From 29051e1f80f66bf2bf092ed0498d73f4ca1d7a9e Mon Sep 17 00:00:00 2001 From: Sacha Al Himdani Date: Wed, 27 May 2026 20:13:29 +0200 Subject: [PATCH] Grant SCIM bridge get/manage in IAM policies MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The MCP getSCIMBridge tool authorized on iam:scim-bridge:get, but no role policy allowed that action, so every call denied — including for owners and admins. Owners now get the full iam:scim-bridge:* wildcard (matching the scim-configuration and scim-event treatment in the same policy). Admins get read-only access and are explicitly denied create/update/ delete, mirroring how scim-configuration is handled. Signed-off-by: Sacha Al Himdani --- pkg/iam/iam_policies.go | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/pkg/iam/iam_policies.go b/pkg/iam/iam_policies.go index 0a4ab39d5..bdb20ba8c 100644 --- a/pkg/iam/iam_policies.go +++ b/pkg/iam/iam_policies.go @@ -216,9 +216,9 @@ var IAMOwnerPolicy = policy.NewPolicy( WithSID("full-scim-event-access"). When(policy.Equals("principal.organization_id", "resource.organization_id")), - // Allow updating SCIM bridge settings (scoped to own organization) - policy.Allow(ActionSCIMBridgeUpdate). - WithSID("scim-bridge-update-access"). + // Full access to SCIM bridge management (scoped to own organization) + policy.Allow("iam:scim-bridge:*"). + WithSID("full-scim-bridge-access"). When(policy.Equals("principal.organization_id", "resource.organization_id")), // Full access to audit log entries (scoped to own organization) @@ -310,20 +310,24 @@ var IAMAdminPolicy = policy.NewPolicy( ). WithSID("deny-saml-management"), - // Can view SCIM configuration and events (scoped to own organization) + // Can view SCIM configuration, bridge, and events (scoped to own organization) policy.Allow( ActionSCIMConfigurationGet, + ActionSCIMBridgeGet, ActionSCIMEventList, ActionSCIMEventGet, ). WithSID("scim-admin-view-access"). When(policy.Equals("principal.organization_id", "resource.organization_id")), - // Cannot manage SCIM configurations (only owner can) + // Cannot manage SCIM configurations or bridges (only owner can) policy.Deny( ActionSCIMConfigurationCreate, ActionSCIMConfigurationUpdate, ActionSCIMConfigurationDelete, + ActionSCIMBridgeCreate, + ActionSCIMBridgeUpdate, + ActionSCIMBridgeDelete, ). WithSID("deny-scim-management"),