Add scim bridge with connector

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/connector/connector.go

@@ -28,7 +28,7 @@ type (
 
 	Connector interface {
 		Initiate(ctx context.Context, provider string, organizationID gid.GID, r *http.Request) (string, error)
-		Complete(ctx context.Context, r *http.Request) (Connection, *gid.GID, error)
+		Complete(ctx context.Context, r *http.Request) (Connection, *gid.GID, string, error) // returns: connection, organizationID, continueURL, error
 	}
 
 	Connection interface {

pkg/connector/oauth2.go

@@ -38,17 +38,19 @@ import (
 
 type (
 	OAuth2Connector struct {
-		ClientID     string
-		ClientSecret string
-		RedirectURI  string
-		Scopes       []string
-		AuthURL      string
-		TokenURL     string
+		ClientID        string
+		ClientSecret    string
+		RedirectURI     string
+		Scopes          []string
+		AuthURL         string
+		TokenURL        string
+		ExtraAuthParams map[string]string // Optional: extra params for auth URL (e.g., access_type=offline for Google)
 	}
 
 	OAuth2State struct {
 		OrganizationID string `json:"oid"`
 		Provider       string `json:"provider"`
+		ContinueURL    string `json:"continue,omitempty"`
 	}
 
 	OAuth2Connection struct {
@@ -73,21 +75,30 @@ func (c *OAuth2Connector) Initiate(ctx context.Context, provider string, organiz
 		OrganizationID: organizationID.String(),
 		Provider:       provider,
 	}
+	if r != nil {
+		if continueURL := r.URL.Query().Get("continue"); continueURL != "" {
+			stateData.ContinueURL = continueURL
+		}
+	}
+	return c.InitiateWithState(ctx, stateData, r)
+}
+
+// InitiateWithState generates an OAuth2 authorization URL with a custom state.
+// This allows callers to include additional context (like SCIMBridgeID) in the state.
+func (c *OAuth2Connector) InitiateWithState(ctx context.Context, stateData OAuth2State, r *http.Request) (string, error) {
 	state, err := statelesstoken.NewToken(c.ClientSecret, OAuth2TokenType, OAuth2TokenTTL, stateData)
 	if err != nil {
 		return "", fmt.Errorf("cannot create state token: %w", err)
 	}
 
+	// Build redirect URI with provider (fixed per provider, so can be registered in OAuth console)
 	redirectURI := c.RedirectURI
 	redirectURIParsed, err := url.Parse(redirectURI)
 	if err != nil {
 		return "", fmt.Errorf("cannot parse redirect URI: %w", err)
 	}
 	q := redirectURIParsed.Query()
-	q.Set("provider", provider)
-	if continueURL := r.URL.Query().Get("continue"); continueURL != "" {
-		q.Set("continue", continueURL)
-	}
+	q.Set("provider", stateData.Provider)
 	redirectURIParsed.RawQuery = q.Encode()
 	redirectURI = redirectURIParsed.String()
 
@@ -98,6 +109,11 @@ func (c *OAuth2Connector) Initiate(ctx context.Context, provider string, organiz
 	authCodeQuery.Set("response_type", "code")
 	authCodeQuery.Set("scope", strings.Join(c.Scopes, " "))
 
+	// Add any extra auth params (e.g., access_type=offline, prompt=consent for Google)
+	for k, v := range c.ExtraAuthParams {
+		authCodeQuery.Set(k, v)
+	}
+
 	u, err := url.Parse(c.AuthURL)
 	if err != nil {
 		return "", fmt.Errorf("cannot parse auth URL: %w", err)
@@ -108,7 +124,23 @@ func (c *OAuth2Connector) Initiate(ctx context.Context, provider string, organiz
 	return u.String(), nil
 }
 
-func (c *OAuth2Connector) Complete(ctx context.Context, r *http.Request) (Connection, *gid.GID, error) {
+func (c *OAuth2Connector) Complete(ctx context.Context, r *http.Request) (Connection, *gid.GID, string, error) {
+	conn, state, err := c.CompleteWithState(ctx, r)
+	if err != nil {
+		return nil, nil, "", err
+	}
+
+	organizationID, err := gid.ParseGID(state.OrganizationID)
+	if err != nil {
+		return nil, nil, "", fmt.Errorf("cannot parse organization ID: %w", err)
+	}
+
+	return conn, &organizationID, state.ContinueURL, nil
+}
+
+// CompleteWithState completes the OAuth2 flow and returns the full state.
+// This allows callers to access additional context (like SCIMBridgeID) from the state.
+func (c *OAuth2Connector) CompleteWithState(ctx context.Context, r *http.Request) (Connection, *OAuth2State, error) {
 	provider := r.URL.Query().Get("provider")
 	if provider == "" {
 		return nil, nil, fmt.Errorf("missing provider in query parameters")
@@ -138,6 +170,7 @@ func (c *OAuth2Connector) Complete(ctx context.Context, r *http.Request) (Connec
 		return nil, nil, fmt.Errorf("cannot parse organization ID: %w", err)
 	}
 
+	// Build redirect URI with provider (must match what was sent to auth endpoint)
 	redirectURI := c.RedirectURI
 	redirectURIParsed, err := url.Parse(redirectURI)
 	if err != nil {
@@ -145,9 +178,6 @@ func (c *OAuth2Connector) Complete(ctx context.Context, r *http.Request) (Connec
 	}
 	q := redirectURIParsed.Query()
 	q.Set("provider", provider)
-	if continueURL := r.URL.Query().Get("continue"); continueURL != "" {
-		q.Set("continue", continueURL)
-	}
 	redirectURIParsed.RawQuery = q.Encode()
 	redirectURI = redirectURIParsed.String()
 
@@ -191,10 +221,11 @@ func (c *OAuth2Connector) Complete(ctx context.Context, r *http.Request) (Connec
 	}
 
 	if provider == SlackProvider {
-		return ParseSlackTokenResponse(body, oauth2Conn, organizationID)
+		conn, _, err := ParseSlackTokenResponse(body, oauth2Conn, organizationID)
+		return conn, &payload.Data, err
 	}
 
-	return &oauth2Conn, &organizationID, nil
+	return &oauth2Conn, &payload.Data, nil
 }
 
 func (c *OAuth2Connection) Type() ProtocolType {

pkg/connector/registry.go

@@ -65,10 +65,10 @@ func (cr *ConnectorRegistry) Initiate(ctx context.Context, provider string, orga
 	return connector.Initiate(ctx, provider, organizationID, r)
 }
 
-func (cr *ConnectorRegistry) Complete(ctx context.Context, provider string, r *http.Request) (Connection, *gid.GID, error) {
+func (cr *ConnectorRegistry) Complete(ctx context.Context, provider string, r *http.Request) (Connection, *gid.GID, string, error) {
 	connector, err := cr.Get(provider)
 	if err != nil {
-		return nil, nil, fmt.Errorf("cannot complete connector: %w", err)
+		return nil, nil, "", fmt.Errorf("cannot complete connector: %w", err)
 	}
 
 	return connector.Complete(ctx, r)

pkg/coredata/connector.go

@@ -150,6 +150,110 @@ func (c *Connectors) LoadAllByOrganizationIDWithoutDecryptedConnection(
 	return c.loadAllByOrganizationID(ctx, conn, scope, organizationID)
 }
 
+func (c *Connector) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	connectorID gid.GID,
+	encryptionKey cipher.EncryptionKey,
+) error {
+	if err := c.LoadMetadataByID(ctx, conn, scope, connectorID); err != nil {
+		return err
+	}
+
+	// Decrypt the connection
+	if len(c.EncryptedConnection) > 0 {
+		decryptedConnection, err := cipher.Decrypt(c.EncryptedConnection, encryptionKey)
+		if err != nil {
+			return fmt.Errorf("cannot decrypt connection: %w", err)
+		}
+
+		c.Connection, err = connector.UnmarshalConnection(c.Protocol.String(), c.Provider.String(), decryptedConnection)
+		if err != nil {
+			return fmt.Errorf("cannot unmarshal connection: %w", err)
+		}
+
+		c.populateSlackSettings()
+	}
+
+	return nil
+}
+
+// LoadMetadataByID loads connector metadata without decrypting the connection.
+// Use this when you only need provider, organization, or other metadata.
+func (c *Connector) LoadMetadataByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	connectorID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    provider,
+    protocol,
+    settings,
+    encrypted_connection,
+    created_at,
+    updated_at
+FROM
+    connectors
+WHERE
+    %s
+    AND id = @id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": connectorID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query connectors: %w", err)
+	}
+
+	loadedConnector, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Connector])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+		return fmt.Errorf("cannot collect connector row: %w", err)
+	}
+
+	*c = loadedConnector
+
+	return nil
+}
+
+func (c *Connector) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE FROM connectors
+WHERE %s AND id = @id
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": c.ID}
+	maps.Copy(args, scope.SQLArguments())
+
+	result, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot delete connector: %w", err)
+	}
+
+	if result.RowsAffected() == 0 {
+		return ErrResourceNotFound
+	}
+
+	return nil
+}
+
 func (c *Connector) Insert(
 	ctx context.Context,
 	conn pg.Conn,

pkg/coredata/connector_provider.go

@@ -22,12 +22,14 @@ import (
 type ConnectorProvider string
 
 const (
-	ConnectorProviderSlack ConnectorProvider = "SLACK"
+	ConnectorProviderSlack           ConnectorProvider = "SLACK"
+	ConnectorProviderGoogleWorkspace ConnectorProvider = "GOOGLE_WORKSPACE"
 )
 
 func ConnectorProviders() []ConnectorProvider {
 	return []ConnectorProvider{
 		ConnectorProviderSlack,
+		ConnectorProviderGoogleWorkspace,
 	}
 }
 
@@ -49,6 +51,8 @@ func (cp *ConnectorProvider) Scan(value any) error {
 	switch s {
 	case "SLACK":
 		*cp = ConnectorProviderSlack
+	case "GOOGLE_WORKSPACE":
+		*cp = ConnectorProviderGoogleWorkspace
 	default:
 		return fmt.Errorf("invalid ConnectorProvider value: %q", s)
 	}

pkg/coredata/entity_type_reg.go

@@ -78,6 +78,7 @@ const (
 	SCIMConfigurationEntityType                uint16 = 52
 	SCIMEventEntityType                        uint16 = 53
 	TokenEntityType                            uint16 = 54
+	SCIMBridgeEntityType                       uint16 = 55
 )
 
 func NewEntityFromID(id gid.GID) (any, bool) {
@@ -190,6 +191,8 @@ func NewEntityFromID(id gid.GID) (any, bool) {
 		return &SCIMEvent{ID: id}, true
 	case TokenEntityType:
 		return &Token{ID: id}, true
+	case SCIMBridgeEntityType:
+		return &SCIMBridge{ID: id}, true
 	default:
 		return nil, false
 	}

pkg/coredata/migrations/20260127T120000Z.sql

@@ -0,0 +1,12 @@
+CREATE TABLE iam_scim_bridges (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+    scim_configuration_id TEXT NOT NULL REFERENCES iam_scim_configurations(id) ON DELETE CASCADE,
+    connector_id TEXT REFERENCES connectors(id) ON DELETE SET NULL,
+    type TEXT NOT NULL,
+    state TEXT NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    CONSTRAINT iam_scim_bridges_scim_configuration_unique UNIQUE (scim_configuration_id)
+);

pkg/coredata/migrations/20260129T041655Z.sql

@@ -0,0 +1 @@
+ALTER TYPE connector_provider ADD VALUE 'GOOGLE_WORKSPACE';

pkg/coredata/scim_bridge.go

@@ -0,0 +1,323 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type (
+	SCIMBridge struct {
+		ID                  gid.GID         `db:"id"`
+		OrganizationID      gid.GID         `db:"organization_id"`
+		ScimConfigurationID gid.GID         `db:"scim_configuration_id"`
+		ConnectorID         *gid.GID        `db:"connector_id"`
+		Type                SCIMBridgeType  `db:"type"`
+		State               SCIMBridgeState `db:"state"`
+		CreatedAt           time.Time       `db:"created_at"`
+		UpdatedAt           time.Time       `db:"updated_at"`
+	}
+
+	SCIMBridges []*SCIMBridge
+)
+
+func (s *SCIMBridge) CursorKey(orderBy SCIMBridgeOrderField) page.CursorKey {
+	switch orderBy {
+	case SCIMBridgeOrderFieldCreatedAt:
+		return page.NewCursorKey(s.ID, s.CreatedAt)
+	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
+}
+
+func (s *SCIMBridge) AuthorizationAttributes(ctx context.Context, conn pg.Conn) (map[string]string, error) {
+	q := `SELECT organization_id FROM iam_scim_bridges WHERE id = $1 LIMIT 1;`
+
+	var organizationID gid.GID
+	if err := conn.QueryRow(ctx, q, s.ID).Scan(&organizationID); err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, ErrResourceNotFound
+		}
+		return nil, fmt.Errorf("cannot query scim bridge authorization attributes: %w", err)
+	}
+
+	return map[string]string{"organization_id": organizationID.String()}, nil
+}
+
+func (s *SCIMBridge) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	bridgeID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    scim_configuration_id,
+    connector_id,
+    type,
+    state,
+    created_at,
+    updated_at
+FROM
+    iam_scim_bridges
+WHERE
+    %s
+    AND id = @id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": bridgeID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query iam_scim_bridges: %w", err)
+	}
+
+	bridge, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[SCIMBridge])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+
+		return fmt.Errorf("cannot collect scim_bridge: %w", err)
+	}
+
+	*s = bridge
+
+	return nil
+}
+
+func (s *SCIMBridge) LoadByOrganizationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    scim_configuration_id,
+    connector_id,
+    type,
+    state,
+    created_at,
+    updated_at
+FROM
+    iam_scim_bridges
+WHERE
+    %s
+    AND organization_id = @organization_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"organization_id": organizationID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query iam_scim_bridges: %w", err)
+	}
+
+	bridge, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[SCIMBridge])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+
+		return fmt.Errorf("cannot collect scim_bridge: %w", err)
+	}
+
+	*s = bridge
+
+	return nil
+}
+
+func (s *SCIMBridge) LoadBySCIMConfigurationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	scimConfigurationID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    scim_configuration_id,
+    connector_id,
+    type,
+    state,
+    created_at,
+    updated_at
+FROM
+    iam_scim_bridges
+WHERE
+    %s
+    AND scim_configuration_id = @scim_configuration_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"scim_configuration_id": scimConfigurationID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query iam_scim_bridges: %w", err)
+	}
+
+	bridge, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[SCIMBridge])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+
+		return fmt.Errorf("cannot collect scim_bridge: %w", err)
+	}
+
+	*s = bridge
+
+	return nil
+}
+
+func (s *SCIMBridge) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO iam_scim_bridges (
+    id,
+    tenant_id,
+    organization_id,
+    scim_configuration_id,
+    connector_id,
+    type,
+    state,
+    created_at,
+    updated_at
+) VALUES (
+    @id,
+    @tenant_id,
+    @organization_id,
+    @scim_configuration_id,
+    @connector_id,
+    @type,
+    @state,
+    @created_at,
+    @updated_at
+)
+`
+
+	args := pgx.StrictNamedArgs{
+		"id":                    s.ID,
+		"tenant_id":             scope.GetTenantID(),
+		"organization_id":       s.OrganizationID,
+		"scim_configuration_id": s.ScimConfigurationID,
+		"connector_id":          s.ConnectorID,
+		"type":                  s.Type,
+		"state":                 s.State,
+		"created_at":            s.CreatedAt,
+		"updated_at":            s.UpdatedAt,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot insert scim_bridge: %w", err)
+	}
+
+	return nil
+}
+
+func (s *SCIMBridge) Update(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+UPDATE iam_scim_bridges
+SET
+    connector_id = @connector_id,
+    state = @state,
+    updated_at = @updated_at
+WHERE
+    %s
+    AND id = @id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"id":           s.ID,
+		"connector_id": s.ConnectorID,
+		"state":        s.State,
+		"updated_at":   s.UpdatedAt,
+	}
+
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot update scim_bridge: %w", err)
+	}
+
+	return nil
+}
+
+func (s *SCIMBridge) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE FROM iam_scim_bridges
+WHERE
+    %s
+    AND id = @id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": s.ID}
+	maps.Copy(args, scope.SQLArguments())
+
+	result, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot delete scim_bridge: %w", err)
+	}
+
+	if result.RowsAffected() == 0 {
+		return ErrResourceNotFound
+	}
+
+	return nil
+}

pkg/coredata/scim_bridge_order_field.go

@@ -0,0 +1,40 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+type (
+	SCIMBridgeOrderField string
+)
+
+const (
+	SCIMBridgeOrderFieldCreatedAt SCIMBridgeOrderField = "CREATED_AT"
+)
+
+func (p SCIMBridgeOrderField) Column() string {
+	return string(p)
+}
+
+func (p SCIMBridgeOrderField) String() string {
+	return string(p)
+}
+
+func (p SCIMBridgeOrderField) MarshalText() ([]byte, error) {
+	return []byte(p.String()), nil
+}
+
+func (p *SCIMBridgeOrderField) UnmarshalText(text []byte) error {
+	*p = SCIMBridgeOrderField(text)
+	return nil
+}

pkg/coredata/scim_bridge_state.go

@@ -0,0 +1,60 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"fmt"
+)
+
+type SCIMBridgeState string
+
+const (
+	SCIMBridgeStatePending SCIMBridgeState = "PENDING"
+	SCIMBridgeStateActive  SCIMBridgeState = "ACTIVE"
+	SCIMBridgeStateFailed  SCIMBridgeState = "FAILED"
+)
+
+func (s SCIMBridgeState) String() string {
+	return string(s)
+}
+
+func (s *SCIMBridgeState) Scan(value any) error {
+	var str string
+	switch v := value.(type) {
+	case string:
+		str = v
+	case []byte:
+		str = string(v)
+	default:
+		return fmt.Errorf("unsupported type for SCIMBridgeState: %T", value)
+	}
+
+	switch str {
+	case "PENDING":
+		*s = SCIMBridgeStatePending
+	case "ACTIVE":
+		*s = SCIMBridgeStateActive
+	case "FAILED":
+		*s = SCIMBridgeStateFailed
+	default:
+		return fmt.Errorf("invalid SCIMBridgeState value: %q", str)
+	}
+	return nil
+}
+
+func (s SCIMBridgeState) Value() (driver.Value, error) {
+	return s.String(), nil
+}

pkg/coredata/scim_bridge_type.go

@@ -0,0 +1,54 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"fmt"
+)
+
+type SCIMBridgeType string
+
+const (
+	SCIMBridgeTypeGoogleWorkspace SCIMBridgeType = "GOOGLE_WORKSPACE"
+)
+
+func (t SCIMBridgeType) String() string {
+	return string(t)
+}
+
+func (t *SCIMBridgeType) Scan(value any) error {
+	var str string
+	switch v := value.(type) {
+	case string:
+		str = v
+	case []byte:
+		str = string(v)
+	default:
+		return fmt.Errorf("unsupported type for SCIMBridgeType: %T", value)
+	}
+
+	switch str {
+	case "GOOGLE_WORKSPACE":
+		*t = SCIMBridgeTypeGoogleWorkspace
+	default:
+		return fmt.Errorf("invalid SCIMBridgeType value: %q", str)
+	}
+	return nil
+}
+
+func (t SCIMBridgeType) Value() (driver.Value, error) {
+	return t.String(), nil
+}

pkg/coredata/scim_configuration.go

@@ -32,6 +32,7 @@ type (
 	SCIMConfiguration struct {
 		ID             gid.GID   `db:"id"`
 		OrganizationID gid.GID   `db:"organization_id"`
+		BridgeID       *gid.GID  `db:"bridge_id"`
 		HashedToken    []byte    `db:"hashed_token"`
 		CreatedAt      time.Time `db:"created_at"`
 		UpdatedAt      time.Time `db:"updated_at"`
@@ -70,18 +71,31 @@ func (s *SCIMConfiguration) LoadByID(
 	configID gid.GID,
 ) error {
 	q := `
+WITH scim_config AS (
+    SELECT
+        id,
+        organization_id,
+        hashed_token,
+        created_at,
+        updated_at
+    FROM
+        iam_scim_configurations
+    WHERE
+        %s
+        AND id = @id
+    LIMIT 1
+)
 SELECT
-    id,
-    organization_id,
-    hashed_token,
-    created_at,
-    updated_at
+    sc.id,
+    sc.organization_id,
+    b.id AS bridge_id,
+    sc.hashed_token,
+    sc.created_at,
+    sc.updated_at
 FROM
-    iam_scim_configurations
-WHERE
-    %s
-    AND id = @id
-LIMIT 1;
+    scim_config sc
+LEFT JOIN
+    iam_scim_bridges b ON b.scim_configuration_id = sc.id;
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
@@ -115,18 +129,31 @@ func (s *SCIMConfiguration) LoadByOrganizationID(
 	organizationID gid.GID,
 ) error {
 	q := `
+WITH scim_config AS (
+    SELECT
+        id,
+        organization_id,
+        hashed_token,
+        created_at,
+        updated_at
+    FROM
+        iam_scim_configurations
+    WHERE
+        %s
+        AND organization_id = @organization_id
+    LIMIT 1
+)
 SELECT
-    id,
-    organization_id,
-    hashed_token,
-    created_at,
-    updated_at
+    sc.id,
+    sc.organization_id,
+    b.id AS bridge_id,
+    sc.hashed_token,
+    sc.created_at,
+    sc.updated_at
 FROM
-    iam_scim_configurations
-WHERE
-    %s
-    AND organization_id = @organization_id
-LIMIT 1;
+    scim_config sc
+LEFT JOIN
+    iam_scim_bridges b ON b.scim_configuration_id = sc.id;
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
@@ -159,17 +186,30 @@ func (s *SCIMConfiguration) LoadByHashedToken(
 	hashedToken []byte,
 ) error {
 	q := `
+WITH scim_config AS (
+    SELECT
+        id,
+        organization_id,
+        hashed_token,
+        created_at,
+        updated_at
+    FROM
+        iam_scim_configurations
+    WHERE
+        hashed_token = @hashed_token
+    LIMIT 1
+)
 SELECT
-    id,
-    organization_id,
-    hashed_token,
-    created_at,
-    updated_at
+    sc.id,
+    sc.organization_id,
+    b.id AS bridge_id,
+    sc.hashed_token,
+    sc.created_at,
+    sc.updated_at
 FROM
-    iam_scim_configurations
-WHERE
-    hashed_token = @hashed_token
-LIMIT 1;
+    scim_config sc
+LEFT JOIN
+    iam_scim_bridges b ON b.scim_configuration_id = sc.id;
 `
 
 	args := pgx.StrictNamedArgs{"hashed_token": hashedToken}

pkg/iam/errors.go

@@ -357,3 +357,23 @@ func NewNoSCIMConfigurationFoundError(organizationID gid.GID) error {
 func (e ErrNoSCIMConfigurationFound) Error() string {
 	return fmt.Sprintf("SCIM configuration not found for organization %q", e.OrganizationID)
 }
+
+type ErrSCIMBridgeNotFound struct{ BridgeID gid.GID }
+
+func NewSCIMBridgeNotFoundError(bridgeID gid.GID) error {
+	return &ErrSCIMBridgeNotFound{BridgeID: bridgeID}
+}
+
+func (e ErrSCIMBridgeNotFound) Error() string {
+	return fmt.Sprintf("SCIM bridge %q not found", e.BridgeID)
+}
+
+type ErrConnectorNotFound struct{ ConnectorID gid.GID }
+
+func NewConnectorNotFoundError(connectorID gid.GID) error {
+	return &ErrConnectorNotFound{ConnectorID: connectorID}
+}
+
+func (e ErrConnectorNotFound) Error() string {
+	return fmt.Sprintf("connector %q not found", e.ConnectorID)
+}

pkg/iam/iam_actions.go

@@ -77,4 +77,12 @@ const (
 	// SCIM Event actions
 	ActionSCIMEventList = "iam:scim-event:list"
 	ActionSCIMEventGet  = "iam:scim-event:get"
+
+	// SCIM Bridge actions
+	ActionSCIMBridgeGet    = "iam:scim-bridge:get"
+	ActionSCIMBridgeCreate = "iam:scim-bridge:create"
+	ActionSCIMBridgeDelete = "iam:scim-bridge:delete"
+
+	// Connector actions
+	ActionConnectorGet = "iam:connector:get"
 )

pkg/iam/organization_service.go

@@ -1296,6 +1296,30 @@ func (s OrganizationService) DeleteSCIMConfiguration(
 				return fmt.Errorf("cannot reset membership sources: %w", err)
 			}
 
+			// Delete SCIM bridge and its connector if they exist
+			bridge := &coredata.SCIMBridge{}
+			err = bridge.LoadBySCIMConfigurationID(ctx, tx, scope, configID)
+			if err != nil && err != coredata.ErrResourceNotFound {
+				return fmt.Errorf("cannot load SCIM bridge: %w", err)
+			}
+
+			if err == nil {
+				// Bridge exists, delete connector if it has one
+				if bridge.ConnectorID != nil {
+					connector := &coredata.Connector{ID: *bridge.ConnectorID}
+					err = connector.Delete(ctx, tx, scope)
+					if err != nil && err != coredata.ErrResourceNotFound {
+						return fmt.Errorf("cannot delete connector: %w", err)
+					}
+				}
+
+				// Delete the bridge
+				err = bridge.Delete(ctx, tx, scope)
+				if err != nil {
+					return fmt.Errorf("cannot delete SCIM bridge: %w", err)
+				}
+			}
+
 			err = config.Delete(ctx, tx, scope)
 			if err != nil {
 				return fmt.Errorf("cannot delete SCIM configuration: %w", err)
@@ -1591,3 +1615,293 @@ func (s OrganizationService) GetOrganization(ctx context.Context, organizationID
 
 	return organization, nil
 }
+
+func (s OrganizationService) GetSCIMBridgeByID(ctx context.Context, bridgeID gid.GID) (*coredata.SCIMBridge, error) {
+	var (
+		scope  = coredata.NewScopeFromObjectID(bridgeID)
+		bridge = &coredata.SCIMBridge{}
+	)
+
+	err := s.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			err := bridge.LoadByID(ctx, conn, scope, bridgeID)
+			if err != nil {
+				if err == coredata.ErrResourceNotFound {
+					return NewSCIMBridgeNotFoundError(bridgeID)
+				}
+
+				return fmt.Errorf("cannot load SCIM bridge: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return bridge, nil
+}
+
+func (s OrganizationService) GetConnectorByID(ctx context.Context, connectorID gid.GID) (*coredata.Connector, error) {
+	var (
+		scope     = coredata.NewScopeFromObjectID(connectorID)
+		connector = &coredata.Connector{}
+	)
+
+	err := s.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			err := connector.LoadByID(ctx, conn, scope, connectorID, s.encryptionKey)
+			if err != nil {
+				if err == coredata.ErrResourceNotFound {
+					return NewConnectorNotFoundError(connectorID)
+				}
+
+				return fmt.Errorf("cannot load connector: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return connector, nil
+}
+
+// GetConnectorMetadataByID returns connector metadata without decrypting the connection.
+// Use this when you only need provider, organization, or other metadata fields.
+func (s OrganizationService) GetConnectorMetadataByID(ctx context.Context, connectorID gid.GID) (*coredata.Connector, error) {
+	var (
+		scope     = coredata.NewScopeFromObjectID(connectorID)
+		connector = &coredata.Connector{}
+	)
+
+	err := s.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			err := connector.LoadMetadataByID(ctx, conn, scope, connectorID)
+			if err != nil {
+				if err == coredata.ErrResourceNotFound {
+					return NewConnectorNotFoundError(connectorID)
+				}
+
+				return fmt.Errorf("cannot load connector: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return connector, nil
+}
+
+func (s OrganizationService) GetSCIMBridgeByOrganizationID(ctx context.Context, organizationID gid.GID) (*coredata.SCIMBridge, error) {
+	var (
+		scope  = coredata.NewScopeFromObjectID(organizationID)
+		bridge = &coredata.SCIMBridge{}
+	)
+
+	err := s.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			err := bridge.LoadByOrganizationID(ctx, conn, scope, organizationID)
+			if err != nil {
+				if err == coredata.ErrResourceNotFound {
+					return nil // No bridge found, not an error
+				}
+
+				return fmt.Errorf("cannot load SCIM bridge: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	// If bridge ID is empty, no bridge was found
+	if bridge.ID == (gid.GID{}) {
+		return nil, nil
+	}
+
+	return bridge, nil
+}
+
+func (s OrganizationService) LinkConnectorToSCIMBridge(
+	ctx context.Context,
+	bridgeID gid.GID,
+	connectorID gid.GID,
+) (*coredata.SCIMBridge, error) {
+	var (
+		scope  = coredata.NewScopeFromObjectID(bridgeID)
+		bridge = &coredata.SCIMBridge{}
+	)
+
+	err := s.pg.WithTx(
+		ctx,
+		func(tx pg.Conn) error {
+			err := bridge.LoadByID(ctx, tx, scope, bridgeID)
+			if err != nil {
+				if err == coredata.ErrResourceNotFound {
+					return NewSCIMBridgeNotFoundError(bridgeID)
+				}
+				return fmt.Errorf("cannot load SCIM bridge: %w", err)
+			}
+
+			// Update the bridge with the connector ID
+			bridge.ConnectorID = &connectorID
+			bridge.State = coredata.SCIMBridgeStateActive
+			bridge.UpdatedAt = time.Now()
+
+			if err := bridge.Update(ctx, tx, scope); err != nil {
+				return fmt.Errorf("cannot update SCIM bridge: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return bridge, nil
+}
+
+func (s OrganizationService) CreateSCIMBridge(
+	ctx context.Context,
+	organizationID gid.GID,
+	scimConfigurationID gid.GID,
+	connectorID gid.GID,
+) (*coredata.SCIMBridge, error) {
+	var (
+		scope  = coredata.NewScopeFromObjectID(organizationID)
+		now    = time.Now()
+		bridge *coredata.SCIMBridge
+	)
+
+	err := s.pg.WithTx(
+		ctx,
+		func(tx pg.Conn) error {
+			organization := &coredata.Organization{}
+			err := organization.LoadByID(ctx, tx, scope, organizationID)
+			if err != nil {
+				if err == coredata.ErrResourceNotFound {
+					return NewOrganizationNotFoundError(organizationID)
+				}
+				return fmt.Errorf("cannot load organization: %w", err)
+			}
+
+			config := &coredata.SCIMConfiguration{}
+			err = config.LoadByID(ctx, tx, scope, scimConfigurationID)
+			if err != nil {
+				if err == coredata.ErrResourceNotFound {
+					return scim.NewSCIMConfigurationNotFoundError(scimConfigurationID)
+				}
+				return fmt.Errorf("cannot load SCIM configuration: %w", err)
+			}
+
+			if config.OrganizationID != organizationID {
+				return scim.NewSCIMConfigurationNotFoundError(scimConfigurationID)
+			}
+
+			// Load and validate the connector (metadata only, no decryption needed)
+			existingConnector := &coredata.Connector{}
+			err = existingConnector.LoadMetadataByID(ctx, tx, scope, connectorID)
+			if err != nil {
+				if err == coredata.ErrResourceNotFound {
+					return NewConnectorNotFoundError(connectorID)
+				}
+
+				return fmt.Errorf("cannot load connector: %w", err)
+			}
+
+			// Verify connector belongs to the same organization
+			if existingConnector.OrganizationID != organizationID {
+				return NewConnectorNotFoundError(connectorID)
+			}
+
+			// Map connector provider to bridge type
+			var bridgeType coredata.SCIMBridgeType
+			switch existingConnector.Provider {
+			case coredata.ConnectorProviderGoogleWorkspace:
+				bridgeType = coredata.SCIMBridgeTypeGoogleWorkspace
+			default:
+				return fmt.Errorf("connector provider %s is not supported for SCIM bridge", existingConnector.Provider)
+			}
+
+			bridge = &coredata.SCIMBridge{
+				ID:                  gid.New(organizationID.TenantID(), coredata.SCIMBridgeEntityType),
+				OrganizationID:      organizationID,
+				ScimConfigurationID: scimConfigurationID,
+				ConnectorID:         &connectorID,
+				Type:                bridgeType,
+				State:               coredata.SCIMBridgeStateActive, // Active immediately since connector already exists
+				CreatedAt:           now,
+				UpdatedAt:           now,
+			}
+
+			if err := bridge.Insert(ctx, tx, scope); err != nil {
+				return fmt.Errorf("cannot insert SCIM bridge: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return bridge, nil
+}
+
+func (s OrganizationService) DeleteSCIMBridge(ctx context.Context, organizationID gid.GID, bridgeID gid.GID) error {
+	var (
+		scope  = coredata.NewScopeFromObjectID(organizationID)
+		bridge = &coredata.SCIMBridge{}
+	)
+
+	err := s.pg.WithTx(
+		ctx,
+		func(tx pg.Conn) error {
+			organization := &coredata.Organization{}
+			err := organization.LoadByID(ctx, tx, scope, organizationID)
+			if err != nil {
+				return fmt.Errorf("cannot load organization: %w", err)
+			}
+
+			if err := bridge.LoadByID(ctx, tx, scope, bridgeID); err != nil {
+				return fmt.Errorf("cannot load SCIM bridge: %w", err)
+			}
+
+			if bridge.OrganizationID != organizationID {
+				return NewSCIMBridgeNotFoundError(bridgeID)
+			}
+
+			if err := bridge.Delete(ctx, tx, scope); err != nil {
+				return fmt.Errorf("cannot delete SCIM bridge: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return err
+	}
+
+	return nil
+}

pkg/probo/actions.go

@@ -278,6 +278,10 @@ const (
 	// SlackConnection actions
 	ActionSlackConnectionList = "core:slack-connection:list"
 
+	// Connector actions (generic)
+	ActionConnectorList   = "core:connector:list"
+	ActionConnectorDelete = "core:connector:delete"
+
 	// DataProtectionImpactAssessment actions
 	ActionDataProtectionImpactAssessmentList   = "core:data-protection-impact-assessment:list"
 	ActionDataProtectionImpactAssessmentGet    = "core:data-protection-impact-assessment:get"

pkg/probo/connector_service.go

@@ -94,6 +94,52 @@ func (s *ConnectorService) ListForOrganizationID(
 	return page.NewPage(connectors, cursor), nil
 }
 
+func (s *ConnectorService) GetByOrganizationIDAndProvider(
+	ctx context.Context,
+	organizationID gid.GID,
+	provider coredata.ConnectorProvider,
+) (*coredata.Connector, error) {
+	var connectors coredata.Connectors
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return connectors.LoadAllByOrganizationIDProtocolAndProvider(
+				ctx,
+				conn,
+				s.svc.scope,
+				organizationID,
+				coredata.ConnectorProtocolOAuth2,
+				provider,
+				s.svc.encryptionKey,
+			)
+		},
+	)
+
+	if err != nil {
+		return nil, fmt.Errorf("cannot get connector: %w", err)
+	}
+
+	if len(connectors) == 0 {
+		return nil, coredata.ErrResourceNotFound
+	}
+
+	return connectors[0], nil
+}
+
+func (s *ConnectorService) Delete(
+	ctx context.Context,
+	connectorID gid.GID,
+) error {
+	return s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			cnnctr := &coredata.Connector{ID: connectorID}
+			return cnnctr.Delete(ctx, conn, s.svc.scope)
+		},
+	)
+}
+
 func (s *ConnectorService) Create(
 	ctx context.Context,
 	req CreateConnectorRequest,

pkg/probo/policies.go

@@ -76,7 +76,7 @@ var ViewerPolicy = policy.NewPolicy(
 		ActionSnapshotGet, ActionSnapshotList,
 		ActionMeetingGet, ActionMeetingList,
 		ActionFileGet, ActionFileDownloadUrl,
-		ActionSlackConnectionList,
+		ActionSlackConnectionList, ActionConnectorList,
 		ActionRightsRequestGet, ActionRightsRequestList,
 		ActionStateOfApplicabilityGet, ActionStateOfApplicabilityList,
 		ActionApplicabilityStatementGet, ActionApplicabilityStatementList,

pkg/probod/connector_config.go

@@ -32,12 +32,13 @@ type (
 	}
 
 	connectorConfigOAuth2 struct {
-		ClientID     string   `json:"client-id"`
-		ClientSecret string   `json:"client-secret"`
-		RedirectURI  string   `json:"redirect-uri"`
-		AuthURL      string   `json:"auth-url"`
-		TokenURL     string   `json:"token-url"`
-		Scopes       []string `json:"scopes"`
+		ClientID        string            `json:"client-id"`
+		ClientSecret    string            `json:"client-secret"`
+		RedirectURI     string            `json:"redirect-uri"`
+		AuthURL         string            `json:"auth-url"`
+		TokenURL        string            `json:"token-url"`
+		Scopes          []string          `json:"scopes"`
+		ExtraAuthParams map[string]string `json:"extra-auth-params,omitempty"`
 	}
 )
 
@@ -85,12 +86,13 @@ func (c *connectorConfig) UnmarshalJSON(data []byte) error {
 		}
 
 		oauth2Connector := connector.OAuth2Connector{
-			ClientID:     config.ClientID,
-			ClientSecret: config.ClientSecret,
-			RedirectURI:  config.RedirectURI,
-			AuthURL:      config.AuthURL,
-			TokenURL:     config.TokenURL,
-			Scopes:       config.Scopes,
+			ClientID:        config.ClientID,
+			ClientSecret:    config.ClientSecret,
+			RedirectURI:     config.RedirectURI,
+			AuthURL:         config.AuthURL,
+			TokenURL:        config.TokenURL,
+			Scopes:          config.Scopes,
+			ExtraAuthParams: config.ExtraAuthParams,
 		}
 
 		c.Config = &oauth2Connector

pkg/server/api/connect/v1/schema.graphql

@@ -347,6 +347,8 @@ type SCIMConfiguration implements Node {
   updatedAt: Datetime!
   organization: Organization @goField(forceResolver: true)
 
+  bridge: SCIMBridge @goField(forceResolver: true)
+
   events(
     first: Int
     after: CursorKey
@@ -360,6 +362,50 @@ type SCIMConfiguration implements Node {
     @session(required: PRESENT)
 }
 
+type SCIMBridge implements Node {
+  id: ID!
+  state: SCIMBridgeState!
+  scimConfiguration: SCIMConfiguration @goField(forceResolver: true)
+  connector: Connector @goField(forceResolver: true)
+  type: SCIMBridgeType!
+  createdAt: Datetime!
+  updatedAt: Datetime!
+
+  permission(action: String!): Boolean!
+    @goField(forceResolver: true)
+    @session(required: PRESENT)
+}
+
+type Connector implements Node {
+  id: ID!
+  provider: ConnectorProvider!
+  createdAt: Datetime!
+  updatedAt: Datetime!
+
+  permission(action: String!): Boolean!
+    @goField(forceResolver: true)
+    @session(required: PRESENT)
+}
+
+enum ConnectorProvider
+  @goModel(model: "go.probo.inc/probo/pkg/coredata.ConnectorProvider") {
+  SLACK @goEnum(value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderSlack")
+  GOOGLE_WORKSPACE
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderGoogleWorkspace")
+}
+
+enum SCIMBridgeType
+  @goModel(model: "go.probo.inc/probo/pkg/coredata.SCIMBridgeType") {
+  GOOGLE_WORKSPACE @goEnum(value: "go.probo.inc/probo/pkg/coredata.SCIMBridgeTypeGoogleWorkspace")
+}
+
+enum SCIMBridgeState
+  @goModel(model: "go.probo.inc/probo/pkg/coredata.SCIMBridgeState") {
+  PENDING @goEnum(value: "go.probo.inc/probo/pkg/coredata.SCIMBridgeStatePending")
+  ACTIVE @goEnum(value: "go.probo.inc/probo/pkg/coredata.SCIMBridgeStateActive")
+  FAILED @goEnum(value: "go.probo.inc/probo/pkg/coredata.SCIMBridgeStateFailed")
+}
+
 type SCIMEvent implements Node {
   id: ID!
   method: String!
@@ -846,6 +892,7 @@ type DeleteSAMLConfigurationPayload {
 
 input CreateSCIMConfigurationInput {
   organizationId: ID!
+  connectorId: ID
 }
 
 input DeleteSCIMConfigurationInput {
@@ -860,6 +907,7 @@ input RegenerateSCIMTokenInput {
 
 type CreateSCIMConfigurationPayload {
   scimConfiguration: SCIMConfiguration!
+  scimBridge: SCIMBridge
   token: String!
 }
 

pkg/server/api/connect/v1/types/bridge.go

@@ -0,0 +1,38 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import "go.probo.inc/probo/pkg/coredata"
+
+func NewSCIMBridge(bridge *coredata.SCIMBridge) *SCIMBridge {
+	var connector *Connector
+	if bridge.ConnectorID != nil {
+		connector = &Connector{
+			ID: *bridge.ConnectorID,
+		}
+	}
+
+	return &SCIMBridge{
+		ID:    bridge.ID,
+		State: bridge.State,
+		ScimConfiguration: &SCIMConfiguration{
+			ID: bridge.ScimConfigurationID,
+		},
+		Connector: connector,
+		Type:      bridge.Type,
+		CreatedAt: bridge.CreatedAt,
+		UpdatedAt: bridge.UpdatedAt,
+	}
+}

pkg/server/api/connect/v1/types/connector.go

@@ -0,0 +1,26 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import "go.probo.inc/probo/pkg/coredata"
+
+func NewConnector(connector *coredata.Connector) *Connector {
+	return &Connector{
+		ID:        connector.ID,
+		Provider:  connector.Provider,
+		CreatedAt: connector.CreatedAt,
+		UpdatedAt: connector.UpdatedAt,
+	}
+}

pkg/server/api/connect/v1/types/scim_configuration.go

@@ -19,12 +19,18 @@ import (
 )
 
 func NewSCIMConfiguration(scimConfiguration *coredata.SCIMConfiguration) *SCIMConfiguration {
+	var bridge *SCIMBridge
+	if scimConfiguration.BridgeID != nil {
+		bridge = &SCIMBridge{
+			ID: *scimConfiguration.BridgeID,
+		}
+	}
+
 	return &SCIMConfiguration{
-		ID: scimConfiguration.ID,
-		Organization: &Organization{
-			ID: scimConfiguration.OrganizationID,
-		},
-		CreatedAt: scimConfiguration.CreatedAt,
-		UpdatedAt: scimConfiguration.UpdatedAt,
+		ID:           scimConfiguration.ID,
+		Organization: &Organization{ID: scimConfiguration.OrganizationID},
+		Bridge:       bridge,
+		CreatedAt:    scimConfiguration.CreatedAt,
+		UpdatedAt:    scimConfiguration.UpdatedAt,
 	}
 }

pkg/server/api/connect/v1/types/types.go

@@ -60,6 +60,17 @@ type ChangePasswordPayload struct {
 	Success bool `json:"success"`
 }
 
+type Connector struct {
+	ID         gid.GID                    `json:"id"`
+	Provider   coredata.ConnectorProvider `json:"provider"`
+	CreatedAt  time.Time                  `json:"createdAt"`
+	UpdatedAt  time.Time                  `json:"updatedAt"`
+	Permission bool                       `json:"permission"`
+}
+
+func (Connector) IsNode()             {}
+func (this Connector) GetID() gid.GID { return this.ID }
+
 type CreateOrganizationInput struct {
 	Name               string          `json:"name"`
 	LogoFile           *graphql.Upload `json:"logoFile,omitempty"`
@@ -96,11 +107,13 @@ type CreateSAMLConfigurationPayload struct {
 }
 
 type CreateSCIMConfigurationInput struct {
-	OrganizationID gid.GID `json:"organizationId"`
+	OrganizationID gid.GID  `json:"organizationId"`
+	ConnectorID    *gid.GID `json:"connectorId,omitempty"`
 }
 
 type CreateSCIMConfigurationPayload struct {
 	ScimConfiguration *SCIMConfiguration `json:"scimConfiguration"`
+	ScimBridge        *SCIMBridge        `json:"scimBridge,omitempty"`
 	Token             string             `json:"token"`
 }
 
@@ -396,12 +409,27 @@ type SAMLConfigurationEdge struct {
 	Cursor page.CursorKey     `json:"cursor"`
 }
 
+type SCIMBridge struct {
+	ID                gid.GID                  `json:"id"`
+	State             coredata.SCIMBridgeState `json:"state"`
+	ScimConfiguration *SCIMConfiguration       `json:"scimConfiguration,omitempty"`
+	Connector         *Connector               `json:"connector,omitempty"`
+	Type              coredata.SCIMBridgeType  `json:"type"`
+	CreatedAt         time.Time                `json:"createdAt"`
+	UpdatedAt         time.Time                `json:"updatedAt"`
+	Permission        bool                     `json:"permission"`
+}
+
+func (SCIMBridge) IsNode()             {}
+func (this SCIMBridge) GetID() gid.GID { return this.ID }
+
 type SCIMConfiguration struct {
 	ID           gid.GID              `json:"id"`
 	EndpointURL  string               `json:"endpointUrl"`
 	CreatedAt    time.Time            `json:"createdAt"`
 	UpdatedAt    time.Time            `json:"updatedAt"`
 	Organization *Organization        `json:"organization,omitempty"`
+	Bridge       *SCIMBridge          `json:"bridge,omitempty"`
 	Events       *SCIMEventConnection `json:"events,omitempty"`
 	Permission   bool                 `json:"permission"`
 }

pkg/server/api/connect/v1/v1_resolver.go

@@ -27,6 +27,11 @@ import (
 	"go.probo.inc/probo/pkg/server/gqlutils/types/cursor"
 )
 
+// Permission is the resolver for the permission field.
+func (r *connectorResolver) Permission(ctx context.Context, obj *types.Connector, action string) (bool, error) {
+	return r.Resolver.Permission(ctx, obj, action)
+}
+
 // Memberships is the resolver for the memberships field.
 func (r *identityResolver) Memberships(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.MembershipOrderBy) (*types.MembershipConnection, error) {
 	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipList); err != nil {
@@ -1119,10 +1124,24 @@ func (r *mutationResolver) CreateSCIMConfiguration(ctx context.Context, input ty
 		return nil, gqlutils.Internal(ctx)
 	}
 
-	return &types.CreateSCIMConfigurationPayload{
+	var bridge *types.SCIMBridge
+
+	if input.ConnectorID != nil {
+		scimBridge, err := r.iam.OrganizationService.CreateSCIMBridge(ctx, input.OrganizationID, config.ID, *input.ConnectorID)
+		if err != nil {
+			r.logger.ErrorCtx(ctx, "cannot create scim bridge", log.Error(err))
+			return nil, gqlutils.Internal(ctx)
+		}
+		bridge = types.NewSCIMBridge(scimBridge)
+	}
+
+	payload := &types.CreateSCIMConfigurationPayload{
 		ScimConfiguration: types.NewSCIMConfiguration(config),
+		ScimBridge:        bridge,
 		Token:             token,
-	}, nil
+	}
+
+	return payload, nil
 }
 
 // DeleteSCIMConfiguration is the resolver for the deleteSCIMConfiguration field.
@@ -1578,6 +1597,63 @@ func (r *sAMLConfigurationConnectionResolver) TotalCount(ctx context.Context, ob
 	return nil, gqlutils.Internal(ctx)
 }
 
+// ScimConfiguration is the resolver for the scimConfiguration field.
+func (r *sCIMBridgeResolver) ScimConfiguration(ctx context.Context, obj *types.SCIMBridge) (*types.SCIMConfiguration, error) {
+	if err := r.authorize(ctx, obj.ScimConfiguration.ID, iam.ActionSCIMConfigurationGet); err != nil {
+		return nil, err
+	}
+
+	if gqlutils.OnlyIDSelected(ctx) {
+		return &types.SCIMConfiguration{
+			ID: obj.ScimConfiguration.ID,
+		}, nil
+	}
+
+	scimConfiguration, err := r.iam.GetSCIMConfiguration(ctx, obj.ScimConfiguration.ID)
+	if err != nil {
+		var errNoSCIMConfigurationFound *iam.ErrNoSCIMConfigurationFound
+		if errors.As(err, &errNoSCIMConfigurationFound) {
+			return nil, nil
+		}
+
+		return nil, err
+	}
+
+	return types.NewSCIMConfiguration(scimConfiguration), nil
+}
+
+// Connector is the resolver for the connector field.
+func (r *sCIMBridgeResolver) Connector(ctx context.Context, obj *types.SCIMBridge) (*types.Connector, error) {
+	if obj.Connector == nil {
+		return nil, nil
+	}
+
+	// Authorize based on the SCIM configuration (connector accessed via bridge is a sub-resource)
+	if err := r.authorize(ctx, obj.ScimConfiguration.ID, iam.ActionSCIMConfigurationGet); err != nil {
+		return nil, err
+	}
+
+	if gqlutils.OnlyIDSelected(ctx) {
+		return &types.Connector{
+			ID: obj.Connector.ID,
+		}, nil
+	}
+
+	// Use metadata-only loading since we don't need the encrypted connection data
+	connector, err := r.iam.OrganizationService.GetConnectorMetadataByID(ctx, obj.Connector.ID)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot get connector", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewConnector(connector), nil
+}
+
+// Permission is the resolver for the permission field.
+func (r *sCIMBridgeResolver) Permission(ctx context.Context, obj *types.SCIMBridge, action string) (bool, error) {
+	return r.Resolver.Permission(ctx, obj, action)
+}
+
 // EndpointURL is the resolver for the endpointUrl field.
 func (r *sCIMConfigurationResolver) EndpointURL(ctx context.Context, obj *types.SCIMConfiguration) (string, error) {
 	return r.baseURL.WithPath("/api/connect/v1/scim/2.0").MustString(), nil
@@ -1609,6 +1685,31 @@ func (r *sCIMConfigurationResolver) Organization(ctx context.Context, obj *types
 	return types.NewOrganization(organization), nil
 }
 
+// Bridge is the resolver for the bridge field.
+func (r *sCIMConfigurationResolver) Bridge(ctx context.Context, obj *types.SCIMConfiguration) (*types.SCIMBridge, error) {
+
+	if obj.Bridge == nil {
+		return nil, nil
+	}
+
+	if err := r.authorize(ctx, obj.ID, iam.ActionSCIMConfigurationGet); err != nil {
+		return nil, err
+	}
+
+	bridge, err := r.iam.OrganizationService.GetSCIMBridgeByID(ctx, obj.Bridge.ID)
+	if err != nil {
+		var errSCIMBridgeNotFound *iam.ErrSCIMBridgeNotFound
+		if errors.As(err, &errSCIMBridgeNotFound) {
+			return nil, nil
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot get scim bridge", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewSCIMBridge(bridge), nil
+}
+
 // Events is the resolver for the events field.
 func (r *sCIMConfigurationResolver) Events(ctx context.Context, obj *types.SCIMConfiguration, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.SCIMEventOrderBy) (*types.SCIMEventConnection, error) {
 	if err := r.authorize(ctx, obj.ID, iam.ActionSCIMEventList); err != nil {
@@ -1734,6 +1835,9 @@ func (r *sessionConnectionResolver) TotalCount(ctx context.Context, obj *types.S
 	return nil, gqlutils.Internal(ctx)
 }
 
+// Connector returns schema.ConnectorResolver implementation.
+func (r *Resolver) Connector() schema.ConnectorResolver { return &connectorResolver{r} }
+
 // Identity returns schema.IdentityResolver implementation.
 func (r *Resolver) Identity() schema.IdentityResolver { return &identityResolver{r} }
 
@@ -1785,6 +1889,9 @@ func (r *Resolver) SAMLConfigurationConnection() schema.SAMLConfigurationConnect
 	return &sAMLConfigurationConnectionResolver{r}
 }
 
+// SCIMBridge returns schema.SCIMBridgeResolver implementation.
+func (r *Resolver) SCIMBridge() schema.SCIMBridgeResolver { return &sCIMBridgeResolver{r} }
+
 // SCIMConfiguration returns schema.SCIMConfigurationResolver implementation.
 func (r *Resolver) SCIMConfiguration() schema.SCIMConfigurationResolver {
 	return &sCIMConfigurationResolver{r}
@@ -1806,6 +1913,7 @@ func (r *Resolver) SessionConnection() schema.SessionConnectionResolver {
 	return &sessionConnectionResolver{r}
 }
 
+type connectorResolver struct{ *Resolver }
 type identityResolver struct{ *Resolver }
 type invitationResolver struct{ *Resolver }
 type invitationConnectionResolver struct{ *Resolver }
@@ -1819,6 +1927,7 @@ type personalAPIKeyConnectionResolver struct{ *Resolver }
 type queryResolver struct{ *Resolver }
 type sAMLConfigurationResolver struct{ *Resolver }
 type sAMLConfigurationConnectionResolver struct{ *Resolver }
+type sCIMBridgeResolver struct{ *Resolver }
 type sCIMConfigurationResolver struct{ *Resolver }
 type sCIMEventResolver struct{ *Resolver }
 type sCIMEventConnectionResolver struct{ *Resolver }

pkg/server/api/console/v1/resolver.go

@@ -21,6 +21,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"net/url"
 	"strings"
 
 	"github.com/go-chi/chi/v5"
@@ -76,7 +77,7 @@ func NewMux(
 
 		r.Get("/connectors/initiate", func(w http.ResponseWriter, r *http.Request) {
 			provider := r.URL.Query().Get("provider")
-			if provider != "SLACK" {
+			if provider != "SLACK" && provider != "GOOGLE_WORKSPACE" {
 				httpserver.RenderError(w, http.StatusBadRequest, fmt.Errorf("unsupported provider"))
 				return
 			}
@@ -118,9 +119,15 @@ func NewMux(
 				panic(fmt.Errorf("cannot initiate connector: %w", err))
 			}
 
-			// Allow external redirects for Slack OAuth only for now
-			slackSafeRedirect := &saferedirect.SafeRedirect{AllowedHost: "slack.com"}
-			slackSafeRedirect.Redirect(w, r, redirectURL, "/", http.StatusSeeOther)
+			// Allow external redirects for OAuth providers
+			var oauthSafeRedirect *saferedirect.SafeRedirect
+			switch provider {
+			case "SLACK":
+				oauthSafeRedirect = &saferedirect.SafeRedirect{AllowedHost: "slack.com"}
+			case "GOOGLE_WORKSPACE":
+				oauthSafeRedirect = &saferedirect.SafeRedirect{AllowedHost: "accounts.google.com"}
+			}
+			oauthSafeRedirect.Redirect(w, r, redirectURL, "/", http.StatusSeeOther)
 		})
 
 		r.Get("/connectors/complete", func(w http.ResponseWriter, r *http.Request) {
@@ -134,6 +141,8 @@ func NewMux(
 			switch provider {
 			case "SLACK":
 				connectorProvider = coredata.ConnectorProviderSlack
+			case "GOOGLE_WORKSPACE":
+				connectorProvider = coredata.ConnectorProviderGoogleWorkspace
 			default:
 				httpserver.RenderError(w, http.StatusBadRequest, fmt.Errorf("unsupported provider"))
 				return
@@ -145,16 +154,14 @@ func NewMux(
 				return
 			}
 
-			connection, organizationID, err := connectorRegistry.Complete(r.Context(), provider, r)
+			connection, organizationID, continueURL, err := connectorRegistry.Complete(r.Context(), provider, r)
 			if err != nil {
 				panic(fmt.Errorf("cannot complete connector: %w", err))
 			}
 
-			continueURL := r.URL.Query().Get("continue")
-
 			svc := proboSvc.WithTenant(organizationID.TenantID())
 
-			_, err = svc.Connectors.Create(
+			connector, err := svc.Connectors.Create(
 				r.Context(),
 				probo.CreateConnectorRequest{
 					OrganizationID: *organizationID,
@@ -167,12 +174,22 @@ func NewMux(
 				panic(fmt.Errorf("cannot create or update connector: %w", err))
 			}
 
-			if continueURL != "" {
-				safeRedirect.Redirect(w, r, continueURL, "/", http.StatusSeeOther)
-			} else {
-				redirectURL := baseURL.WithPath("/organizations/" + organizationID.String()).MustString()
-				safeRedirect.Redirect(w, r, redirectURL, "/", http.StatusSeeOther)
+			// Append connector_id to the redirect URL so frontend can create the bridge
+			redirectURL := continueURL
+			if redirectURL == "" {
+				redirectURL = baseURL.WithPath("/organizations/" + organizationID.String()).MustString()
 			}
+
+			parsedURL, err := url.Parse(redirectURL)
+			if err != nil {
+				logger.ErrorCtx(r.Context(), "cannot parse redirect URL", log.Error(err))
+				parsedURL, _ = url.Parse(baseURL.WithPath("/organizations/" + organizationID.String()).MustString())
+			}
+			q := parsedURL.Query()
+			q.Set("connector_id", connector.ID.String())
+			parsedURL.RawQuery = q.Encode()
+
+			safeRedirect.Redirect(w, r, parsedURL.String(), "/", http.StatusSeeOther)
 		})
 	})