUrl": format!("{}/scim/v2/{org_id}", CONFIG.domain()), |
||||
|
"revisionDate": format_date(&scim_key.revision_date), |
||||
|
}))) |
||||
|
} |
||||
|
|
||||
|
#[delete("/organizations/<org_id>/scim/api-key", data = "<data>")] |
||||
|
async fn delete_scim_key( |
||||
|
org_id: OrganizationId, |
||||
|
data: Json<PasswordOrOtpData>, |
||||
|
headers: AdminHeaders, |
||||
|
conn: DbConn, |
||||
|
) -> EmptyResult { |
||||
|
if org_id != headers.org_id { |
||||
|
err!("Organization not found", "Organization id's do not match"); |
||||
|
} |
||||
|
data.into_inner().validate(&headers.user, true, &conn).await?; |
||||
|
|
||||
|
ScimApiKey::delete_all_by_organization(&org_id, &conn).await |
||||
|
} |
||||
|
|
||||
|
#[get("/organizations/<org_id>/scim/status")] |
||||
|
async fn scim_status(org_id: OrganizationId, headers: AdminHeaders, conn: DbConn) -> JsonResult { |
||||
|
if org_id != headers.org_id { |
||||
|
err!("Organization not found", "Organization id's do not match"); |
||||
|
} |
||||
|
|
||||
|
let scim_key = ScimApiKey::find_by_org(&org_id, &conn).await; |
||||
|
Ok(Json(json!({ |
||||
|
"object": "scim-status", |
||||
|
"scimEnabled": CONFIG.scim_enabled(), |
||||
|
"keyConfigured": scim_key.is_some(), |
||||
|
"keyEnabled": scim_key.as_ref().is_some_and(|k| k.enabled), |
||||
|
"createdAt": scim_key.as_ref().map(|k| format_date(&k.created_at)), |
||||
|
"revisionDate": scim_key.as_ref().map(|k| format_date(&k.revision_date)), |
||||
|
}))) |
||||
|
} |
||||
@ -0,0 +1,90 @@ |
|||||
|
//
|
||||
|
// SCIM v2 provisioning endpoints (RFC 7643 / RFC 7644), Entra ID first.
|
||||
|
//
|
||||
|
// Mounted at /scim (see main.rs). Authentication is the per-organization
|
||||
|
// static bearer token checked by guard::ScimToken. Management of that token
|
||||
|
// is an admin-session concern and lives under /api via manage::routes().
|
||||
|
//
|
||||
|
pub mod guard; |
||||
|
|
||||
|
mod discovery; |
||||
|
mod error; |
||||
|
mod manage; |
||||
|
|
||||
|
use std::io::Cursor; |
||||
|
|
||||
|
use rocket::{ |
||||
|
Catcher, Route, |
||||
|
http::Status, |
||||
|
request::Request, |
||||
|
response::{self, Responder, Response}, |
||||
|
}; |
||||
|
use serde_json::Value; |
||||
|
|
||||
|
pub use error::ScimError; |
||||
|
pub use manage::routes as manage_routes; |
||||
|
|
||||
|
pub fn routes() -> Vec<Route> { |
||||
|
discovery::routes() |
||||
|
} |
||||
|
|
||||
|
// A JSON body with Content-Type application/scim+json, RFC 7644 section 3.1.
|
||||
|
pub struct ScimResponse { |
||||
|
status: Status, |
||||
|
body: Value, |
||||
|
} |
||||
|
|
||||
|
impl ScimResponse { |
||||
|
pub fn ok(body: Value) -> Self { |
||||
|
Self { |
||||
|
status: Status::Ok, |
||||
|
body, |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
impl Responder<'_, 'static> for ScimResponse { |
||||
|
fn respond_to(self, _: &Request<'_>) -> response::Result<'static> { |
||||
|
let body = self.body.to_string(); |
||||
|
Response::build() |
||||
|
.status(self.status) |
||||
|
.header(error::scim_content_type()) |
||||
|
.sized_body(Some(body.len()), Cursor::new(body)) |
||||
|
.ok() |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// Catchers keep every error under /scim inside the SCIM envelope, including
|
||||
|
// guard rejections (which carry only a status). The 401 body is a constant:
|
||||
|
// all auth failure causes look identical to the caller.
|
||||
|
pub fn catchers() -> Vec<Catcher> { |
||||
|
catchers![scim_bad_request, scim_unauthorized, scim_not_found, scim_too_many_requests, scim_internal] |
||||
|
} |
||||
|
|
||||
|
#[catch(400)] |
||||
|
fn scim_bad_request() -> ScimError { |
||||
|
ScimError::bad_request("invalidValue", "Bad request") |
||||
|
} |
||||
|
|
||||
|
#[catch(401)] |
||||
|
fn scim_unauthorized() -> ScimError { |
||||
|
ScimError::unauthorized() |
||||
|
} |
||||
|
|
||||
|
#[catch(404)] |
||||
|
fn scim_not_found() -> ScimError { |
||||
|
ScimError::not_found() |
||||
|
} |
||||
|
|
||||
|
#[catch(429)] |
||||
|
fn scim_too_many_requests() -> ScimError { |
||||
|
ScimError::too_many_requests() |
||||
|
} |
||||
|
|
||||
|
#[catch(500)] |
||||
|
fn scim_internal() -> ScimError { |
||||
|
ScimError::internal() |
||||
|
} |
||||
|
|
||||
|
#[cfg(all(test, sqlite))] |
||||
|
mod tests; |
||||
@ -0,0 +1,192 @@ |
|||||
|
//
|
||||
|
// Integration tests for the SCIM endpoints, driven through a Rocket local
|
||||
|
// client against a temporary sqlite database.
|
||||
|
//
|
||||
|
// Environment: a #[ctor] constructor calls test_support::init_hermetic_env()
|
||||
|
// BEFORE main and before any test thread starts. CONFIG is a process-global
|
||||
|
// LazyLock that reads the environment on first deref, so this is the only
|
||||
|
// point where its inputs can be controlled race-free. The main crate forbids
|
||||
|
// unsafe code, which is why the env mutation lives in the test-support crate.
|
||||
|
//
|
||||
|
// Tests that build a rocket + database serialize on TEST_LOCK: the sqlite
|
||||
|
// file and the CONFIG global are shared process state.
|
||||
|
//
|
||||
|
use std::sync::LazyLock; |
||||
|
|
||||
|
use rocket::{ |
||||
|
http::{Header, Status}, |
||||
|
local::asynchronous::{Client, LocalResponse}, |
||||
|
}; |
||||
|
|
||||
|
use crate::{ |
||||
|
api::scim, |
||||
|
crypto, |
||||
|
db::{ |
||||
|
DbConn, DbPool, |
||||
|
models::{Organization, OrganizationId, ScimApiKey}, |
||||
|
}, |
||||
|
}; |
||||
|
|
||||
|
// Linking test-support activates its #[ctor] constructor, which points CONFIG
|
||||
|
// at a hermetic temp environment before main. See test-support/src/lib.rs.
|
||||
|
use test_support as _; |
||||
|
|
||||
|
static TEST_LOCK: LazyLock<tokio::sync::Mutex<()>> = LazyLock::new(|| tokio::sync::Mutex::new(())); |
||||
|
|
||||
|
const SCIM_CONTENT_TYPE: &str = "application/scim+json"; |
||||
|
|
||||
|
// One pool for the whole test process: it is never dropped, so no test can
|
||||
|
// hit "database is locked" from a previous test's lazily-dropped connections,
|
||||
|
// and the embedded migrations run exactly once.
|
||||
|
fn test_pool() -> &'static DbPool { |
||||
|
static POOL: std::sync::OnceLock<DbPool> = std::sync::OnceLock::new(); |
||||
|
POOL.get_or_init(|| { |
||||
|
// main() installs the rustls provider at startup; the test binary
|
||||
|
// never runs main, and the CONFIG load path builds an http client
|
||||
|
// that needs it.
|
||||
|
rustls::crypto::ring::default_provider().install_default().expect("install rustls crypto provider"); |
||||
|
DbPool::from_config().expect("test db pool (migrations embedded)") |
||||
|
}) |
||||
|
} |
||||
|
|
||||
|
async fn scim_client() -> (Client, DbPool) { |
||||
|
let pool = test_pool().clone(); |
||||
|
let rocket = rocket::custom(rocket::Config::default()) |
||||
|
.mount("/scim", scim::routes()) |
||||
|
.register("/scim", scim::catchers()) |
||||
|
.manage(pool.clone()); |
||||
|
let client = Client::untracked(rocket).await.expect("local rocket client"); |
||||
|
(client, pool) |
||||
|
} |
||||
|
|
||||
|
async fn seed_org(conn: &DbConn, name: &str) -> OrganizationId { |
||||
|
let org = Organization::new(String::from(name), "admin@example.com", None, None); |
||||
|
org.save(conn).await.expect("saving test org"); |
||||
|
org.uuid |
||||
|
} |
||||
|
|
||||
|
// Mirrors manage::generate_scim_key and returns the full bearer token.
|
||||
|
async fn seed_scim_key(conn: &DbConn, org_uuid: &OrganizationId) -> String { |
||||
|
let secret = crypto::encode_random_bytes::<32>(&data_encoding::BASE64URL_NOPAD); |
||||
|
let key_hash = crypto::sha256_hex(secret.as_bytes()); |
||||
|
ScimApiKey::new(org_uuid.clone(), key_hash).save(conn).await.expect("saving scim key"); |
||||
|
format!("scim_v1.{org_uuid}.{secret}") |
||||
|
} |
||||
|
|
||||
|
fn bearer(token: &str) -> Header<'static> { |
||||
|
Header::new("Authorization", format!("Bearer {token}")) |
||||
|
} |
||||
|
|
||||
|
async fn body_of(response: LocalResponse<'_>) -> String { |
||||
|
response.into_string().await.expect("response body") |
||||
|
} |
||||
|
|
||||
|
#[rocket::async_test] |
||||
|
async fn valid_token_reaches_discovery() { |
||||
|
let _guard = TEST_LOCK.lock().await; |
||||
|
let (client, pool) = scim_client().await; |
||||
|
let conn = pool.get().await.expect("conn"); |
||||
|
let org = seed_org(&conn, "scim-authz-ok").await; |
||||
|
let token = seed_scim_key(&conn, &org).await; |
||||
|
|
||||
|
let response = client.get(format!("/scim/v2/{org}/ServiceProviderConfig")).header(bearer(&token)).dispatch().await; |
||||
|
assert_eq!(response.status(), Status::Ok); |
||||
|
let content_type = response.headers().get_one("Content-Type").expect("content type"); |
||||
|
assert!(content_type.starts_with(SCIM_CONTENT_TYPE), "unexpected content type {content_type}"); |
||||
|
let body = body_of(response).await; |
||||
|
assert!(body.contains("urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig")); |
||||
|
|
||||
|
let response = client.get(format!("/scim/v2/{org}/ResourceTypes")).header(bearer(&token)).dispatch().await; |
||||
|
assert_eq!(response.status(), Status::Ok); |
||||
|
let body = body_of(response).await; |
||||
|
assert!(body.contains("urn:ietf:params:scim:api:messages:2.0:ListResponse")); |
||||
|
assert!(body.contains("\"endpoint\":\"/Users\"")); |
||||
|
|
||||
|
let response = client.get(format!("/scim/v2/{org}/Schemas")).header(bearer(&token)).dispatch().await; |
||||
|
assert_eq!(response.status(), Status::Ok); |
||||
|
} |
||||
|
|
||||
|
#[rocket::async_test] |
||||
|
async fn auth_failures_are_uniform_401s() { |
||||
|
let _guard = TEST_LOCK.lock().await; |
||||
|
let (client, pool) = scim_client().await; |
||||
|
let conn = pool.get().await.expect("conn"); |
||||
|
|
||||
|
let org_a = seed_org(&conn, "scim-authz-a").await; |
||||
|
let token_a = seed_scim_key(&conn, &org_a).await; |
||||
|
let org_b = seed_org(&conn, "scim-authz-b").await; |
||||
|
let _token_b = seed_scim_key(&conn, &org_b).await; |
||||
|
// An org that exists but has no SCIM key configured.
|
||||
|
let org_c = seed_org(&conn, "scim-authz-c").await; |
||||
|
|
||||
|
let url_a = format!("/scim/v2/{org_a}/ServiceProviderConfig"); |
||||
|
|
||||
|
let mut failures: Vec<(&str, LocalResponse<'_>)> = Vec::new(); |
||||
|
failures.push(("no auth header", client.get(&url_a).dispatch().await)); |
||||
|
failures |
||||
|
.push(("not a bearer", client.get(&url_a).header(Header::new("Authorization", "Basic abc")).dispatch().await)); |
||||
|
failures.push(("malformed token", client.get(&url_a).header(bearer("garbage")).dispatch().await)); |
||||
|
failures.push(( |
||||
|
"wrong version prefix", |
||||
|
client.get(&url_a).header(bearer(&format!("scim_v0.{org_a}.x"))).dispatch().await, |
||||
|
)); |
||||
|
failures.push(( |
||||
|
"wrong secret", |
||||
|
client.get(&url_a).header(bearer(&format!("scim_v1.{org_a}.bm90LXRoZS1zZWNyZXQ"))).dispatch().await, |
||||
|
)); |
||||
|
failures.push(( |
||||
|
"token org != path org", |
||||
|
client.get(format!("/scim/v2/{org_b}/ServiceProviderConfig")).header(bearer(&token_a)).dispatch().await, |
||||
|
)); |
||||
|
failures.push(( |
||||
|
"org without key", |
||||
|
client |
||||
|
.get(format!("/scim/v2/{org_c}/ServiceProviderConfig")) |
||||
|
.header(bearer(&format!("scim_v1.{org_c}.c2VjcmV0"))) |
||||
|
.dispatch() |
||||
|
.await, |
||||
|
)); |
||||
|
|
||||
|
let mut bodies = Vec::new(); |
||||
|
for (case, response) in failures { |
||||
|
assert_eq!(response.status(), Status::Unauthorized, "expected 401 for case: {case}"); |
||||
|
bodies.push((case, body_of(response).await)); |
||||
|
} |
||||
|
|
||||
|
// Every failure cause must produce a byte-identical body: no signal about
|
||||
|
// which check rejected the request.
|
||||
|
let (_, first) = &bodies[0]; |
||||
|
for (case, body) in &bodies { |
||||
|
assert_eq!(body, first, "401 body differs for case: {case}"); |
||||
|
} |
||||
|
assert!(first.contains("urn:ietf:params:scim:api:messages:2.0:Error")); |
||||
|
assert!(first.contains("\"status\":\"401\"")); |
||||
|
} |
||||
|
|
||||
|
#[rocket::async_test] |
||||
|
async fn unknown_scim_route_is_scim_enveloped_404() { |
||||
|
let _guard = TEST_LOCK.lock().await; |
||||
|
let (client, _pool) = scim_client().await; |
||||
|
|
||||
|
let response = client.get("/scim/v2/some-org/Nope").dispatch().await; |
||||
|
assert_eq!(response.status(), Status::NotFound); |
||||
|
let body = body_of(response).await; |
||||
|
assert!(body.contains("urn:ietf:params:scim:api:messages:2.0:Error")); |
||||
|
assert!(body.contains("\"status\":\"404\"")); |
||||
|
} |
||||
|
|
||||
|
#[test] |
||||
|
fn rate_limiter_returns_429_when_drained() { |
||||
|
// Uses a synthetic IP so draining this bucket cannot affect the shared
|
||||
|
// bucket the HTTP tests consume from (the limiter is keyed by IP).
|
||||
|
let ip: std::net::IpAddr = "10.99.99.99".parse().expect("test ip"); |
||||
|
let burst = crate::CONFIG.scim_ratelimit_max_burst(); |
||||
|
let mut limited = false; |
||||
|
for _ in 0..=burst { |
||||
|
if crate::ratelimit::check_limit_scim(&ip).is_err() { |
||||
|
limited = true; |
||||
|
break; |
||||
|
} |
||||
|
} |
||||
|
assert!(limited, "limiter never tripped after {burst} + 1 requests"); |
||||
|
} |
||||
@ -0,0 +1,105 @@ |
|||||
|
use chrono::{NaiveDateTime, Utc}; |
||||
|
use derive_more::Display; |
||||
|
use diesel::prelude::*; |
||||
|
|
||||
|
use crate::{ |
||||
|
api::EmptyResult, |
||||
|
crypto, |
||||
|
db::{DbConn, models::OrganizationId, schema::scim_api_key}, |
||||
|
error::MapResult, |
||||
|
}; |
||||
|
|
||||
|
#[derive(Identifiable, Queryable, Insertable, AsChangeset)] |
||||
|
#[diesel(table_name = scim_api_key)] |
||||
|
#[diesel(primary_key(uuid))] |
||||
|
pub struct ScimApiKey { |
||||
|
pub uuid: ScimApiKeyId, |
||||
|
pub org_uuid: OrganizationId, |
||||
|
// sha256 hex digest of the token secret. The plaintext secret is shown once
|
||||
|
// at generation time and never stored or logged.
|
||||
|
pub key_hash: String, |
||||
|
pub enabled: bool, |
||||
|
pub created_at: NaiveDateTime, |
||||
|
pub revision_date: NaiveDateTime, |
||||
|
} |
||||
|
|
||||
|
#[derive(Clone, Debug, DieselNewType, Display, Hash, PartialEq, Eq, Serialize, Deserialize)] |
||||
|
pub struct ScimApiKeyId(String); |
||||
|
|
||||
|
impl ScimApiKey { |
||||
|
pub fn new(org_uuid: OrganizationId, key_hash: String) -> Self { |
||||
|
let now = Utc::now().naive_utc(); |
||||
|
Self { |
||||
|
uuid: ScimApiKeyId(crate::util::get_uuid()), |
||||
|
org_uuid, |
||||
|
key_hash, |
||||
|
enabled: true, |
||||
|
created_at: now, |
||||
|
revision_date: now, |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// Constant-time comparison against a plaintext secret's digest. A dummy
|
||||
|
// digest is compared when no key row exists so the caller can keep the
|
||||
|
// verification cost independent of row presence.
|
||||
|
pub fn check_valid_secret(&self, secret: &str) -> bool { |
||||
|
crypto::ct_eq(&self.key_hash, crypto::sha256_hex(secret.as_bytes())) |
||||
|
} |
||||
|
|
||||
|
pub async fn save(&self, conn: &DbConn) -> EmptyResult { |
||||
|
// Rotation replaces the row wholesale (delete + insert), so a plain
|
||||
|
// insert with an update fallback covers every backend identically.
|
||||
|
db_run! { conn: |
||||
|
sqlite, mysql { |
||||
|
match diesel::replace_into(scim_api_key::table) |
||||
|
.values(self) |
||||
|
.execute(conn) |
||||
|
{ |
||||
|
Ok(_) => Ok(()), |
||||
|
Err(diesel::result::Error::DatabaseError(diesel::result::DatabaseErrorKind::ForeignKeyViolation, _)) => { |
||||
|
diesel::update(scim_api_key::table) |
||||
|
.filter(scim_api_key::uuid.eq(&self.uuid)) |
||||
|
.set(self) |
||||
|
.execute(conn) |
||||
|
.map_res("Error saving SCIM api key") |
||||
|
} |
||||
|
Err(e) => Err(e.into()), |
||||
|
}.map_res("Error saving SCIM api key") |
||||
|
} |
||||
|
postgresql { |
||||
|
diesel::insert_into(scim_api_key::table) |
||||
|
.values(self) |
||||
|
.on_conflict(scim_api_key::uuid) |
||||
|
.do_update() |
||||
|
.set(self) |
||||
|
.execute(conn) |
||||
|
.map_res("Error saving SCIM api key") |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
pub async fn find_by_org(org_uuid: &OrganizationId, conn: &DbConn) -> Option<Self> { |
||||
|
conn.run(move |conn| scim_api_key::table.filter(scim_api_key::org_uuid.eq(org_uuid)).first::<Self>(conn).ok()) |
||||
|
.await |
||||
|
} |
||||
|
|
||||
|
pub async fn find_active_by_org(org_uuid: &OrganizationId, conn: &DbConn) -> Option<Self> { |
||||
|
conn.run(move |conn| { |
||||
|
scim_api_key::table |
||||
|
.filter(scim_api_key::org_uuid.eq(org_uuid)) |
||||
|
.filter(scim_api_key::enabled.eq(true)) |
||||
|
.first::<Self>(conn) |
||||
|
.ok() |
||||
|
}) |
||||
|
.await |
||||
|
} |
||||
|
|
||||
|
pub async fn delete_all_by_organization(org_uuid: &OrganizationId, conn: &DbConn) -> EmptyResult { |
||||
|
conn.run(move |conn| { |
||||
|
diesel::delete(scim_api_key::table.filter(scim_api_key::org_uuid.eq(org_uuid))) |
||||
|
.execute(conn) |
||||
|
.map_res("Error removing SCIM api key from organization") |
||||
|
}) |
||||
|
.await |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,10 @@ |
|||||
|
[package] |
||||
|
name = "test-support" |
||||
|
version = "0.1.0" |
||||
|
edition.workspace = true |
||||
|
rust-version.workspace = true |
||||
|
license.workspace = true |
||||
|
publish = false |
||||
|
|
||||
|
[dependencies] |
||||
|
ctor = "1.0.9" |
||||
@ -0,0 +1,67 @@ |
|||||
|
//! Test-only environment bootstrap.
|
||||
|
//!
|
||||
|
//! The main crate forbids `unsafe`, and `std::env::set_var` is `unsafe` on
|
||||
|
//! edition 2024, so the mutation lives here. The `#[ctor]` constructor runs
|
||||
|
//! before `main` and before any test thread exists, which is the only point
|
||||
|
//! where the process environment can be changed race-free and the only point
|
||||
|
//! early enough to beat the first deref of Vaultwarden's process-global
|
||||
|
//! `CONFIG` (a `LazyLock` that reads the environment).
|
||||
|
//!
|
||||
|
//! Linkage is intentional: this crate only takes effect in test binaries that
|
||||
|
//! reference it (`use test_support as _;`). Feature combos that do not compile
|
||||
|
//! those test modules never link it and keep upstream behaviour.
|
||||
|
|
||||
|
/// Points every config-relevant environment variable at a per-process
|
||||
|
/// temporary directory and enables the flags the SCIM test suite needs.
|
||||
|
///
|
||||
|
/// `DATABASE_URL` is deliberately left unset: Vaultwarden derives it as
|
||||
|
/// `sqlite://{DATA_FOLDER}/db.sqlite3`, which lands inside the hermetic
|
||||
|
/// directory, and hardcoding a sqlite URL here would poison config validation
|
||||
|
/// for mysql/postgresql-only feature combos.
|
||||
|
pub fn init_hermetic_env() { |
||||
|
let base = std::env::temp_dir().join(format!("vaultwarden-test-{}", std::process::id())); |
||||
|
let data = base.join("data"); |
||||
|
std::fs::create_dir_all(&data).expect("creating hermetic test data dir"); |
||||
|
|
||||
|
// An empty env file: a configured-but-missing ENV_FILE makes Vaultwarden
|
||||
|
// exit at config load, and an unset one falls back to the repo's dev .env.
|
||||
|
let env_file = base.join("test.env"); |
||||
|
std::fs::write(&env_file, "").expect("creating hermetic test env file"); |
||||
|
|
||||
|
let vars: &[(&str, String)] = &[ |
||||
|
("ENV_FILE", env_file.to_string_lossy().into_owned()), |
||||
|
("DATA_FOLDER", data.to_string_lossy().into_owned()), |
||||
|
("DOMAIN", String::from("http://localhost:8000")), |
||||
|
("WEB_VAULT_ENABLED", String::from("false")), |
||||
|
("SIGNUPS_ALLOWED", String::from("true")), |
||||
|
("INVITATIONS_ALLOWED", String::from("true")), |
||||
|
("ORG_GROUPS_ENABLED", String::from("true")), |
||||
|
("SCIM_ENABLED", String::from("true")), |
||||
|
("SCIM_RATELIMIT_SECONDS", String::from("1")), |
||||
|
// High burst so the shared per-IP limiter never trips ordinary tests;
|
||||
|
// the 429 path is exercised against a distinct synthetic IP.
|
||||
|
("SCIM_RATELIMIT_MAX_BURST", String::from("10000")), |
||||
|
]; |
||||
|
|
||||
|
for (key, value) in vars { |
||||
|
// SAFETY: runs pre-main via #[ctor]; the process is single-threaded,
|
||||
|
// so mutating the environment cannot race with any reader.
|
||||
|
unsafe { |
||||
|
std::env::set_var(key, value); |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// Make sure a developer shell exporting SMTP settings cannot leak mail
|
||||
|
// sending into tests.
|
||||
|
for key in ["SMTP_HOST", "SMTP_FROM", "USE_SENDMAIL"] { |
||||
|
// SAFETY: as above.
|
||||
|
unsafe { |
||||
|
std::env::remove_var(key); |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
#[ctor::ctor(unsafe)] |
||||
|
fn hermetic_env() { |
||||
|
init_hermetic_env(); |
||||
|
} |
||||
Loading…
Reference in new issue