rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix active state not used at creation

Browse Source 
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
This commit is contained in:
Bryan Frimin
2026-02-10 17:46:59 +01:00
parent bb591d0c8e
commit 055a606747
1 changed files with 17 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
pkg/iam/scim/service.go
View File

@@ -127,7 +127,7 @@ func (s *Service) CreateUser(
config *coredata.SCIMConfiguration, config *coredata.SCIMConfiguration,
attributes scim.ResourceAttributes, attributes scim.ResourceAttributes,
) (scim.Resource, error) { ) (scim.Resource, error) {
email, fullName := ParseUserFromAttributes(attributes) email, fullName, active := ParseUserFromAttributes(attributes)
if email == "" { if email == "" {
return scim.Resource{}, scimerrors.ScimErrorBadRequest("userName or email is required") return scim.Resource{}, scimerrors.ScimErrorBadRequest("userName or email is required")
} }
@@ -138,6 +138,11 @@ func (s *Service) CreateUser(
} }
now := time.Now() now := time.Now()
membershipState := coredata.MembershipStateActive
if !active {
membershipState = coredata.MembershipStateInactive
}
var membership *coredata.Membership var membership *coredata.Membership
scope := coredata.NewScopeFromObjectID(config.OrganizationID) scope := coredata.NewScopeFromObjectID(config.OrganizationID)
@@ -179,7 +184,7 @@ func (s *Service) CreateUser(
OrganizationID: config.OrganizationID, OrganizationID: config.OrganizationID,
Role: coredata.MembershipRoleEmployee, Role: coredata.MembershipRoleEmployee,
Source: coredata.MembershipSourceSCIM, Source: coredata.MembershipSourceSCIM,
State: coredata.MembershipStateActive, State: membershipState,
CreatedAt: now, CreatedAt: now,
UpdatedAt: now, UpdatedAt: now,
} }
@@ -221,13 +226,9 @@ func (s *Service) CreateUser(
} else if err != nil { } else if err != nil {
return fmt.Errorf("cannot load membership: %w", err) return fmt.Errorf("cannot load membership: %w", err)
} else { } else {
// Update existing membership - reactivate if inactive, update source to SCIM // Update existing membership - follow what SCIM tells us
wasInactive := membership.State == coredata.MembershipStateInactive
membership.Source = coredata.MembershipSourceSCIM membership.Source = coredata.MembershipSourceSCIM
membership.State = coredata.MembershipStateActive membership.State = membershipState
if wasInactive {
membership.Role = coredata.MembershipRoleEmployee
}
membership.UpdatedAt = now membership.UpdatedAt = now
err = membership.Update(ctx, tx, scope) err = membership.Update(ctx, tx, scope)
@@ -594,10 +595,16 @@ func (s *Service) createEvent(
return event return event
} }
func ParseUserFromAttributes(attributes scim.ResourceAttributes) (email string, fullName string) { func ParseUserFromAttributes(attributes scim.ResourceAttributes) (email string, fullName string, active bool) {
userName, _ := attributes["userName"].(string) userName, _ := attributes["userName"].(string)
displayName, _ := attributes["displayName"].(string) displayName, _ := attributes["displayName"].(string)
// Default to active if the attribute is not present.
active = true
if a, ok := attributes["active"].(bool); ok {
active = a
}
var givenName, familyName string var givenName, familyName string
if name, ok := attributes["name"].(map[string]any); ok { if name, ok := attributes["name"].(map[string]any); ok {
givenName, _ = name["givenName"].(string) givenName, _ = name["givenName"].(string)
@@ -636,7 +643,7 @@ func ParseUserFromAttributes(attributes scim.ResourceAttributes) (email string,
fullName = userName fullName = userName
} }
return email, fullName return email, fullName, active
} }
func ParseUserFromReplaceAttributes(attributes scim.ResourceAttributes) (fullName string, active *bool) { func ParseUserFromReplaceAttributes(attributes scim.ResourceAttributes) (fullName string, active *bool) {