rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Grant SCIM bridge get/manage in IAM policies

Browse Source 
The MCP getSCIMBridge tool authorized on iam:scim-bridge:get, but no
role policy allowed that action, so every call denied — including for
owners and admins.

Owners now get the full iam:scim-bridge:* wildcard (matching the
scim-configuration and scim-event treatment in the same policy).
Admins get read-only access and are explicitly denied create/update/
delete, mirroring how scim-configuration is handled.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
2026-05-27 20:13:29 +02:00
parent b30c476ffe
commit 29051e1f80
1 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
pkg/iam/iam_policies.go
View File

@@ -216,9 +216,9 @@ var IAMOwnerPolicy = policy.NewPolicy(
WithSID("full-scim-event-access").
When(policy.Equals("principal.organization_id", "resource.organization_id")),
// Allow updating SCIM bridge settings (scoped to own organization)
policy.Allow(ActionSCIMBridgeUpdate).
WithSID("scim-bridge-update-access").
// Full access to SCIM bridge management (scoped to own organization)
policy.Allow("iam:scim-bridge:*").
WithSID("full-scim-bridge-access").
When(policy.Equals("principal.organization_id", "resource.organization_id")),
// Full access to audit log entries (scoped to own organization)
@@ -310,20 +310,24 @@ var IAMAdminPolicy = policy.NewPolicy(
).
WithSID("deny-saml-management"),
// Can view SCIM configuration and events (scoped to own organization)
// Can view SCIM configuration, bridge, and events (scoped to own organization)
policy.Allow(
ActionSCIMConfigurationGet,
ActionSCIMBridgeGet,
ActionSCIMEventList,
ActionSCIMEventGet,
).
WithSID("scim-admin-view-access").
When(policy.Equals("principal.organization_id", "resource.organization_id")),
// Cannot manage SCIM configurations (only owner can)
// Cannot manage SCIM configurations or bridges (only owner can)
policy.Deny(
ActionSCIMConfigurationCreate,
ActionSCIMConfigurationUpdate,
ActionSCIMConfigurationDelete,
ActionSCIMBridgeCreate,
ActionSCIMBridgeUpdate,
ActionSCIMBridgeDelete,
).
WithSID("deny-scim-management"),