Add Microsoft 365 SCIM bridge and access review driver

Microsoft 365's native SCIM endpoint is unreliable, so mirror the Google Workspace bridge over Microsoft Graph: a new MICROSOFT_365 OAuth2 connector, a SCIM bridge provider listing /v1.0/users with $select pagination, and an access review driver that derives admin status from /directoryRoles members. Refactor the bridge runner to share OAuth2 plumbing across providers and surface the new bridge type, scopes, UI card, and bootstrap env wiring. Signed-off-by: Bryan Frimin <bryan@getprobo.com>
2026-04-30 12:57:39 +02:00
parent 0aaee9ef73
commit 5e55c888c4
24 changed files with 1050 additions and 18 deletions
--- a/pkg/iam/scim/bridge/provider/microsoft365/oauth2_scopes.go
+++ b/pkg/iam/scim/bridge/provider/microsoft365/oauth2_scopes.go
@@ -0,0 +1,35 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package microsoft365
+
+var (
+	// OAuth2Scopes are the Microsoft Graph permission scopes required by the
+	// SCIM provisioning bridge. The bridge reads users (including the
+	// extended profile fields populated below) and their managers from the
+	// Microsoft Graph API.
+	//
+	// - openid / profile: identifies the consenting admin.
+	// - offline_access: required to receive a refresh token.
+	// - User.Read.All: read all user profiles in the directory.
+	// - Directory.Read.All: needed to read manager relationships and
+	//   organizational data on every user without per-user consent.
+	OAuth2Scopes = []string{
+		"openid",
+		"profile",
+		"offline_access",
+		"https://graph.microsoft.com/User.Read.All",
+		"https://graph.microsoft.com/Directory.Read.All",
+	}
+)
--- a/pkg/iam/scim/bridge/provider/microsoft365/provider.go
+++ b/pkg/iam/scim/bridge/provider/microsoft365/provider.go
@@ -0,0 +1,179 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+// Package microsoft365 provides a Microsoft 365 (Microsoft Entra ID)
+// identity provider for SCIM synchronization using OAuth2 against the
+// Microsoft Graph API.
+package microsoft365
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+
+	scimclient "go.probo.inc/probo/pkg/iam/scim/bridge/client"
+	"go.probo.inc/probo/pkg/iam/scim/bridge/provider"
+)
+
+// graphBaseURL is the Microsoft Graph v1.0 endpoint. The bridge uses raw
+// HTTP rather than the official SDK because the SDK pulls in a large
+// dependency tree for what is a small set of read-only calls.
+const graphBaseURL = "https://graph.microsoft.com/v1.0"
+
+// graphUserSelect is the projection used when listing users. Limiting the
+// response to only the fields we map keeps payloads small and avoids the
+// extra permission scopes some properties would otherwise require.
+const graphUserSelect = "id,userPrincipalName,mail,displayName,givenName,surname,accountEnabled,jobTitle,department,companyName,employeeId,preferredLanguage,usageLocation"
+
+// graphPageSize is the maximum page size for /users. Microsoft Graph
+// caps /users at 999.
+const graphPageSize = 999
+
+// graphMaxPages bounds pagination to prevent unbounded loops if the
+// API misbehaves.
+const graphMaxPages = 1000
+
+var _ provider.Provider = (*Provider)(nil)
+
+type Provider struct {
+	httpClient        *http.Client
+	excludedUserNames []string
+}
+
+func New(httpClient *http.Client, excludedUserNames []string) *Provider {
+	return &Provider{
+		httpClient:        httpClient,
+		excludedUserNames: excludedUserNames,
+	}
+}
+
+func (p *Provider) Name() string {
+	return "microsoft-365"
+}
+
+func (p *Provider) isExcluded(email string) bool {
+	emailLower := strings.ToLower(email)
+	for _, excluded := range p.excludedUserNames {
+		if strings.ToLower(excluded) == emailLower {
+			return true
+		}
+	}
+	return false
+}
+
+// graphUser is the subset of the Microsoft Graph user resource the
+// bridge consumes. Managers are intentionally not fetched here: the
+// /users endpoint does not return them and per-user lookups would
+// multiply the call volume by the directory size. Manager data can be
+// added later via /users/{id}/manager when needed.
+type graphUser struct {
+	ID                string `json:"id"`
+	UserPrincipalName string `json:"userPrincipalName"`
+	Mail              string `json:"mail"`
+	DisplayName       string `json:"displayName"`
+	GivenName         string `json:"givenName"`
+	Surname           string `json:"surname"`
+	AccountEnabled    bool   `json:"accountEnabled"`
+	JobTitle          string `json:"jobTitle"`
+	Department        string `json:"department"`
+	CompanyName       string `json:"companyName"`
+	EmployeeID        string `json:"employeeId"`
+	PreferredLanguage string `json:"preferredLanguage"`
+	UsageLocation     string `json:"usageLocation"`
+}
+
+type graphUsersResponse struct {
+	Value    []graphUser `json:"value"`
+	NextLink string      `json:"@odata.nextLink"`
+}
+
+func (p *Provider) ListUsers(ctx context.Context) (scimclient.Users, error) {
+	url := fmt.Sprintf(
+		"%s/users?$select=%s&$top=%d",
+		graphBaseURL,
+		graphUserSelect,
+		graphPageSize,
+	)
+
+	var allUsers scimclient.Users
+	for range graphMaxPages {
+		users, next, err := p.fetchPage(ctx, url)
+		if err != nil {
+			return nil, err
+		}
+
+		for _, u := range users {
+			email := u.Mail
+			if email == "" {
+				email = u.UserPrincipalName
+			}
+			if email == "" {
+				continue
+			}
+			if p.isExcluded(email) {
+				continue
+			}
+
+			allUsers = append(allUsers, scimclient.User{
+				UserName:               email,
+				DisplayName:            u.DisplayName,
+				GivenName:              u.GivenName,
+				FamilyName:             u.Surname,
+				Active:                 u.AccountEnabled,
+				ExternalID:             u.ID,
+				Title:                  u.JobTitle,
+				Department:             u.Department,
+				EnterpriseOrganization: u.CompanyName,
+				EmployeeNumber:         u.EmployeeID,
+				PreferredLanguage:      u.PreferredLanguage,
+			})
+		}
+
+		if next == "" {
+			return allUsers, nil
+		}
+		url = next
+	}
+
+	return nil, fmt.Errorf("microsoft 365: pagination limit of %d pages reached", graphMaxPages)
+}
+
+func (p *Provider) fetchPage(ctx context.Context, url string) ([]graphUser, string, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return nil, "", fmt.Errorf("cannot create graph users request: %w", err)
+	}
+	req.Header.Set("Accept", "application/json")
+
+	resp, err := p.httpClient.Do(req)
+	if err != nil {
+		return nil, "", fmt.Errorf("cannot list graph users: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		body, _ := io.ReadAll(resp.Body)
+		return nil, "", fmt.Errorf("microsoft graph error: status %d, body: %s", resp.StatusCode, string(body))
+	}
+
+	var page graphUsersResponse
+	if err := json.NewDecoder(resp.Body).Decode(&page); err != nil {
+		return nil, "", fmt.Errorf("cannot decode graph users response: %w", err)
+	}
+
+	return page.Value, page.NextLink, nil
+}