SCIM: automatic schema discovery doesn't work

Aperta
  • Qualcosa non va?
#5,687 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 3 giorni

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
53/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
haskell, python
Ambito
api, backend

Direzione di ricerca

Read the follow-up issue #5436 and the fix in PR #5441 for context, then locate the SCIM server handlers for /ServiceProviderConfig and /Schemas. Check the response schemas against the RFC requirements described here, including retrieval of the profile extension schemas. Done means /ServiceProviderConfig advertises only its own schema and /Schemas returns all supported schemas, including individually retrievable extensions.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

This is a follow-up to https://github.com/wireapp/wire-server/issues/5436.

Two related issues with the SCIM server's responses regarding schemas break automatic schema discovery in stricter clients. We're using the scim2-client Python library, which got a lot stricter in recent versions.

Incorrect schemas on /ServiceProviderConfig

The response of the /ServiceProviderConfig contains these schemas:

{
  ...
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User",
    "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig",
    "urn:ietf:params:scim:schemas:core:2.0:Group",
    "urn:ietf:params:scim:schemas:core:2.0:Schema",
    "urn:ietf:params:scim:schemas:core:2.0:ResourceType"
  ]
  ...
}

but it should only be

{
  ...
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"]
  ...
}

The schemas should only describe the response (i.e. the ServiceProviderConfig), not list all the schemas the server knows. Relevant parts of the standard:

  • RFC 7644 §4 specifies this endpoint and its schema URI.
  • RFC 7643 §3 requires schemas to contain only the resource type's base/extension schemas.
  • RFC 7643 §8.5 shows a configuration example.

scim2-cli (CLI building on scim2-client) breaks like this:

$ uvx --from scim2-cli scim2 --url https://prod-nginz-https.wire.com/scim/v2 test
Error: Could not discover the server at https://prod-nginz-https.wire.com/scim/v2: Expected type ServiceProviderConfig but got unknown resource with schemas: urn:ietf:params:scim:schemas:core:2.0:User, urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig, urn:ietf:params:scim:schemas:core:2.0:Group, urn:ietf:params:scim:schemas:core:2.0:Schema, urn:ietf:params:scim:schemas:core:2.0:ResourceType

Extensions advertised in /ResourceTypes, but missing from /Schemas

https://github.com/wireapp/wire-server/pull/5441 correctly fixed the server to include the extension schemas (urn:wire:scim:schemas:profile:1.0 and urn:wire:scim:schemas:profile:1.0) in ResourceTypes. But for automatic schema discovery to work, the schema definitions must be returned as part of the /Schemas response, as well as individually at /Schemas/urn:wire:scim:schemas:profile:1.0 and /Schemas/urn:wire:scim:schemas:profile:1.0.

Currently, the individual endpoints return 404s, and the collective /Schemas endpoint returns only the 5 schemas that are (incorrectly) listed in the /ServiceProviderConfig.

Relevant parts of the standard:

  • RFC 7644 §4: GET /Schemas SHALL return all supported schemas, and describes individual schema retrieval.
  • RFC 7643 §6: each schemaExtensions.schema must equal the id of a Schema resource.
  • RFC 7643 §7: for every schema URI used in a resource object, there is a corresponding Schema resource.

This makes it impossible to use data in the extension schemas, at least using scim2-client.

Lingua principale
Haskell
Stelle
2.8k
Fork
333
Merge medio
3g 8h
PR unite (30g)
37

Preparare l'ambiente

  • Nessun Dockerfile né file Docker Compose
  • Ha un modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di wireapp/wire-server

Tutte le issue di wireapp/wire-server

Issue simili

Altre issue su Haskell

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.