Add scim bridge with connector

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

apps/console/src/__generated__/iam/ConnectorListFragment.graphql.ts

@@ -0,0 +1,53 @@
+/**
+ * @generated SignedSource<<042ba763926f3dddfcf4f9d673ae5201>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ReaderFragment } from 'relay-runtime';
+import { FragmentRefs } from "relay-runtime";
+export type ConnectorListFragment$data = {
+  readonly scimConfiguration: {
+    readonly " $fragmentSpreads": FragmentRefs<"GoogleWorkspaceConnectorFragment">;
+  } | null | undefined;
+  readonly " $fragmentType": "ConnectorListFragment";
+};
+export type ConnectorListFragment$key = {
+  readonly " $data"?: ConnectorListFragment$data;
+  readonly " $fragmentSpreads": FragmentRefs<"ConnectorListFragment">;
+};
+
+const node: ReaderFragment = {
+  "argumentDefinitions": [],
+  "kind": "Fragment",
+  "metadata": null,
+  "name": "ConnectorListFragment",
+  "selections": [
+    {
+      "alias": null,
+      "args": null,
+      "concreteType": "SCIMConfiguration",
+      "kind": "LinkedField",
+      "name": "scimConfiguration",
+      "plural": false,
+      "selections": [
+        {
+          "args": null,
+          "kind": "FragmentSpread",
+          "name": "GoogleWorkspaceConnectorFragment"
+        }
+      ],
+      "storageKey": null
+    }
+  ],
+  "type": "Organization",
+  "abstractKey": null
+};
+
+(node as any).hash = "32fd94ab5080bb8deba95ab24b545fc1";
+
+export default node;

apps/console/src/__generated__/iam/GoogleWorkspaceConnectorDeleteMutation.graphql.ts

@@ -0,0 +1,93 @@
+/**
+ * @generated SignedSource<<b7e9a7b1979b5caf109266b80803fdbf>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type DeleteSCIMConfigurationInput = {
+  organizationId: string;
+  scimConfigurationId: string;
+};
+export type GoogleWorkspaceConnectorDeleteMutation$variables = {
+  input: DeleteSCIMConfigurationInput;
+};
+export type GoogleWorkspaceConnectorDeleteMutation$data = {
+  readonly deleteSCIMConfiguration: {
+    readonly deletedScimConfigurationId: string;
+  } | null | undefined;
+};
+export type GoogleWorkspaceConnectorDeleteMutation = {
+  response: GoogleWorkspaceConnectorDeleteMutation$data;
+  variables: GoogleWorkspaceConnectorDeleteMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "input"
+  }
+],
+v1 = [
+  {
+    "alias": null,
+    "args": [
+      {
+        "kind": "Variable",
+        "name": "input",
+        "variableName": "input"
+      }
+    ],
+    "concreteType": "DeleteSCIMConfigurationPayload",
+    "kind": "LinkedField",
+    "name": "deleteSCIMConfiguration",
+    "plural": false,
+    "selections": [
+      {
+        "alias": null,
+        "args": null,
+        "kind": "ScalarField",
+        "name": "deletedScimConfigurationId",
+        "storageKey": null
+      }
+    ],
+    "storageKey": null
+  }
+];
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "GoogleWorkspaceConnectorDeleteMutation",
+    "selections": (v1/*: any*/),
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "GoogleWorkspaceConnectorDeleteMutation",
+    "selections": (v1/*: any*/)
+  },
+  "params": {
+    "cacheID": "8fa5927c728a768a19fd163d162facac",
+    "id": null,
+    "metadata": {},
+    "name": "GoogleWorkspaceConnectorDeleteMutation",
+    "operationKind": "mutation",
+    "text": "mutation GoogleWorkspaceConnectorDeleteMutation(\n  $input: DeleteSCIMConfigurationInput!\n) {\n  deleteSCIMConfiguration(input: $input) {\n    deletedScimConfigurationId\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "fc1502ef215040eda187b2f782adb530";
+
+export default node;

apps/console/src/__generated__/iam/GoogleWorkspaceConnectorFragment.graphql.ts

@@ -0,0 +1,90 @@
+/**
+ * @generated SignedSource<<2beb895d75d5cbcbd64a59387e35c281>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ReaderFragment } from 'relay-runtime';
+export type ConnectorProvider = "GOOGLE_WORKSPACE" | "SLACK";
+import { FragmentRefs } from "relay-runtime";
+export type GoogleWorkspaceConnectorFragment$data = {
+  readonly bridge: {
+    readonly connector: {
+      readonly createdAt: string;
+      readonly id: string;
+      readonly provider: ConnectorProvider;
+    } | null | undefined;
+  } | null | undefined;
+  readonly id: string;
+  readonly " $fragmentType": "GoogleWorkspaceConnectorFragment";
+};
+export type GoogleWorkspaceConnectorFragment$key = {
+  readonly " $data"?: GoogleWorkspaceConnectorFragment$data;
+  readonly " $fragmentSpreads": FragmentRefs<"GoogleWorkspaceConnectorFragment">;
+};
+
+const node: ReaderFragment = (function(){
+var v0 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+};
+return {
+  "argumentDefinitions": [],
+  "kind": "Fragment",
+  "metadata": null,
+  "name": "GoogleWorkspaceConnectorFragment",
+  "selections": [
+    (v0/*: any*/),
+    {
+      "alias": null,
+      "args": null,
+      "concreteType": "SCIMBridge",
+      "kind": "LinkedField",
+      "name": "bridge",
+      "plural": false,
+      "selections": [
+        {
+          "alias": null,
+          "args": null,
+          "concreteType": "Connector",
+          "kind": "LinkedField",
+          "name": "connector",
+          "plural": false,
+          "selections": [
+            (v0/*: any*/),
+            {
+              "alias": null,
+              "args": null,
+              "kind": "ScalarField",
+              "name": "provider",
+              "storageKey": null
+            },
+            {
+              "alias": null,
+              "args": null,
+              "kind": "ScalarField",
+              "name": "createdAt",
+              "storageKey": null
+            }
+          ],
+          "storageKey": null
+        }
+      ],
+      "storageKey": null
+    }
+  ],
+  "type": "SCIMConfiguration",
+  "abstractKey": null
+};
+})();
+
+(node as any).hash = "180a97ae989c22060d815280ec2f7b67";
+
+export default node;

apps/console/src/__generated__/iam/SCIMConfigurationCreateMutation.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<481d9c3c647c11a95d68ff7e4a489a24>>
+ * @generated SignedSource<<29e2f3791be9e59a1c61033e31eb0134>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -10,6 +10,7 @@
 
 import { ConcreteRequest } from 'relay-runtime';
 export type CreateSCIMConfigurationInput = {
+  connectorId?: string | null | undefined;
   organizationId: string;
 };
 export type SCIMConfigurationCreateMutation$variables = {

apps/console/src/__generated__/iam/SCIMConfigurationFragment.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<17691f5400c05fd0281c9320b9fb86b9>>
+ * @generated SignedSource<<dfd688860df6b21ffe3a3f14bb2e2bf1>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -11,8 +11,15 @@
 import { ReaderFragment } from 'relay-runtime';
 import { FragmentRefs } from "relay-runtime";
 export type SCIMConfigurationFragment$data = {
-  readonly endpointUrl: string;
+  readonly canCreateSCIMConfiguration: boolean;
-  readonly id: string;
+  readonly canDeleteSCIMConfiguration: boolean;
+  readonly scimConfiguration: {
+    readonly bridge: {
+      readonly id: string;
+    } | null | undefined;
+    readonly endpointUrl: string;
+    readonly id: string;
+  } | null | undefined;
   readonly " $fragmentType": "SCIMConfigurationFragment";
 };
 export type SCIMConfigurationFragment$key = {
@@ -20,31 +27,83 @@ export type SCIMConfigurationFragment$key = {
   readonly " $fragmentSpreads": FragmentRefs<"SCIMConfigurationFragment">;
 };
 
-const node: ReaderFragment = {
+const node: ReaderFragment = (function(){
+var v0 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+};
+return {
   "argumentDefinitions": [],
   "kind": "Fragment",
   "metadata": null,
   "name": "SCIMConfigurationFragment",
   "selections": [
     {
-      "alias": null,
+      "alias": "canCreateSCIMConfiguration",
-      "args": null,
+      "args": [
+        {
+          "kind": "Literal",
+          "name": "action",
+          "value": "iam:scim-configuration:create"
+        }
+      ],
       "kind": "ScalarField",
-      "name": "id",
+      "name": "permission",
-      "storageKey": null
+      "storageKey": "permission(action:\"iam:scim-configuration:create\")"
+    },
+    {
+      "alias": "canDeleteSCIMConfiguration",
+      "args": [
+        {
+          "kind": "Literal",
+          "name": "action",
+          "value": "iam:scim-configuration:delete"
+        }
+      ],
+      "kind": "ScalarField",
+      "name": "permission",
+      "storageKey": "permission(action:\"iam:scim-configuration:delete\")"
     },
     {
       "alias": null,
       "args": null,
-      "kind": "ScalarField",
+      "concreteType": "SCIMConfiguration",
-      "name": "endpointUrl",
+      "kind": "LinkedField",
+      "name": "scimConfiguration",
+      "plural": false,
+      "selections": [
+        (v0/*: any*/),
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "endpointUrl",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "concreteType": "SCIMBridge",
+          "kind": "LinkedField",
+          "name": "bridge",
+          "plural": false,
+          "selections": [
+            (v0/*: any*/)
+          ],
+          "storageKey": null
+        }
+      ],
       "storageKey": null
     }
   ],
-  "type": "SCIMConfiguration",
+  "type": "Organization",
   "abstractKey": null
 };
+})();
 
-(node as any).hash = "5bd76da1abe24699f9895857cda748b1";
+(node as any).hash = "5b128ae2e680a0ffe0dd931e4e86f52e";
 
 export default node;

apps/console/src/__generated__/iam/SCIMSettingsPageCreateSCIMConfigurationMutation.graphql.ts

@@ -0,0 +1,120 @@
+/**
+ * @generated SignedSource<<4b9c832eb09c31751c1da609cda983ba>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type CreateSCIMConfigurationInput = {
+  connectorId?: string | null | undefined;
+  organizationId: string;
+};
+export type SCIMSettingsPageCreateSCIMConfigurationMutation$variables = {
+  input: CreateSCIMConfigurationInput;
+};
+export type SCIMSettingsPageCreateSCIMConfigurationMutation$data = {
+  readonly createSCIMConfiguration: {
+    readonly scimBridge: {
+      readonly id: string;
+    } | null | undefined;
+    readonly scimConfiguration: {
+      readonly id: string;
+    };
+  } | null | undefined;
+};
+export type SCIMSettingsPageCreateSCIMConfigurationMutation = {
+  response: SCIMSettingsPageCreateSCIMConfigurationMutation$data;
+  variables: SCIMSettingsPageCreateSCIMConfigurationMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "input"
+  }
+],
+v1 = [
+  {
+    "alias": null,
+    "args": null,
+    "kind": "ScalarField",
+    "name": "id",
+    "storageKey": null
+  }
+],
+v2 = [
+  {
+    "alias": null,
+    "args": [
+      {
+        "kind": "Variable",
+        "name": "input",
+        "variableName": "input"
+      }
+    ],
+    "concreteType": "CreateSCIMConfigurationPayload",
+    "kind": "LinkedField",
+    "name": "createSCIMConfiguration",
+    "plural": false,
+    "selections": [
+      {
+        "alias": null,
+        "args": null,
+        "concreteType": "SCIMConfiguration",
+        "kind": "LinkedField",
+        "name": "scimConfiguration",
+        "plural": false,
+        "selections": (v1/*: any*/),
+        "storageKey": null
+      },
+      {
+        "alias": null,
+        "args": null,
+        "concreteType": "SCIMBridge",
+        "kind": "LinkedField",
+        "name": "scimBridge",
+        "plural": false,
+        "selections": (v1/*: any*/),
+        "storageKey": null
+      }
+    ],
+    "storageKey": null
+  }
+];
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "SCIMSettingsPageCreateSCIMConfigurationMutation",
+    "selections": (v2/*: any*/),
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "SCIMSettingsPageCreateSCIMConfigurationMutation",
+    "selections": (v2/*: any*/)
+  },
+  "params": {
+    "cacheID": "281c9e39b96e2e56c3f4379f8dd8dc30",
+    "id": null,
+    "metadata": {},
+    "name": "SCIMSettingsPageCreateSCIMConfigurationMutation",
+    "operationKind": "mutation",
+    "text": "mutation SCIMSettingsPageCreateSCIMConfigurationMutation(\n  $input: CreateSCIMConfigurationInput!\n) {\n  createSCIMConfiguration(input: $input) {\n    scimConfiguration {\n      id\n    }\n    scimBridge {\n      id\n    }\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "841dfdb5ce8a226c7e683090c75951f0";
+
+export default node;

apps/console/src/__generated__/iam/SCIMSettingsPageQuery.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<5507ea6452d9065f29d74bf685ea3777>>
+ * @generated SignedSource<<8e3a5e8f3e57e3097149f28537f50e31>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -16,12 +16,15 @@ export type SCIMSettingsPageQuery$variables = {
 export type SCIMSettingsPageQuery$data = {
   readonly organization: {
     readonly __typename: "Organization";
-    readonly canCreateSCIMConfiguration: boolean;
-    readonly canDeleteSCIMConfiguration: boolean;
     readonly id: string;
     readonly scimConfiguration: {
-      readonly " $fragmentSpreads": FragmentRefs<"SCIMConfigurationFragment" | "SCIMEventListFragment">;
+      readonly bridge: {
+        readonly id: string;
+      } | null | undefined;
+      readonly id: string;
+      readonly " $fragmentSpreads": FragmentRefs<"SCIMEventListFragment">;
     } | null | undefined;
+    readonly " $fragmentSpreads": FragmentRefs<"ConnectorListFragment" | "SCIMConfigurationFragment">;
   } | {
     // This will never be '%other', but we need some
     // value in case none of the concrete values match.
@@ -63,32 +66,13 @@ v3 = {
   "storageKey": null
 },
 v4 = {
-  "alias": "canCreateSCIMConfiguration",
+  "alias": null,
-  "args": [
+  "args": null,
-    {
-      "kind": "Literal",
-      "name": "action",
-      "value": "iam:scim-configuration:create"
-    }
-  ],
   "kind": "ScalarField",
-  "name": "permission",
+  "name": "createdAt",
-  "storageKey": "permission(action:\"iam:scim-configuration:create\")"
+  "storageKey": null
 },
-v5 = {
+v5 = [
-  "alias": "canDeleteSCIMConfiguration",
-  "args": [
-    {
-      "kind": "Literal",
-      "name": "action",
-      "value": "iam:scim-configuration:delete"
-    }
-  ],
-  "kind": "ScalarField",
-  "name": "permission",
-  "storageKey": "permission(action:\"iam:scim-configuration:delete\")"
-},
-v6 = [
   {
     "kind": "Literal",
     "name": "first",
@@ -117,8 +101,6 @@ return {
               "kind": "InlineFragment",
               "selections": [
                 (v3/*: any*/),
-                (v4/*: any*/),
-                (v5/*: any*/),
                 {
                   "alias": null,
                   "args": null,
@@ -127,10 +109,18 @@ return {
                   "name": "scimConfiguration",
                   "plural": false,
                   "selections": [
+                    (v3/*: any*/),
                     {
+                      "alias": null,
                       "args": null,
-                      "kind": "FragmentSpread",
+                      "concreteType": "SCIMBridge",
-                      "name": "SCIMConfigurationFragment"
+                      "kind": "LinkedField",
+                      "name": "bridge",
+                      "plural": false,
+                      "selections": [
+                        (v3/*: any*/)
+                      ],
+                      "storageKey": null
                     },
                     {
                       "args": null,
@@ -139,6 +129,16 @@ return {
                     }
                   ],
                   "storageKey": null
+                },
+                {
+                  "args": null,
+                  "kind": "FragmentSpread",
+                  "name": "SCIMConfigurationFragment"
+                },
+                {
+                  "args": null,
+                  "kind": "FragmentSpread",
+                  "name": "ConnectorListFragment"
                 }
               ],
               "type": "Organization",
@@ -172,8 +172,6 @@ return {
           {
             "kind": "InlineFragment",
             "selections": [
-              (v4/*: any*/),
-              (v5/*: any*/),
               {
                 "alias": null,
                 "args": null,
@@ -186,13 +184,38 @@ return {
                   {
                     "alias": null,
                     "args": null,
-                    "kind": "ScalarField",
+                    "concreteType": "SCIMBridge",
-                    "name": "endpointUrl",
+                    "kind": "LinkedField",
+                    "name": "bridge",
+                    "plural": false,
+                    "selections": [
+                      (v3/*: any*/),
+                      {
+                        "alias": null,
+                        "args": null,
+                        "concreteType": "Connector",
+                        "kind": "LinkedField",
+                        "name": "connector",
+                        "plural": false,
+                        "selections": [
+                          (v3/*: any*/),
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "provider",
+                            "storageKey": null
+                          },
+                          (v4/*: any*/)
+                        ],
+                        "storageKey": null
+                      }
+                    ],
                     "storageKey": null
                   },
                   {
                     "alias": null,
-                    "args": (v6/*: any*/),
+                    "args": (v5/*: any*/),
                     "concreteType": "SCIMEventConnection",
                     "kind": "LinkedField",
                     "name": "events",
@@ -250,13 +273,7 @@ return {
                                 "name": "ipAddress",
                                 "storageKey": null
                               },
-                              {
+                              (v4/*: any*/),
-                                "alias": null,
-                                "args": null,
-                                "kind": "ScalarField",
-                                "name": "createdAt",
-                                "storageKey": null
-                              },
                               {
                                 "alias": null,
                                 "args": null,
@@ -346,15 +363,48 @@ return {
                   },
                   {
                     "alias": null,
-                    "args": (v6/*: any*/),
+                    "args": (v5/*: any*/),
                     "filters": null,
                     "handle": "connection",
                     "key": "SCIMEventListFragment_events",
                     "kind": "LinkedHandle",
                     "name": "events"
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "endpointUrl",
+                    "storageKey": null
                   }
                 ],
                 "storageKey": null
+              },
+              {
+                "alias": "canCreateSCIMConfiguration",
+                "args": [
+                  {
+                    "kind": "Literal",
+                    "name": "action",
+                    "value": "iam:scim-configuration:create"
+                  }
+                ],
+                "kind": "ScalarField",
+                "name": "permission",
+                "storageKey": "permission(action:\"iam:scim-configuration:create\")"
+              },
+              {
+                "alias": "canDeleteSCIMConfiguration",
+                "args": [
+                  {
+                    "kind": "Literal",
+                    "name": "action",
+                    "value": "iam:scim-configuration:delete"
+                  }
+                ],
+                "kind": "ScalarField",
+                "name": "permission",
+                "storageKey": "permission(action:\"iam:scim-configuration:delete\")"
               }
             ],
             "type": "Organization",
@@ -366,16 +416,16 @@ return {
     ]
   },
   "params": {
-    "cacheID": "89bcad16c50ccf4ef4afd0345b02fe4a",
+    "cacheID": "eabd000a44bc720b07342557eedac872",
     "id": null,
     "metadata": {},
     "name": "SCIMSettingsPageQuery",
     "operationKind": "query",
-    "text": "query SCIMSettingsPageQuery(\n  $organizationId: ID!\n) {\n  organization: node(id: $organizationId) {\n    __typename\n    ... on Organization {\n      id\n      canCreateSCIMConfiguration: permission(action: \"iam:scim-configuration:create\")\n      canDeleteSCIMConfiguration: permission(action: \"iam:scim-configuration:delete\")\n      scimConfiguration {\n        ...SCIMConfigurationFragment\n        ...SCIMEventListFragment\n        id\n      }\n    }\n    id\n  }\n}\n\nfragment SCIMConfigurationFragment on SCIMConfiguration {\n  id\n  endpointUrl\n}\n\nfragment SCIMEventListFragment on SCIMConfiguration {\n  events(first: 20) {\n    edges {\n      node {\n        id\n        ...SCIMEventListItemFragment\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n\nfragment SCIMEventListItemFragment on SCIMEvent {\n  id\n  method\n  path\n  statusCode\n  errorMessage\n  ipAddress\n  createdAt\n  membership {\n    id\n    profile {\n      fullName\n      id\n    }\n  }\n}\n"
+    "text": "query SCIMSettingsPageQuery(\n  $organizationId: ID!\n) {\n  organization: node(id: $organizationId) {\n    __typename\n    ... on Organization {\n      id\n      scimConfiguration {\n        id\n        bridge {\n          id\n        }\n        ...SCIMEventListFragment\n      }\n      ...SCIMConfigurationFragment\n      ...ConnectorListFragment\n    }\n    id\n  }\n}\n\nfragment ConnectorListFragment on Organization {\n  scimConfiguration {\n    ...GoogleWorkspaceConnectorFragment\n    id\n  }\n}\n\nfragment GoogleWorkspaceConnectorFragment on SCIMConfiguration {\n  id\n  bridge {\n    connector {\n      id\n      provider\n      createdAt\n    }\n    id\n  }\n}\n\nfragment SCIMConfigurationFragment on Organization {\n  canCreateSCIMConfiguration: permission(action: \"iam:scim-configuration:create\")\n  canDeleteSCIMConfiguration: permission(action: \"iam:scim-configuration:delete\")\n  scimConfiguration {\n    id\n    endpointUrl\n    bridge {\n      id\n    }\n  }\n}\n\nfragment SCIMEventListFragment on SCIMConfiguration {\n  events(first: 20) {\n    edges {\n      node {\n        id\n        ...SCIMEventListItemFragment\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n\nfragment SCIMEventListItemFragment on SCIMEvent {\n  id\n  method\n  path\n  statusCode\n  errorMessage\n  ipAddress\n  createdAt\n  membership {\n    id\n    profile {\n      fullName\n      id\n    }\n  }\n}\n"
   }
 };
 })();
 
-(node as any).hash = "051cceb15c9eaf30694189c259b6d715";
+(node as any).hash = "9db69676a14d2a6c4062fee58ce728e1";
 
 export default node;

apps/console/src/pages/iam/organizations/settings/SCIMSettingsPage.tsx

@@ -1,8 +1,14 @@
 import { useTranslate } from "@probo/i18n";
-import { graphql, type PreloadedQuery, usePreloadedQuery } from "react-relay";
+import { Spinner } from "@probo/ui";
+import { useEffect, useRef } from "react";
+import { graphql, type PreloadedQuery,
+  useMutation, usePreloadedQuery } from "react-relay";
+import { useSearchParams } from "react-router";
 
+import type { SCIMSettingsPageCreateSCIMConfigurationMutation } from "#/__generated__/iam/SCIMSettingsPageCreateSCIMConfigurationMutation.graphql";
 import type { SCIMSettingsPageQuery } from "#/__generated__/iam/SCIMSettingsPageQuery.graphql";
 
+import { ConnectorList } from "./_components/ConnectorList";
 import { SCIMConfiguration } from "./_components/SCIMConfiguration";
 import { SCIMEventList } from "./_components/SCIMEventList";
 
@@ -12,17 +18,32 @@ export const scimSettingsPageQuery = graphql`
       __typename
       ... on Organization {
         id
-        canCreateSCIMConfiguration: permission(
-          action: "iam:scim-configuration:create"
-        )
-        canDeleteSCIMConfiguration: permission(
-          action: "iam:scim-configuration:delete"
-        )
 
         scimConfiguration {
-          ...SCIMConfigurationFragment
+          id
+          bridge {
+            id
+          }
           ...SCIMEventListFragment
         }
+
+        ...SCIMConfigurationFragment
+        ...ConnectorListFragment
+      }
+    }
+  }
+`;
+
+const createSCIMConfigurationMutation = graphql`
+  mutation SCIMSettingsPageCreateSCIMConfigurationMutation(
+    $input: CreateSCIMConfigurationInput!
+  ) {
+    createSCIMConfiguration(input: $input) {
+      scimConfiguration {
+        id
+      }
+      scimBridge {
+        id
       }
     }
   }
@@ -33,26 +54,117 @@ export function SCIMSettingsPage(props: {
 }) {
   const { queryRef } = props;
   const { __ } = useTranslate();
+  const [searchParams, setSearchParams] = useSearchParams();
+  const connectorId = searchParams.get("connector_id");
+  const mutationTriggeredRef = useRef(false);
 
   const { organization } = usePreloadedQuery(scimSettingsPageQuery, queryRef);
   if (organization.__typename !== "Organization") {
     throw new Error("invalid node type");
   }
 
+  const [createSCIMConfiguration]
+    = useMutation<SCIMSettingsPageCreateSCIMConfigurationMutation>(
+      createSCIMConfigurationMutation,
+    );
+
+  // Auto-create SCIM configuration and bridge when connector_id is in URL
+  useEffect(() => {
+    if (!connectorId || mutationTriggeredRef.current) return;
+
+    // Don't create if SCIM config already exists
+    if (organization.scimConfiguration?.id) {
+      setSearchParams((params: URLSearchParams) => {
+        params.delete("connector_id");
+        return params;
+      });
+      return;
+    }
+
+    mutationTriggeredRef.current = true;
+
+    createSCIMConfiguration({
+      variables: {
+        input: {
+          organizationId: organization.id,
+          connectorId: connectorId,
+        },
+      },
+      onCompleted: () => {
+        const url = new URL(window.location.href);
+        url.searchParams.delete("connector_id");
+        window.location.href = url.toString();
+      },
+      onError: (error) => {
+        console.error("Failed to create SCIM configuration:", error);
+        mutationTriggeredRef.current = false;
+        setSearchParams((params: URLSearchParams) => {
+          params.delete("connector_id");
+          return params;
+        });
+      },
+    });
+  }, [
+    connectorId,
+    organization.id,
+    organization.scimConfiguration?.id,
+    createSCIMConfiguration,
+    setSearchParams,
+  ]);
+
+  // Show loader while creating SCIM configuration
+  if (connectorId) {
+    return (
+      <div className="flex items-center justify-center py-12">
+        <Spinner size={24} />
+      </div>
+    );
+  }
+
+  // Check if connected via Identity Provider (SCIM config has a bridge)
+  const hasIdentityProvider = !!organization.scimConfiguration?.bridge;
+
+  // Check if Manual SCIM is configured (SCIM config exists but no bridge)
+  const hasManualScim = !!organization.scimConfiguration && !organization.scimConfiguration.bridge;
+
+  // Show Identity Provider section when:
+  // - No SCIM config yet (user can connect)
+  // - Or SCIM config with bridge (already connected via IdP)
+  const showIdentityProviderSection = !organization.scimConfiguration || hasIdentityProvider;
+
+  // Show Manual SCIM section when:
+  // - Manual SCIM is configured (no bridge)
+  // - Or no SCIM config at all (user can choose to enable manual)
+  const showManualScimSection = hasManualScim || !organization.scimConfiguration;
+
+  // Show provisioning events when SCIM is configured (either manual or via IdP)
+  const showProvisioningEvents = !!organization.scimConfiguration;
+
   return (
     <div className="space-y-8">
-      <div className="space-y-4">
+      {showIdentityProviderSection && (
-        <h2 className="text-base font-medium">{__("SCIM Provisioning")}</h2>
+        <ConnectorList fKey={organization} />
-        <SCIMConfiguration
+      )}
-          fKey={organization.scimConfiguration ?? null}
-          canCreate={organization.canCreateSCIMConfiguration}
-          canDelete={organization.canDeleteSCIMConfiguration}
-        />
-      </div>
 
-      {organization.scimConfiguration && (
+      {showManualScimSection && (
         <div className="space-y-4">
-          <h2 className="text-base font-medium">{__("SCIM Event History")}</h2>
+          <h2 className="text-base font-medium">{__("Manual SCIM")}</h2>
+          {!hasManualScim && (
+            <p className="text-sm text-txt-secondary">
+              {__(
+                "Configure SCIM manually if your identity provider is not listed above. This requires setting up the SCIM endpoint URL and bearer token in your identity provider.",
+              )}
+            </p>
+          )}
+          <SCIMConfiguration fKey={organization} />
+        </div>
+      )}
+
+      {showProvisioningEvents && (
+        <div className="space-y-4">
+          <h2 className="text-base font-medium">
+            {__("Provisioning Event History")}
+          </h2>
           <SCIMEventList fKey={organization.scimConfiguration} />
         </div>
       )}

apps/console/src/pages/iam/organizations/settings/_components/ConnectorList.tsx

@@ -0,0 +1,32 @@
+import { useTranslate } from "@probo/i18n";
+import { graphql, useFragment } from "react-relay";
+
+import type { ConnectorListFragment$key } from "#/__generated__/iam/ConnectorListFragment.graphql";
+
+import { GoogleWorkspaceConnector } from "./GoogleWorkspaceConnector";
+
+const connectorListFragment = graphql`
+  fragment ConnectorListFragment on Organization {
+    scimConfiguration {
+      ...GoogleWorkspaceConnectorFragment
+    }
+  }
+`;
+
+export function ConnectorList(props: { fKey: ConnectorListFragment$key }) {
+  const { fKey } = props;
+  const data = useFragment<ConnectorListFragment$key>(connectorListFragment, fKey);
+  const { __ } = useTranslate();
+
+  return (
+    <div className="space-y-4">
+      <h2 className="text-base font-medium">{__("Identity Provider")}</h2>
+      <p className="text-sm text-txt-secondary">
+        {__(
+          "Connect your identity provider to automatically sync users to your organization. Once connected, you don't need to configure SCIM manually.",
+        )}
+      </p>
+      <GoogleWorkspaceConnector fKey={data.scimConfiguration ?? null} />
+    </div>
+  );
+}

apps/console/src/pages/iam/organizations/settings/_components/GoogleWorkspaceConnector.tsx

@@ -0,0 +1,171 @@
+import { sprintf } from "@probo/helpers";
+import { useTranslate } from "@probo/i18n";
+import {
+  Badge,
+  Button,
+  Card,
+  Dialog,
+  DialogContent,
+  DialogFooter,
+  useDialogRef,
+} from "@probo/ui";
+import { graphql, useFragment } from "react-relay";
+
+import type { GoogleWorkspaceConnectorDeleteMutation } from "#/__generated__/iam/GoogleWorkspaceConnectorDeleteMutation.graphql";
+import type { GoogleWorkspaceConnectorFragment$key } from "#/__generated__/iam/GoogleWorkspaceConnectorFragment.graphql";
+import { useMutationWithToasts } from "#/hooks/useMutationWithToasts";
+import { useOrganizationId } from "#/hooks/useOrganizationId";
+
+const googleWorkspaceConnectorFragment = graphql`
+  fragment GoogleWorkspaceConnectorFragment on SCIMConfiguration {
+    id
+    bridge {
+      connector {
+        id
+        createdAt
+      }
+    }
+  }
+`;
+
+const deleteSCIMConfigurationMutation = graphql`
+  mutation GoogleWorkspaceConnectorDeleteMutation(
+    $input: DeleteSCIMConfigurationInput!
+  ) {
+    deleteSCIMConfiguration(input: $input) {
+      deletedScimConfigurationId
+    }
+  }
+`;
+
+export function GoogleWorkspaceConnector(props: {
+  fKey: GoogleWorkspaceConnectorFragment$key | null;
+}) {
+  const { fKey } = props;
+  const data = useFragment<GoogleWorkspaceConnectorFragment$key>(googleWorkspaceConnectorFragment, fKey);
+  const connector = data?.bridge?.connector;
+  const scimConfigurationId = data?.id;
+
+  const organizationId = useOrganizationId();
+  const { __, dateTimeFormat } = useTranslate();
+  const dialogRef = useDialogRef();
+
+  const [deleteSCIMConfiguration, isDeleting]
+    = useMutationWithToasts<GoogleWorkspaceConnectorDeleteMutation>(
+      deleteSCIMConfigurationMutation,
+      {
+        successMessage: __("Google Workspace disconnected successfully"),
+        errorMessage: __("Failed to disconnect Google Workspace"),
+      },
+    );
+
+  const handleConnect = () => {
+    const baseUrl = import.meta.env.VITE_API_URL || window.location.origin;
+    const url = new URL("/api/console/v1/connectors/initiate", baseUrl);
+    url.searchParams.append("organization_id", organizationId);
+    url.searchParams.append("provider", "GOOGLE_WORKSPACE");
+    const continueUrl = `/organizations/${organizationId}/settings/scim`;
+    url.searchParams.append("continue", continueUrl);
+    window.location.href = url.toString();
+  };
+
+  const handleDisconnect = () => {
+    if (!connector || !scimConfigurationId) return;
+
+    void deleteSCIMConfiguration({
+      variables: {
+        input: {
+          organizationId: organizationId,
+          scimConfigurationId: scimConfigurationId,
+        },
+      },
+      onCompleted: () => {
+        dialogRef.current?.close();
+      },
+      updater: (store) => {
+        const organizationRecord = store.get(organizationId);
+        if (organizationRecord) {
+          organizationRecord.setValue(null, "scimConfiguration");
+        }
+      },
+    });
+  };
+
+  // Not connected state
+  if (!connector) {
+    return (
+      <Card padded className="flex items-center gap-3">
+        <div className="w-10 h-10 flex items-center justify-center bg-subtle rounded">
+          <img
+            src="/google-workspace.png"
+            alt="Google Workspace"
+            className="w-6 h-6"
+          />
+        </div>
+        <div className="mr-auto">
+          <h3 className="font-medium">{__("Google Workspace")}</h3>
+          <p className="text-sm text-txt-secondary">
+            {__(
+              "Connect Google Workspace to automatically sync users via SCIM.",
+            )}
+          </p>
+        </div>
+        <Button variant="secondary" onClick={handleConnect}>
+          {__("Connect")}
+        </Button>
+      </Card>
+    );
+  }
+
+  // Connected state
+  return (
+    <Card padded className="flex items-center gap-3">
+      <div className="w-10 h-10 flex items-center justify-center bg-subtle rounded">
+        <img
+          src="/google-workspace.png"
+          alt="Google Workspace"
+          className="w-6 h-6"
+        />
+      </div>
+      <div className="mr-auto">
+        <h3 className="font-medium">{__("Google Workspace")}</h3>
+        <p className="text-sm text-txt-secondary">
+          {sprintf(__("Connected on %s"), dateTimeFormat(connector.createdAt))}
+        </p>
+      </div>
+      <Badge variant="success" size="md">
+        {__("Connected")}
+      </Badge>
+      <Dialog
+        ref={dialogRef}
+        trigger={(
+          <Button variant="secondary">
+            {__("Disconnect")}
+          </Button>
+        )}
+        title={__("Disconnect Google Workspace")}
+        className="max-w-lg"
+      >
+        <DialogContent padded className="space-y-4">
+          <p className="text-txt-secondary text-sm">
+            {__(
+              "This will disconnect your Google Workspace integration. Users will no longer be automatically synced via SCIM.",
+            )}
+          </p>
+          <p className="text-red-600 text-sm font-medium">
+            {__("This action cannot be undone.")}
+          </p>
+        </DialogContent>
+        <DialogFooter>
+          <Button
+            variant="danger"
+            onClick={handleDisconnect}
+            disabled={isDeleting}
+          >
+            {isDeleting ? __("Disconnecting...") : __("Disconnect")}
+          </Button>
+        </DialogFooter>
+      </Dialog>
+    </Card>
+  );
+}

apps/console/src/pages/iam/organizations/settings/_components/SCIMConfiguration.tsx

@@ -20,9 +20,20 @@ import type { SCIMConfigurationRegenerateTokenMutation } from "#/__generated__/i
 import { useOrganizationId } from "#/hooks/useOrganizationId";
 
 const SCIMConfigurationFragment = graphql`
-  fragment SCIMConfigurationFragment on SCIMConfiguration {
+  fragment SCIMConfigurationFragment on Organization {
-    id
+    canCreateSCIMConfiguration: permission(
-    endpointUrl
+      action: "iam:scim-configuration:create"
+    )
+    canDeleteSCIMConfiguration: permission(
+      action: "iam:scim-configuration:delete"
+    )
+    scimConfiguration {
+      id
+      endpointUrl
+      bridge {
+        id
+      }
+    }
   }
 `;
 
@@ -75,15 +86,19 @@ const regenerateSCIMTokenMutation = graphql`
 `;
 
 export function SCIMConfiguration(props: {
-  fKey: SCIMConfigurationFragment$key | null;
+  fKey: SCIMConfigurationFragment$key;
-  canCreate: boolean;
-  canDelete: boolean;
 }) {
-  const { canCreate, canDelete, fKey } = props;
+  const { fKey } = props;
 
   const organizationId = useOrganizationId();
 
-  const scimConfiguration = useFragment(SCIMConfigurationFragment, fKey);
+  const organization = useFragment<SCIMConfigurationFragment$key>(SCIMConfigurationFragment, fKey);
+  const {
+    canCreateSCIMConfiguration: canCreate,
+    canDeleteSCIMConfiguration: canDelete,
+    scimConfiguration,
+  } = organization;
+  const hasIdentityProvider = !!scimConfiguration?.bridge;
   const { __ } = useTranslate();
   const { toast } = useToast();
 
@@ -117,7 +132,7 @@ export function SCIMConfiguration(props: {
             variant: "error",
             title: __("Error"),
             description: formatError(
-              __("SCIM configuration creation failed"),
+              __("Manual SCIM configuration failed"),
               e,
             ),
           });
@@ -128,7 +143,7 @@ export function SCIMConfiguration(props: {
           setToken(response.createSCIMConfiguration.token);
         }
         toast({
-          title: __("SCIM Configuration Created"),
+          title: __("Manual SCIM Configured"),
           description: __(
             "Copy the bearer token now. It will not be shown again.",
           ),
@@ -159,7 +174,7 @@ export function SCIMConfiguration(props: {
         deleteDialogRef.current?.close();
         setToken(null);
         toast({
-          title: __("SCIM Configuration Deleted"),
+          title: __("Manual SCIM Configuration Deleted"),
           description: __(
             "All SCIM-provisioned memberships have been changed to manual source.",
           ),
@@ -218,14 +233,18 @@ export function SCIMConfiguration(props: {
   };
 
   if (!scimConfiguration) {
+    if (hasIdentityProvider) {
+      return null;
+    }
+
     return (
       <Card padded>
         <div className="flex items-center justify-between">
           <div>
-            <h3 className="font-medium">{__("SCIM is not configured")}</h3>
+            <h3 className="font-medium">{__("Manual SCIM is not configured")}</h3>
             <p className="text-sm text-txt-secondary mt-1">
               {__(
-                "Enable SCIM to automatically provision users from your identity provider.",
+                "Generate a SCIM endpoint and bearer token to configure your identity provider manually.",
               )}
             </p>
           </div>
@@ -250,10 +269,10 @@ export function SCIMConfiguration(props: {
         <div className="space-y-6">
           <div className="flex items-center justify-between">
             <div>
-              <h3 className="font-medium">{__("SCIM Provisioning Active")}</h3>
+              <h3 className="font-medium">{__("Manual SCIM Active")}</h3>
               <p className="text-sm text-txt-secondary">
                 {__(
-                  "Automatic user provisioning is enabled for this organization.",
+                  "Use these credentials to configure SCIM in your identity provider.",
                 )}
               </p>
             </div>
@@ -328,17 +347,17 @@ export function SCIMConfiguration(props: {
 
       <Dialog
         ref={deleteDialogRef}
-        title={__("Delete SCIM Configuration")}
+        title={__("Delete Manual SCIM Configuration")}
         onClose={() => deleteDialogRef.current?.close()}
       >
         <div className="p-4 space-y-4">
           <p>
             {__(
-              "Are you sure you want to delete the SCIM configuration? This will:",
+              "Are you sure you want to delete the manual SCIM configuration? This will:",
             )}
           </p>
           <ul className="list-disc list-inside text-sm space-y-1">
-            <li>{__("Disable automatic user provisioning")}</li>
+            <li>{__("Disable manual SCIM provisioning")}</li>
             <li>
               {__("Change all SCIM-provisioned memberships to manual source")}
             </li>

apps/console/vite.config.ts

@@ -8,7 +8,7 @@ import { defineConfig } from "vite";
 export default defineConfig({
   plugins: [
     react({
-      exclude: ["src/pages/iam/**/*"],
+      exclude: ["src/pages/iam/**/*", "src/components/connectors/**/*"],
       babel: {
         plugins: [
           [
@@ -22,7 +22,7 @@ export default defineConfig({
       },
     }),
     react({
-      include: ["src/pages/iam/**/*"],
+      include: ["src/pages/iam/**/*", "src/components/connectors/**/*"],
       babel: {
         plugins: [
           [

cfg/dev.yaml

@@ -107,7 +107,7 @@ probod:
       key-type: "EC256"
 
   connectors:
-    - provider: "slack"
+    - provider: "SLACK"
       protocol: "oauth2"
       config:
         client-id: "slack-client-id"
@@ -121,3 +121,18 @@ probod:
           - "incoming-webhook"
       settings:
         signing-secret: "this-is-not-a-secret-for-slack-signing"
+    - provider: "GOOGLE_WORKSPACE"
+      protocol: "oauth2"
+      config:
+        client-id: "google-workspace-client-id"
+        client-secret: "thisisnotasecret"
+        redirect-uri: "http://localhost:8080/api/console/v1/connectors/complete"
+        auth-url: "https://accounts.google.com/o/oauth2/v2/auth"
+        token-url: "https://oauth2.googleapis.com/token"
+        scopes:
+          - "https://www.googleapis.com/auth/admin.directory.user.readonly"
+          - "https://www.googleapis.com/auth/admin.directory.userschema.readonly"
+          - "https://www.googleapis.com/auth/admin.directory.group.member.readonly"
+        extra-auth-params:
+          access_type: "offline"
+          prompt: "consent"

go.mod

@@ -35,11 +35,16 @@ require (
 	go.opentelemetry.io/otel/trace v1.39.0
 	go.probo.inc/mcpgen v0.0.0-20251124210642-41a5174eb92f
 	golang.org/x/crypto v0.47.0
-	golang.org/x/image v0.35.0
+	golang.org/x/image v0.33.0
+	golang.org/x/oauth2 v0.34.0
 	golang.org/x/sync v0.19.0
+	google.golang.org/api v0.260.0
 )
 
 require (
+	cloud.google.com/go/auth v0.18.0 // indirect
+	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
+	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	github.com/agnivade/levenshtein v1.2.1 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17 // indirect
@@ -64,6 +69,7 @@ require (
 	github.com/di-wu/xsd-datetime v1.0.0 // indirect
 	github.com/dnephin/pflag v1.0.7 // indirect
 	github.com/fatih/color v1.18.0 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/go-json-experiment/json v0.0.0-20251027170946-4849db3c2f7e // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
@@ -75,8 +81,11 @@ require (
 	github.com/goccy/go-yaml v1.19.2 // indirect
 	github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f // indirect
 	github.com/google/jsonschema-go v0.4.2 // indirect
+	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/google/uuid v1.6.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.9 // indirect
+	github.com/googleapis/gax-go/v2 v2.16.0 // indirect
 	github.com/gorilla/websocket v1.5.3 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
@@ -118,6 +127,7 @@ require (
 	github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
 	go.gearno.de/x/panicf v0.1.1 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.39.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.39.0 // indirect
 	go.opentelemetry.io/otel/metric v1.39.0 // indirect
@@ -126,7 +136,6 @@ require (
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	golang.org/x/mod v0.31.0 // indirect
 	golang.org/x/net v0.49.0 // indirect
-	golang.org/x/oauth2 v0.34.0 // indirect
 	golang.org/x/sys v0.40.0 // indirect
 	golang.org/x/term v0.39.0 // indirect
 	golang.org/x/text v0.33.0 // indirect

go.sum

@@ -1,3 +1,9 @@
+cloud.google.com/go/auth v0.18.0 h1:wnqy5hrv7p3k7cShwAU/Br3nzod7fxoqG+k0VZ+/Pk0=
+cloud.google.com/go/auth v0.18.0/go.mod h1:wwkPM1AgE1f2u6dG443MiWoD8C3BtOywNsUMcUTVDRo=
+cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
+cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
+cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
+cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
 codeberg.org/miekg/dns v0.6.40 h1:dzO+f0pcQEejc5kQYhOV8pSdJ14uc640M21valACl4s=
 codeberg.org/miekg/dns v0.6.40/go.mod h1:fIxAzBMDPnXWSw0fp8+pfZMRiAqYY4+HHYLzUo/S6Dg=
 github.com/99designs/gqlgen v0.17.86 h1:C8N3UTa5heXX6twl+b0AJyGkTwYL6dNmFrgZNLRcU6w=
@@ -77,6 +83,8 @@ github.com/elimity-com/scim v0.0.0-20240320110924-172bf2aee9c8 h1:0+BTyxIYgiVAry
 github.com/elimity-com/scim v0.0.0-20240320110924-172bf2aee9c8/go.mod h1:JkjcmqbLW+khwt2fmBPJFBhx2zGZ8XobRZ+O0VhlwWo=
 github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
 github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 github.com/go-chi/chi/v5 v5.2.4 h1:WtFKPHwlywe8Srng8j2BhOD9312j9cGUxG1SP4V2cR4=
@@ -114,10 +122,16 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/jsonschema-go v0.4.2 h1:tmrUohrwoLZZS/P3x7ex0WAVknEkBZM46iALbcqoRA8=
 github.com/google/jsonschema-go v0.4.2/go.mod h1:r5quNTdLOYEz95Ru18zA0ydNbBuYoo9tgaYcxEYhJVE=
+github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
+github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/enterprise-certificate-proxy v0.3.9 h1:TOpi/QG8iDcZlkQlGlFUti/ZtyLkliXvHDcyUIMuFrU=
+github.com/googleapis/enterprise-certificate-proxy v0.3.9/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
+github.com/googleapis/gax-go/v2 v2.16.0 h1:iHbQmKLLZrexmb0OSsNGTeSTS0HO4YvFOG8g5E4Zd0Y=
+github.com/googleapis/gax-go/v2 v2.16.0/go.mod h1:o1vfQjjNZn4+dPnRdl/4ZD7S9414Y4xA+a/6Icj6l14=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
 github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 h1:X+2YciYSxvMQK0UZ7sg45ZVabVZBeBuvMkmuI2V3Fak=
@@ -257,6 +271,8 @@ go.gearno.de/x/ref v0.0.0-20240502200927-d74926fcb14c h1:b8Wwr2owaB6g38tptSk5tek
 go.gearno.de/x/ref v0.0.0-20240502200927-d74926fcb14c/go.mod h1:k3GtgnI5X9dl8FlqaNYkCkil7/iACQdFOromU/H4u6I=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
 go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48=
 go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.39.0 h1:f0cb2XPmrqn4XMy9PNliTgRKJgS5WcL/u0/WRYGz4t0=
@@ -283,8 +299,8 @@ go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
 golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
-golang.org/x/image v0.35.0 h1:LKjiHdgMtO8z7Fh18nGY6KDcoEtVfsgLDPeLyguqb7I=
+golang.org/x/image v0.33.0 h1:LXRZRnv1+zGd5XBUVRFmYEphyyKJjQjCRiOuAP3sZfQ=
-golang.org/x/image v0.35.0/go.mod h1:MwPLTVgvxSASsxdLzKrl8BRFuyqMyGhLwmC+TO1Sybk=
+golang.org/x/image v0.33.0/go.mod h1:DD3OsTYT9chzuzTQt+zMcOlBHgfoKQb1gry8p76Y1sc=
 golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI=
 golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
 golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
@@ -304,6 +320,10 @@ golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA=
 golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=
 gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
 gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
+google.golang.org/api v0.260.0 h1:XbNi5E6bOVEj/uLXQRlt6TKuEzMD7zvW/6tNwltE4P4=
+google.golang.org/api v0.260.0/go.mod h1:Shj1j0Phr/9sloYrKomICzdYgsSDImpTxME8rGLaZ/o=
+google.golang.org/genproto v0.0.0-20251202230838-ff82c1b0f217 h1:GvESR9BIyHUahIb0NcTum6itIWtdoglGX+rnGxm2934=
+google.golang.org/genproto v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:yJ2HH4EHEDTd3JiLmhds6NkJ17ITVYOdV3m3VKOnws0=
 google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 h1:merA0rdPeUV3YIIfHHcH4qBkiQAc1nfCKSI7lB4cV2M=
 google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409/go.mod h1:fl8J1IvUjCilwZzQowmw2b7HQB2eAuYBabMXzWurF+I=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 h1:H86B94AW+VfJWDqFeEbBPhEtHzJwJfTbgE2lZa54ZAQ=

pkg/connector/connector.go

@@ -28,7 +28,7 @@ type (
 
 	Connector interface {
 		Initiate(ctx context.Context, provider string, organizationID gid.GID, r *http.Request) (string, error)
-		Complete(ctx context.Context, r *http.Request) (Connection, *gid.GID, error)
+		Complete(ctx context.Context, r *http.Request) (Connection, *gid.GID, string, error) // returns: connection, organizationID, continueURL, error
 	}
 
 	Connection interface {

pkg/connector/oauth2.go

@@ -38,17 +38,19 @@ import (
 
 type (
 	OAuth2Connector struct {
-		ClientID     string
+		ClientID        string
-		ClientSecret string
+		ClientSecret    string
-		RedirectURI  string
+		RedirectURI     string
-		Scopes       []string
+		Scopes          []string
-		AuthURL      string
+		AuthURL         string
-		TokenURL     string
+		TokenURL        string
+		ExtraAuthParams map[string]string // Optional: extra params for auth URL (e.g., access_type=offline for Google)
 	}
 
 	OAuth2State struct {
 		OrganizationID string `json:"oid"`
 		Provider       string `json:"provider"`
+		ContinueURL    string `json:"continue,omitempty"`
 	}
 
 	OAuth2Connection struct {
@@ -73,21 +75,30 @@ func (c *OAuth2Connector) Initiate(ctx context.Context, provider string, organiz
 		OrganizationID: organizationID.String(),
 		Provider:       provider,
 	}
+	if r != nil {
+		if continueURL := r.URL.Query().Get("continue"); continueURL != "" {
+			stateData.ContinueURL = continueURL
+		}
+	}
+	return c.InitiateWithState(ctx, stateData, r)
+}
+
+// InitiateWithState generates an OAuth2 authorization URL with a custom state.
+// This allows callers to include additional context (like SCIMBridgeID) in the state.
+func (c *OAuth2Connector) InitiateWithState(ctx context.Context, stateData OAuth2State, r *http.Request) (string, error) {
 	state, err := statelesstoken.NewToken(c.ClientSecret, OAuth2TokenType, OAuth2TokenTTL, stateData)
 	if err != nil {
 		return "", fmt.Errorf("cannot create state token: %w", err)
 	}
 
+	// Build redirect URI with provider (fixed per provider, so can be registered in OAuth console)
 	redirectURI := c.RedirectURI
 	redirectURIParsed, err := url.Parse(redirectURI)
 	if err != nil {
 		return "", fmt.Errorf("cannot parse redirect URI: %w", err)
 	}
 	q := redirectURIParsed.Query()
-	q.Set("provider", provider)
+	q.Set("provider", stateData.Provider)
-	if continueURL := r.URL.Query().Get("continue"); continueURL != "" {
-		q.Set("continue", continueURL)
-	}
 	redirectURIParsed.RawQuery = q.Encode()
 	redirectURI = redirectURIParsed.String()
 
@@ -98,6 +109,11 @@ func (c *OAuth2Connector) Initiate(ctx context.Context, provider string, organiz
 	authCodeQuery.Set("response_type", "code")
 	authCodeQuery.Set("scope", strings.Join(c.Scopes, " "))
 
+	// Add any extra auth params (e.g., access_type=offline, prompt=consent for Google)
+	for k, v := range c.ExtraAuthParams {
+		authCodeQuery.Set(k, v)
+	}
+
 	u, err := url.Parse(c.AuthURL)
 	if err != nil {
 		return "", fmt.Errorf("cannot parse auth URL: %w", err)
@@ -108,7 +124,23 @@ func (c *OAuth2Connector) Initiate(ctx context.Context, provider string, organiz
 	return u.String(), nil
 }
 
-func (c *OAuth2Connector) Complete(ctx context.Context, r *http.Request) (Connection, *gid.GID, error) {
+func (c *OAuth2Connector) Complete(ctx context.Context, r *http.Request) (Connection, *gid.GID, string, error) {
+	conn, state, err := c.CompleteWithState(ctx, r)
+	if err != nil {
+		return nil, nil, "", err
+	}
+
+	organizationID, err := gid.ParseGID(state.OrganizationID)
+	if err != nil {
+		return nil, nil, "", fmt.Errorf("cannot parse organization ID: %w", err)
+	}
+
+	return conn, &organizationID, state.ContinueURL, nil
+}
+
+// CompleteWithState completes the OAuth2 flow and returns the full state.
+// This allows callers to access additional context (like SCIMBridgeID) from the state.
+func (c *OAuth2Connector) CompleteWithState(ctx context.Context, r *http.Request) (Connection, *OAuth2State, error) {
 	provider := r.URL.Query().Get("provider")
 	if provider == "" {
 		return nil, nil, fmt.Errorf("missing provider in query parameters")
@@ -138,6 +170,7 @@ func (c *OAuth2Connector) Complete(ctx context.Context, r *http.Request) (Connec
 		return nil, nil, fmt.Errorf("cannot parse organization ID: %w", err)
 	}
 
+	// Build redirect URI with provider (must match what was sent to auth endpoint)
 	redirectURI := c.RedirectURI
 	redirectURIParsed, err := url.Parse(redirectURI)
 	if err != nil {
@@ -145,9 +178,6 @@ func (c *OAuth2Connector) Complete(ctx context.Context, r *http.Request) (Connec
 	}
 	q := redirectURIParsed.Query()
 	q.Set("provider", provider)
-	if continueURL := r.URL.Query().Get("continue"); continueURL != "" {
-		q.Set("continue", continueURL)
-	}
 	redirectURIParsed.RawQuery = q.Encode()
 	redirectURI = redirectURIParsed.String()
 
@@ -191,10 +221,11 @@ func (c *OAuth2Connector) Complete(ctx context.Context, r *http.Request) (Connec
 	}
 
 	if provider == SlackProvider {
-		return ParseSlackTokenResponse(body, oauth2Conn, organizationID)
+		conn, _, err := ParseSlackTokenResponse(body, oauth2Conn, organizationID)
+		return conn, &payload.Data, err
 	}
 
-	return &oauth2Conn, &organizationID, nil
+	return &oauth2Conn, &payload.Data, nil
 }
 
 func (c *OAuth2Connection) Type() ProtocolType {

pkg/connector/registry.go

@@ -65,10 +65,10 @@ func (cr *ConnectorRegistry) Initiate(ctx context.Context, provider string, orga
 	return connector.Initiate(ctx, provider, organizationID, r)
 }
 
-func (cr *ConnectorRegistry) Complete(ctx context.Context, provider string, r *http.Request) (Connection, *gid.GID, error) {
+func (cr *ConnectorRegistry) Complete(ctx context.Context, provider string, r *http.Request) (Connection, *gid.GID, string, error) {
 	connector, err := cr.Get(provider)
 	if err != nil {
-		return nil, nil, fmt.Errorf("cannot complete connector: %w", err)
+		return nil, nil, "", fmt.Errorf("cannot complete connector: %w", err)
 	}
 
 	return connector.Complete(ctx, r)

pkg/coredata/connector.go

@@ -150,6 +150,110 @@ func (c *Connectors) LoadAllByOrganizationIDWithoutDecryptedConnection(
 	return c.loadAllByOrganizationID(ctx, conn, scope, organizationID)
 }
 
+func (c *Connector) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	connectorID gid.GID,
+	encryptionKey cipher.EncryptionKey,
+) error {
+	if err := c.LoadMetadataByID(ctx, conn, scope, connectorID); err != nil {
+		return err
+	}
+
+	// Decrypt the connection
+	if len(c.EncryptedConnection) > 0 {
+		decryptedConnection, err := cipher.Decrypt(c.EncryptedConnection, encryptionKey)
+		if err != nil {
+			return fmt.Errorf("cannot decrypt connection: %w", err)
+		}
+
+		c.Connection, err = connector.UnmarshalConnection(c.Protocol.String(), c.Provider.String(), decryptedConnection)
+		if err != nil {
+			return fmt.Errorf("cannot unmarshal connection: %w", err)
+		}
+
+		c.populateSlackSettings()
+	}
+
+	return nil
+}
+
+// LoadMetadataByID loads connector metadata without decrypting the connection.
+// Use this when you only need provider, organization, or other metadata.
+func (c *Connector) LoadMetadataByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	connectorID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    provider,
+    protocol,
+    settings,
+    encrypted_connection,
+    created_at,
+    updated_at
+FROM
+    connectors
+WHERE
+    %s
+    AND id = @id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": connectorID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query connectors: %w", err)
+	}
+
+	loadedConnector, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Connector])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+		return fmt.Errorf("cannot collect connector row: %w", err)
+	}
+
+	*c = loadedConnector
+
+	return nil
+}
+
+func (c *Connector) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE FROM connectors
+WHERE %s AND id = @id
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": c.ID}
+	maps.Copy(args, scope.SQLArguments())
+
+	result, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot delete connector: %w", err)
+	}
+
+	if result.RowsAffected() == 0 {
+		return ErrResourceNotFound
+	}
+
+	return nil
+}
+
 func (c *Connector) Insert(
 	ctx context.Context,
 	conn pg.Conn,

pkg/coredata/connector_provider.go

@@ -22,12 +22,14 @@ import (
 type ConnectorProvider string
 
 const (
-	ConnectorProviderSlack ConnectorProvider = "SLACK"
+	ConnectorProviderSlack           ConnectorProvider = "SLACK"
+	ConnectorProviderGoogleWorkspace ConnectorProvider = "GOOGLE_WORKSPACE"
 )
 
 func ConnectorProviders() []ConnectorProvider {
 	return []ConnectorProvider{
 		ConnectorProviderSlack,
+		ConnectorProviderGoogleWorkspace,
 	}
 }
 
@@ -49,6 +51,8 @@ func (cp *ConnectorProvider) Scan(value any) error {
 	switch s {
 	case "SLACK":
 		*cp = ConnectorProviderSlack
+	case "GOOGLE_WORKSPACE":
+		*cp = ConnectorProviderGoogleWorkspace
 	default:
 		return fmt.Errorf("invalid ConnectorProvider value: %q", s)
 	}

pkg/coredata/entity_type_reg.go

@@ -78,6 +78,7 @@ const (
 	SCIMConfigurationEntityType                uint16 = 52
 	SCIMEventEntityType                        uint16 = 53
 	TokenEntityType                            uint16 = 54
+	SCIMBridgeEntityType                       uint16 = 55
 )
 
 func NewEntityFromID(id gid.GID) (any, bool) {
@@ -190,6 +191,8 @@ func NewEntityFromID(id gid.GID) (any, bool) {
 		return &SCIMEvent{ID: id}, true
 	case TokenEntityType:
 		return &Token{ID: id}, true
+	case SCIMBridgeEntityType:
+		return &SCIMBridge{ID: id}, true
 	default:
 		return nil, false
 	}

pkg/coredata/migrations/20260127T120000Z.sql

@@ -0,0 +1,12 @@
+CREATE TABLE iam_scim_bridges (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+    scim_configuration_id TEXT NOT NULL REFERENCES iam_scim_configurations(id) ON DELETE CASCADE,
+    connector_id TEXT REFERENCES connectors(id) ON DELETE SET NULL,
+    type TEXT NOT NULL,
+    state TEXT NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    CONSTRAINT iam_scim_bridges_scim_configuration_unique UNIQUE (scim_configuration_id)
+);

pkg/coredata/migrations/20260129T041655Z.sql

@@ -0,0 +1 @@
+ALTER TYPE connector_provider ADD VALUE 'GOOGLE_WORKSPACE';

pkg/coredata/scim_bridge.go

@@ -0,0 +1,323 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type (
+	SCIMBridge struct {
+		ID                  gid.GID         `db:"id"`
+		OrganizationID      gid.GID         `db:"organization_id"`
+		ScimConfigurationID gid.GID         `db:"scim_configuration_id"`
+		ConnectorID         *gid.GID        `db:"connector_id"`
+		Type                SCIMBridgeType  `db:"type"`
+		State               SCIMBridgeState `db:"state"`
+		CreatedAt           time.Time       `db:"created_at"`
+		UpdatedAt           time.Time       `db:"updated_at"`
+	}
+
+	SCIMBridges []*SCIMBridge
+)
+
+func (s *SCIMBridge) CursorKey(orderBy SCIMBridgeOrderField) page.CursorKey {
+	switch orderBy {
+	case SCIMBridgeOrderFieldCreatedAt:
+		return page.NewCursorKey(s.ID, s.CreatedAt)
+	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
+}
+
+func (s *SCIMBridge) AuthorizationAttributes(ctx context.Context, conn pg.Conn) (map[string]string, error) {
+	q := `SELECT organization_id FROM iam_scim_bridges WHERE id = $1 LIMIT 1;`
+
+	var organizationID gid.GID
+	if err := conn.QueryRow(ctx, q, s.ID).Scan(&organizationID); err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, ErrResourceNotFound
+		}
+		return nil, fmt.Errorf("cannot query scim bridge authorization attributes: %w", err)
+	}
+
+	return map[string]string{"organization_id": organizationID.String()}, nil
+}
+
+func (s *SCIMBridge) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	bridgeID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    scim_configuration_id,
+    connector_id,
+    type,
+    state,
+    created_at,
+    updated_at
+FROM
+    iam_scim_bridges
+WHERE
+    %s
+    AND id = @id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": bridgeID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query iam_scim_bridges: %w", err)
+	}
+
+	bridge, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[SCIMBridge])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+
+		return fmt.Errorf("cannot collect scim_bridge: %w", err)
+	}
+
+	*s = bridge
+
+	return nil
+}
+
+func (s *SCIMBridge) LoadByOrganizationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    scim_configuration_id,
+    connector_id,
+    type,
+    state,
+    created_at,
+    updated_at
+FROM
+    iam_scim_bridges
+WHERE
+    %s
+    AND organization_id = @organization_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"organization_id": organizationID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query iam_scim_bridges: %w", err)
+	}
+
+	bridge, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[SCIMBridge])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+
+		return fmt.Errorf("cannot collect scim_bridge: %w", err)
+	}
+
+	*s = bridge
+
+	return nil
+}
+
+func (s *SCIMBridge) LoadBySCIMConfigurationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	scimConfigurationID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    scim_configuration_id,
+    connector_id,
+    type,
+    state,
+    created_at,
+    updated_at
+FROM
+    iam_scim_bridges
+WHERE
+    %s
+    AND scim_configuration_id = @scim_configuration_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"scim_configuration_id": scimConfigurationID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query iam_scim_bridges: %w", err)
+	}
+
+	bridge, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[SCIMBridge])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+
+		return fmt.Errorf("cannot collect scim_bridge: %w", err)
+	}
+
+	*s = bridge
+
+	return nil
+}
+
+func (s *SCIMBridge) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO iam_scim_bridges (
+    id,
+    tenant_id,
+    organization_id,
+    scim_configuration_id,
+    connector_id,
+    type,
+    state,
+    created_at,
+    updated_at
+) VALUES (
+    @id,
+    @tenant_id,
+    @organization_id,
+    @scim_configuration_id,
+    @connector_id,
+    @type,
+    @state,
+    @created_at,
+    @updated_at
+)
+`
+
+	args := pgx.StrictNamedArgs{
+		"id":                    s.ID,
+		"tenant_id":             scope.GetTenantID(),
+		"organization_id":       s.OrganizationID,
+		"scim_configuration_id": s.ScimConfigurationID,
+		"connector_id":          s.ConnectorID,
+		"type":                  s.Type,
+		"state":                 s.State,
+		"created_at":            s.CreatedAt,
+		"updated_at":            s.UpdatedAt,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot insert scim_bridge: %w", err)
+	}
+
+	return nil
+}
+
+func (s *SCIMBridge) Update(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+UPDATE iam_scim_bridges
+SET
+    connector_id = @connector_id,
+    state = @state,
+    updated_at = @updated_at
+WHERE
+    %s
+    AND id = @id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"id":           s.ID,
+		"connector_id": s.ConnectorID,
+		"state":        s.State,
+		"updated_at":   s.UpdatedAt,
+	}
+
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot update scim_bridge: %w", err)
+	}
+
+	return nil
+}
+
+func (s *SCIMBridge) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE FROM iam_scim_bridges
+WHERE
+    %s
+    AND id = @id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": s.ID}
+	maps.Copy(args, scope.SQLArguments())
+
+	result, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot delete scim_bridge: %w", err)
+	}
+
+	if result.RowsAffected() == 0 {
+		return ErrResourceNotFound
+	}
+
+	return nil
+}

pkg/coredata/scim_bridge_order_field.go

@@ -0,0 +1,40 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+type (
+	SCIMBridgeOrderField string
+)
+
+const (
+	SCIMBridgeOrderFieldCreatedAt SCIMBridgeOrderField = "CREATED_AT"
+)
+
+func (p SCIMBridgeOrderField) Column() string {
+	return string(p)
+}
+
+func (p SCIMBridgeOrderField) String() string {
+	return string(p)
+}
+
+func (p SCIMBridgeOrderField) MarshalText() ([]byte, error) {
+	return []byte(p.String()), nil
+}
+
+func (p *SCIMBridgeOrderField) UnmarshalText(text []byte) error {
+	*p = SCIMBridgeOrderField(text)
+	return nil
+}

pkg/coredata/scim_bridge_state.go

@@ -0,0 +1,60 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"fmt"
+)
+
+type SCIMBridgeState string
+
+const (
+	SCIMBridgeStatePending SCIMBridgeState = "PENDING"
+	SCIMBridgeStateActive  SCIMBridgeState = "ACTIVE"
+	SCIMBridgeStateFailed  SCIMBridgeState = "FAILED"
+)
+
+func (s SCIMBridgeState) String() string {
+	return string(s)
+}
+
+func (s *SCIMBridgeState) Scan(value any) error {
+	var str string
+	switch v := value.(type) {
+	case string:
+		str = v
+	case []byte:
+		str = string(v)
+	default:
+		return fmt.Errorf("unsupported type for SCIMBridgeState: %T", value)
+	}
+
+	switch str {
+	case "PENDING":
+		*s = SCIMBridgeStatePending
+	case "ACTIVE":
+		*s = SCIMBridgeStateActive
+	case "FAILED":
+		*s = SCIMBridgeStateFailed
+	default:
+		return fmt.Errorf("invalid SCIMBridgeState value: %q", str)
+	}
+	return nil
+}
+
+func (s SCIMBridgeState) Value() (driver.Value, error) {
+	return s.String(), nil
+}

pkg/coredata/scim_bridge_type.go

@@ -0,0 +1,54 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"fmt"
+)
+
+type SCIMBridgeType string
+
+const (
+	SCIMBridgeTypeGoogleWorkspace SCIMBridgeType = "GOOGLE_WORKSPACE"
+)
+
+func (t SCIMBridgeType) String() string {
+	return string(t)
+}
+
+func (t *SCIMBridgeType) Scan(value any) error {
+	var str string
+	switch v := value.(type) {
+	case string:
+		str = v
+	case []byte:
+		str = string(v)
+	default:
+		return fmt.Errorf("unsupported type for SCIMBridgeType: %T", value)
+	}
+
+	switch str {
+	case "GOOGLE_WORKSPACE":
+		*t = SCIMBridgeTypeGoogleWorkspace
+	default:
+		return fmt.Errorf("invalid SCIMBridgeType value: %q", str)
+	}
+	return nil
+}
+
+func (t SCIMBridgeType) Value() (driver.Value, error) {
+	return t.String(), nil
+}

pkg/coredata/scim_configuration.go

@@ -32,6 +32,7 @@ type (
 	SCIMConfiguration struct {
 		ID             gid.GID   `db:"id"`
 		OrganizationID gid.GID   `db:"organization_id"`
+		BridgeID       *gid.GID  `db:"bridge_id"`
 		HashedToken    []byte    `db:"hashed_token"`
 		CreatedAt      time.Time `db:"created_at"`
 		UpdatedAt      time.Time `db:"updated_at"`
@@ -70,18 +71,31 @@ func (s *SCIMConfiguration) LoadByID(
 	configID gid.GID,
 ) error {
 	q := `
+WITH scim_config AS (
+    SELECT
+        id,
+        organization_id,
+        hashed_token,
+        created_at,
+        updated_at
+    FROM
+        iam_scim_configurations
+    WHERE
+        %s
+        AND id = @id
+    LIMIT 1
+)
 SELECT
-    id,
+    sc.id,
-    organization_id,
+    sc.organization_id,
-    hashed_token,
+    b.id AS bridge_id,
-    created_at,
+    sc.hashed_token,
-    updated_at
+    sc.created_at,
+    sc.updated_at
 FROM
-    iam_scim_configurations
+    scim_config sc
-WHERE
+LEFT JOIN
-    %s
+    iam_scim_bridges b ON b.scim_configuration_id = sc.id;
-    AND id = @id
-LIMIT 1;
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
@@ -115,18 +129,31 @@ func (s *SCIMConfiguration) LoadByOrganizationID(
 	organizationID gid.GID,
 ) error {
 	q := `
+WITH scim_config AS (
+    SELECT
+        id,
+        organization_id,
+        hashed_token,
+        created_at,
+        updated_at
+    FROM
+        iam_scim_configurations
+    WHERE
+        %s
+        AND organization_id = @organization_id
+    LIMIT 1
+)
 SELECT
-    id,
+    sc.id,
-    organization_id,
+    sc.organization_id,
-    hashed_token,
+    b.id AS bridge_id,
-    created_at,
+    sc.hashed_token,
-    updated_at
+    sc.created_at,
+    sc.updated_at
 FROM
-    iam_scim_configurations
+    scim_config sc
-WHERE
+LEFT JOIN
-    %s
+    iam_scim_bridges b ON b.scim_configuration_id = sc.id;
-    AND organization_id = @organization_id
-LIMIT 1;
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
@@ -159,17 +186,30 @@ func (s *SCIMConfiguration) LoadByHashedToken(
 	hashedToken []byte,
 ) error {
 	q := `
+WITH scim_config AS (
+    SELECT
+        id,
+        organization_id,
+        hashed_token,
+        created_at,
+        updated_at
+    FROM
+        iam_scim_configurations
+    WHERE
+        hashed_token = @hashed_token
+    LIMIT 1
+)
 SELECT
-    id,
+    sc.id,
-    organization_id,
+    sc.organization_id,
-    hashed_token,
+    b.id AS bridge_id,
-    created_at,
+    sc.hashed_token,
-    updated_at
+    sc.created_at,
+    sc.updated_at
 FROM
-    iam_scim_configurations
+    scim_config sc
-WHERE
+LEFT JOIN
-    hashed_token = @hashed_token
+    iam_scim_bridges b ON b.scim_configuration_id = sc.id;
-LIMIT 1;
 `
 
 	args := pgx.StrictNamedArgs{"hashed_token": hashedToken}

pkg/iam/errors.go

@@ -357,3 +357,23 @@ func NewNoSCIMConfigurationFoundError(organizationID gid.GID) error {
 func (e ErrNoSCIMConfigurationFound) Error() string {
 	return fmt.Sprintf("SCIM configuration not found for organization %q", e.OrganizationID)
 }
+
+type ErrSCIMBridgeNotFound struct{ BridgeID gid.GID }
+
+func NewSCIMBridgeNotFoundError(bridgeID gid.GID) error {
+	return &ErrSCIMBridgeNotFound{BridgeID: bridgeID}
+}
+
+func (e ErrSCIMBridgeNotFound) Error() string {
+	return fmt.Sprintf("SCIM bridge %q not found", e.BridgeID)
+}
+
+type ErrConnectorNotFound struct{ ConnectorID gid.GID }
+
+func NewConnectorNotFoundError(connectorID gid.GID) error {
+	return &ErrConnectorNotFound{ConnectorID: connectorID}
+}
+
+func (e ErrConnectorNotFound) Error() string {
+	return fmt.Sprintf("connector %q not found", e.ConnectorID)
+}

pkg/iam/iam_actions.go

@@ -77,4 +77,12 @@ const (
 	// SCIM Event actions
 	ActionSCIMEventList = "iam:scim-event:list"
 	ActionSCIMEventGet  = "iam:scim-event:get"
+
+	// SCIM Bridge actions
+	ActionSCIMBridgeGet    = "iam:scim-bridge:get"
+	ActionSCIMBridgeCreate = "iam:scim-bridge:create"
+	ActionSCIMBridgeDelete = "iam:scim-bridge:delete"
+
+	// Connector actions
+	ActionConnectorGet = "iam:connector:get"
 )

pkg/iam/organization_service.go

@@ -1296,6 +1296,30 @@ func (s OrganizationService) DeleteSCIMConfiguration(
 				return fmt.Errorf("cannot reset membership sources: %w", err)
 			}
 
+			// Delete SCIM bridge and its connector if they exist
+			bridge := &coredata.SCIMBridge{}
+			err = bridge.LoadBySCIMConfigurationID(ctx, tx, scope, configID)
+			if err != nil && err != coredata.ErrResourceNotFound {
+				return fmt.Errorf("cannot load SCIM bridge: %w", err)
+			}
+
+			if err == nil {
+				// Bridge exists, delete connector if it has one
+				if bridge.ConnectorID != nil {
+					connector := &coredata.Connector{ID: *bridge.ConnectorID}
+					err = connector.Delete(ctx, tx, scope)
+					if err != nil && err != coredata.ErrResourceNotFound {
+						return fmt.Errorf("cannot delete connector: %w", err)
+					}
+				}
+
+				// Delete the bridge
+				err = bridge.Delete(ctx, tx, scope)
+				if err != nil {
+					return fmt.Errorf("cannot delete SCIM bridge: %w", err)
+				}
+			}
+
 			err = config.Delete(ctx, tx, scope)
 			if err != nil {
 				return fmt.Errorf("cannot delete SCIM configuration: %w", err)
@@ -1591,3 +1615,293 @@ func (s OrganizationService) GetOrganization(ctx context.Context, organizationID
 
 	return organization, nil
 }
+
+func (s OrganizationService) GetSCIMBridgeByID(ctx context.Context, bridgeID gid.GID) (*coredata.SCIMBridge, error) {
+	var (
+		scope  = coredata.NewScopeFromObjectID(bridgeID)
+		bridge = &coredata.SCIMBridge{}
+	)
+
+	err := s.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			err := bridge.LoadByID(ctx, conn, scope, bridgeID)
+			if err != nil {
+				if err == coredata.ErrResourceNotFound {
+					return NewSCIMBridgeNotFoundError(bridgeID)
+				}
+
+				return fmt.Errorf("cannot load SCIM bridge: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return bridge, nil
+}
+
+func (s OrganizationService) GetConnectorByID(ctx context.Context, connectorID gid.GID) (*coredata.Connector, error) {
+	var (
+		scope     = coredata.NewScopeFromObjectID(connectorID)
+		connector = &coredata.Connector{}
+	)
+
+	err := s.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			err := connector.LoadByID(ctx, conn, scope, connectorID, s.encryptionKey)
+			if err != nil {
+				if err == coredata.ErrResourceNotFound {
+					return NewConnectorNotFoundError(connectorID)
+				}
+
+				return fmt.Errorf("cannot load connector: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return connector, nil
+}
+
+// GetConnectorMetadataByID returns connector metadata without decrypting the connection.
+// Use this when you only need provider, organization, or other metadata fields.
+func (s OrganizationService) GetConnectorMetadataByID(ctx context.Context, connectorID gid.GID) (*coredata.Connector, error) {
+	var (
+		scope     = coredata.NewScopeFromObjectID(connectorID)
+		connector = &coredata.Connector{}
+	)
+
+	err := s.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			err := connector.LoadMetadataByID(ctx, conn, scope, connectorID)
+			if err != nil {
+				if err == coredata.ErrResourceNotFound {
+					return NewConnectorNotFoundError(connectorID)
+				}
+
+				return fmt.Errorf("cannot load connector: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return connector, nil
+}
+
+func (s OrganizationService) GetSCIMBridgeByOrganizationID(ctx context.Context, organizationID gid.GID) (*coredata.SCIMBridge, error) {
+	var (
+		scope  = coredata.NewScopeFromObjectID(organizationID)
+		bridge = &coredata.SCIMBridge{}
+	)
+
+	err := s.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			err := bridge.LoadByOrganizationID(ctx, conn, scope, organizationID)
+			if err != nil {
+				if err == coredata.ErrResourceNotFound {
+					return nil // No bridge found, not an error
+				}
+
+				return fmt.Errorf("cannot load SCIM bridge: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	// If bridge ID is empty, no bridge was found
+	if bridge.ID == (gid.GID{}) {
+		return nil, nil
+	}
+
+	return bridge, nil
+}
+
+func (s OrganizationService) LinkConnectorToSCIMBridge(
+	ctx context.Context,
+	bridgeID gid.GID,
+	connectorID gid.GID,
+) (*coredata.SCIMBridge, error) {
+	var (
+		scope  = coredata.NewScopeFromObjectID(bridgeID)
+		bridge = &coredata.SCIMBridge{}
+	)
+
+	err := s.pg.WithTx(
+		ctx,
+		func(tx pg.Conn) error {
+			err := bridge.LoadByID(ctx, tx, scope, bridgeID)
+			if err != nil {
+				if err == coredata.ErrResourceNotFound {
+					return NewSCIMBridgeNotFoundError(bridgeID)
+				}
+				return fmt.Errorf("cannot load SCIM bridge: %w", err)
+			}
+
+			// Update the bridge with the connector ID
+			bridge.ConnectorID = &connectorID
+			bridge.State = coredata.SCIMBridgeStateActive
+			bridge.UpdatedAt = time.Now()
+
+			if err := bridge.Update(ctx, tx, scope); err != nil {
+				return fmt.Errorf("cannot update SCIM bridge: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return bridge, nil
+}
+
+func (s OrganizationService) CreateSCIMBridge(
+	ctx context.Context,
+	organizationID gid.GID,
+	scimConfigurationID gid.GID,
+	connectorID gid.GID,
+) (*coredata.SCIMBridge, error) {
+	var (
+		scope  = coredata.NewScopeFromObjectID(organizationID)
+		now    = time.Now()
+		bridge *coredata.SCIMBridge
+	)
+
+	err := s.pg.WithTx(
+		ctx,
+		func(tx pg.Conn) error {
+			organization := &coredata.Organization{}
+			err := organization.LoadByID(ctx, tx, scope, organizationID)
+			if err != nil {
+				if err == coredata.ErrResourceNotFound {
+					return NewOrganizationNotFoundError(organizationID)
+				}
+				return fmt.Errorf("cannot load organization: %w", err)
+			}
+
+			config := &coredata.SCIMConfiguration{}
+			err = config.LoadByID(ctx, tx, scope, scimConfigurationID)
+			if err != nil {
+				if err == coredata.ErrResourceNotFound {
+					return scim.NewSCIMConfigurationNotFoundError(scimConfigurationID)
+				}
+				return fmt.Errorf("cannot load SCIM configuration: %w", err)
+			}
+
+			if config.OrganizationID != organizationID {
+				return scim.NewSCIMConfigurationNotFoundError(scimConfigurationID)
+			}
+
+			// Load and validate the connector (metadata only, no decryption needed)
+			existingConnector := &coredata.Connector{}
+			err = existingConnector.LoadMetadataByID(ctx, tx, scope, connectorID)
+			if err != nil {
+				if err == coredata.ErrResourceNotFound {
+					return NewConnectorNotFoundError(connectorID)
+				}
+
+				return fmt.Errorf("cannot load connector: %w", err)
+			}
+
+			// Verify connector belongs to the same organization
+			if existingConnector.OrganizationID != organizationID {
+				return NewConnectorNotFoundError(connectorID)
+			}
+
+			// Map connector provider to bridge type
+			var bridgeType coredata.SCIMBridgeType
+			switch existingConnector.Provider {
+			case coredata.ConnectorProviderGoogleWorkspace:
+				bridgeType = coredata.SCIMBridgeTypeGoogleWorkspace
+			default:
+				return fmt.Errorf("connector provider %s is not supported for SCIM bridge", existingConnector.Provider)
+			}
+
+			bridge = &coredata.SCIMBridge{
+				ID:                  gid.New(organizationID.TenantID(), coredata.SCIMBridgeEntityType),
+				OrganizationID:      organizationID,
+				ScimConfigurationID: scimConfigurationID,
+				ConnectorID:         &connectorID,
+				Type:                bridgeType,
+				State:               coredata.SCIMBridgeStateActive, // Active immediately since connector already exists
+				CreatedAt:           now,
+				UpdatedAt:           now,
+			}
+
+			if err := bridge.Insert(ctx, tx, scope); err != nil {
+				return fmt.Errorf("cannot insert SCIM bridge: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return bridge, nil
+}
+
+func (s OrganizationService) DeleteSCIMBridge(ctx context.Context, organizationID gid.GID, bridgeID gid.GID) error {
+	var (
+		scope  = coredata.NewScopeFromObjectID(organizationID)
+		bridge = &coredata.SCIMBridge{}
+	)
+
+	err := s.pg.WithTx(
+		ctx,
+		func(tx pg.Conn) error {
+			organization := &coredata.Organization{}
+			err := organization.LoadByID(ctx, tx, scope, organizationID)
+			if err != nil {
+				return fmt.Errorf("cannot load organization: %w", err)
+			}
+
+			if err := bridge.LoadByID(ctx, tx, scope, bridgeID); err != nil {
+				return fmt.Errorf("cannot load SCIM bridge: %w", err)
+			}
+
+			if bridge.OrganizationID != organizationID {
+				return NewSCIMBridgeNotFoundError(bridgeID)
+			}
+
+			if err := bridge.Delete(ctx, tx, scope); err != nil {
+				return fmt.Errorf("cannot delete SCIM bridge: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return err
+	}
+
+	return nil
+}

pkg/probo/actions.go

@@ -278,6 +278,10 @@ const (
 	// SlackConnection actions
 	ActionSlackConnectionList = "core:slack-connection:list"
 
+	// Connector actions (generic)
+	ActionConnectorList   = "core:connector:list"
+	ActionConnectorDelete = "core:connector:delete"
+
 	// DataProtectionImpactAssessment actions
 	ActionDataProtectionImpactAssessmentList   = "core:data-protection-impact-assessment:list"
 	ActionDataProtectionImpactAssessmentGet    = "core:data-protection-impact-assessment:get"

pkg/probo/connector_service.go

@@ -94,6 +94,52 @@ func (s *ConnectorService) ListForOrganizationID(
 	return page.NewPage(connectors, cursor), nil
 }
 
+func (s *ConnectorService) GetByOrganizationIDAndProvider(
+	ctx context.Context,
+	organizationID gid.GID,
+	provider coredata.ConnectorProvider,
+) (*coredata.Connector, error) {
+	var connectors coredata.Connectors
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return connectors.LoadAllByOrganizationIDProtocolAndProvider(
+				ctx,
+				conn,
+				s.svc.scope,
+				organizationID,
+				coredata.ConnectorProtocolOAuth2,
+				provider,
+				s.svc.encryptionKey,
+			)
+		},
+	)
+
+	if err != nil {
+		return nil, fmt.Errorf("cannot get connector: %w", err)
+	}
+
+	if len(connectors) == 0 {
+		return nil, coredata.ErrResourceNotFound
+	}
+
+	return connectors[0], nil
+}
+
+func (s *ConnectorService) Delete(
+	ctx context.Context,
+	connectorID gid.GID,
+) error {
+	return s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			cnnctr := &coredata.Connector{ID: connectorID}
+			return cnnctr.Delete(ctx, conn, s.svc.scope)
+		},
+	)
+}
+
 func (s *ConnectorService) Create(
 	ctx context.Context,
 	req CreateConnectorRequest,

pkg/probo/policies.go

@@ -76,7 +76,7 @@ var ViewerPolicy = policy.NewPolicy(
 		ActionSnapshotGet, ActionSnapshotList,
 		ActionMeetingGet, ActionMeetingList,
 		ActionFileGet, ActionFileDownloadUrl,
-		ActionSlackConnectionList,
+		ActionSlackConnectionList, ActionConnectorList,
 		ActionRightsRequestGet, ActionRightsRequestList,
 		ActionStateOfApplicabilityGet, ActionStateOfApplicabilityList,
 		ActionApplicabilityStatementGet, ActionApplicabilityStatementList,

pkg/probod/connector_config.go

@@ -32,12 +32,13 @@ type (
 	}
 
 	connectorConfigOAuth2 struct {
-		ClientID     string   `json:"client-id"`
+		ClientID        string            `json:"client-id"`
-		ClientSecret string   `json:"client-secret"`
+		ClientSecret    string            `json:"client-secret"`
-		RedirectURI  string   `json:"redirect-uri"`
+		RedirectURI     string            `json:"redirect-uri"`
-		AuthURL      string   `json:"auth-url"`
+		AuthURL         string            `json:"auth-url"`
-		TokenURL     string   `json:"token-url"`
+		TokenURL        string            `json:"token-url"`
-		Scopes       []string `json:"scopes"`
+		Scopes          []string          `json:"scopes"`
+		ExtraAuthParams map[string]string `json:"extra-auth-params,omitempty"`
 	}
 )
 
@@ -85,12 +86,13 @@ func (c *connectorConfig) UnmarshalJSON(data []byte) error {
 		}
 
 		oauth2Connector := connector.OAuth2Connector{
-			ClientID:     config.ClientID,
+			ClientID:        config.ClientID,
-			ClientSecret: config.ClientSecret,
+			ClientSecret:    config.ClientSecret,
-			RedirectURI:  config.RedirectURI,
+			RedirectURI:     config.RedirectURI,
-			AuthURL:      config.AuthURL,
+			AuthURL:         config.AuthURL,
-			TokenURL:     config.TokenURL,
+			TokenURL:        config.TokenURL,
-			Scopes:       config.Scopes,
+			Scopes:          config.Scopes,
+			ExtraAuthParams: config.ExtraAuthParams,
 		}
 
 		c.Config = &oauth2Connector

pkg/server/api/connect/v1/schema.graphql

@@ -347,6 +347,8 @@ type SCIMConfiguration implements Node {
   updatedAt: Datetime!
   organization: Organization @goField(forceResolver: true)
 
+  bridge: SCIMBridge @goField(forceResolver: true)
+
   events(
     first: Int
     after: CursorKey
@@ -360,6 +362,50 @@ type SCIMConfiguration implements Node {
     @session(required: PRESENT)
 }
 
+type SCIMBridge implements Node {
+  id: ID!
+  state: SCIMBridgeState!
+  scimConfiguration: SCIMConfiguration @goField(forceResolver: true)
+  connector: Connector @goField(forceResolver: true)
+  type: SCIMBridgeType!
+  createdAt: Datetime!
+  updatedAt: Datetime!
+
+  permission(action: String!): Boolean!
+    @goField(forceResolver: true)
+    @session(required: PRESENT)
+}
+
+type Connector implements Node {
+  id: ID!
+  provider: ConnectorProvider!
+  createdAt: Datetime!
+  updatedAt: Datetime!
+
+  permission(action: String!): Boolean!
+    @goField(forceResolver: true)
+    @session(required: PRESENT)
+}
+
+enum ConnectorProvider
+  @goModel(model: "go.probo.inc/probo/pkg/coredata.ConnectorProvider") {
+  SLACK @goEnum(value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderSlack")
+  GOOGLE_WORKSPACE
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderGoogleWorkspace")
+}
+
+enum SCIMBridgeType
+  @goModel(model: "go.probo.inc/probo/pkg/coredata.SCIMBridgeType") {
+  GOOGLE_WORKSPACE @goEnum(value: "go.probo.inc/probo/pkg/coredata.SCIMBridgeTypeGoogleWorkspace")
+}
+
+enum SCIMBridgeState
+  @goModel(model: "go.probo.inc/probo/pkg/coredata.SCIMBridgeState") {
+  PENDING @goEnum(value: "go.probo.inc/probo/pkg/coredata.SCIMBridgeStatePending")
+  ACTIVE @goEnum(value: "go.probo.inc/probo/pkg/coredata.SCIMBridgeStateActive")
+  FAILED @goEnum(value: "go.probo.inc/probo/pkg/coredata.SCIMBridgeStateFailed")
+}
+
 type SCIMEvent implements Node {
   id: ID!
   method: String!
@@ -846,6 +892,7 @@ type DeleteSAMLConfigurationPayload {
 
 input CreateSCIMConfigurationInput {
   organizationId: ID!
+  connectorId: ID
 }
 
 input DeleteSCIMConfigurationInput {
@@ -860,6 +907,7 @@ input RegenerateSCIMTokenInput {
 
 type CreateSCIMConfigurationPayload {
   scimConfiguration: SCIMConfiguration!
+  scimBridge: SCIMBridge
   token: String!
 }
 

pkg/server/api/connect/v1/types/bridge.go

@@ -0,0 +1,38 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import "go.probo.inc/probo/pkg/coredata"
+
+func NewSCIMBridge(bridge *coredata.SCIMBridge) *SCIMBridge {
+	var connector *Connector
+	if bridge.ConnectorID != nil {
+		connector = &Connector{
+			ID: *bridge.ConnectorID,
+		}
+	}
+
+	return &SCIMBridge{
+		ID:    bridge.ID,
+		State: bridge.State,
+		ScimConfiguration: &SCIMConfiguration{
+			ID: bridge.ScimConfigurationID,
+		},
+		Connector: connector,
+		Type:      bridge.Type,
+		CreatedAt: bridge.CreatedAt,
+		UpdatedAt: bridge.UpdatedAt,
+	}
+}

pkg/server/api/connect/v1/types/connector.go

@@ -0,0 +1,26 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import "go.probo.inc/probo/pkg/coredata"
+
+func NewConnector(connector *coredata.Connector) *Connector {
+	return &Connector{
+		ID:        connector.ID,
+		Provider:  connector.Provider,
+		CreatedAt: connector.CreatedAt,
+		UpdatedAt: connector.UpdatedAt,
+	}
+}

pkg/server/api/connect/v1/types/scim_configuration.go

@@ -19,12 +19,18 @@ import (
 )
 
 func NewSCIMConfiguration(scimConfiguration *coredata.SCIMConfiguration) *SCIMConfiguration {
+	var bridge *SCIMBridge
+	if scimConfiguration.BridgeID != nil {
+		bridge = &SCIMBridge{
+			ID: *scimConfiguration.BridgeID,
+		}
+	}
+
 	return &SCIMConfiguration{
-		ID: scimConfiguration.ID,
+		ID:           scimConfiguration.ID,
-		Organization: &Organization{
+		Organization: &Organization{ID: scimConfiguration.OrganizationID},
-			ID: scimConfiguration.OrganizationID,
+		Bridge:       bridge,
-		},
+		CreatedAt:    scimConfiguration.CreatedAt,
-		CreatedAt: scimConfiguration.CreatedAt,
+		UpdatedAt:    scimConfiguration.UpdatedAt,
-		UpdatedAt: scimConfiguration.UpdatedAt,
 	}
 }

pkg/server/api/connect/v1/types/types.go

@@ -60,6 +60,17 @@ type ChangePasswordPayload struct {
 	Success bool `json:"success"`
 }
 
+type Connector struct {
+	ID         gid.GID                    `json:"id"`
+	Provider   coredata.ConnectorProvider `json:"provider"`
+	CreatedAt  time.Time                  `json:"createdAt"`
+	UpdatedAt  time.Time                  `json:"updatedAt"`
+	Permission bool                       `json:"permission"`
+}
+
+func (Connector) IsNode()             {}
+func (this Connector) GetID() gid.GID { return this.ID }
+
 type CreateOrganizationInput struct {
 	Name               string          `json:"name"`
 	LogoFile           *graphql.Upload `json:"logoFile,omitempty"`
@@ -96,11 +107,13 @@ type CreateSAMLConfigurationPayload struct {
 }
 
 type CreateSCIMConfigurationInput struct {
-	OrganizationID gid.GID `json:"organizationId"`
+	OrganizationID gid.GID  `json:"organizationId"`
+	ConnectorID    *gid.GID `json:"connectorId,omitempty"`
 }
 
 type CreateSCIMConfigurationPayload struct {
 	ScimConfiguration *SCIMConfiguration `json:"scimConfiguration"`
+	ScimBridge        *SCIMBridge        `json:"scimBridge,omitempty"`
 	Token             string             `json:"token"`
 }
 
@@ -396,12 +409,27 @@ type SAMLConfigurationEdge struct {
 	Cursor page.CursorKey     `json:"cursor"`
 }
 
+type SCIMBridge struct {
+	ID                gid.GID                  `json:"id"`
+	State             coredata.SCIMBridgeState `json:"state"`
+	ScimConfiguration *SCIMConfiguration       `json:"scimConfiguration,omitempty"`
+	Connector         *Connector               `json:"connector,omitempty"`
+	Type              coredata.SCIMBridgeType  `json:"type"`
+	CreatedAt         time.Time                `json:"createdAt"`
+	UpdatedAt         time.Time                `json:"updatedAt"`
+	Permission        bool                     `json:"permission"`
+}
+
+func (SCIMBridge) IsNode()             {}
+func (this SCIMBridge) GetID() gid.GID { return this.ID }
+
 type SCIMConfiguration struct {
 	ID           gid.GID              `json:"id"`
 	EndpointURL  string               `json:"endpointUrl"`
 	CreatedAt    time.Time            `json:"createdAt"`
 	UpdatedAt    time.Time            `json:"updatedAt"`
 	Organization *Organization        `json:"organization,omitempty"`
+	Bridge       *SCIMBridge          `json:"bridge,omitempty"`
 	Events       *SCIMEventConnection `json:"events,omitempty"`
 	Permission   bool                 `json:"permission"`
 }

pkg/server/api/connect/v1/v1_resolver.go

@@ -27,6 +27,11 @@ import (
 	"go.probo.inc/probo/pkg/server/gqlutils/types/cursor"
 )
 
+// Permission is the resolver for the permission field.
+func (r *connectorResolver) Permission(ctx context.Context, obj *types.Connector, action string) (bool, error) {
+	return r.Resolver.Permission(ctx, obj, action)
+}
+
 // Memberships is the resolver for the memberships field.
 func (r *identityResolver) Memberships(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.MembershipOrderBy) (*types.MembershipConnection, error) {
 	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipList); err != nil {
@@ -1119,10 +1124,24 @@ func (r *mutationResolver) CreateSCIMConfiguration(ctx context.Context, input ty
 		return nil, gqlutils.Internal(ctx)
 	}
 
-	return &types.CreateSCIMConfigurationPayload{
+	var bridge *types.SCIMBridge
+
+	if input.ConnectorID != nil {
+		scimBridge, err := r.iam.OrganizationService.CreateSCIMBridge(ctx, input.OrganizationID, config.ID, *input.ConnectorID)
+		if err != nil {
+			r.logger.ErrorCtx(ctx, "cannot create scim bridge", log.Error(err))
+			return nil, gqlutils.Internal(ctx)
+		}
+		bridge = types.NewSCIMBridge(scimBridge)
+	}
+
+	payload := &types.CreateSCIMConfigurationPayload{
 		ScimConfiguration: types.NewSCIMConfiguration(config),
+		ScimBridge:        bridge,
 		Token:             token,
-	}, nil
+	}
+
+	return payload, nil
 }
 
 // DeleteSCIMConfiguration is the resolver for the deleteSCIMConfiguration field.
@@ -1578,6 +1597,63 @@ func (r *sAMLConfigurationConnectionResolver) TotalCount(ctx context.Context, ob
 	return nil, gqlutils.Internal(ctx)
 }
 
+// ScimConfiguration is the resolver for the scimConfiguration field.
+func (r *sCIMBridgeResolver) ScimConfiguration(ctx context.Context, obj *types.SCIMBridge) (*types.SCIMConfiguration, error) {
+	if err := r.authorize(ctx, obj.ScimConfiguration.ID, iam.ActionSCIMConfigurationGet); err != nil {
+		return nil, err
+	}
+
+	if gqlutils.OnlyIDSelected(ctx) {
+		return &types.SCIMConfiguration{
+			ID: obj.ScimConfiguration.ID,
+		}, nil
+	}
+
+	scimConfiguration, err := r.iam.GetSCIMConfiguration(ctx, obj.ScimConfiguration.ID)
+	if err != nil {
+		var errNoSCIMConfigurationFound *iam.ErrNoSCIMConfigurationFound
+		if errors.As(err, &errNoSCIMConfigurationFound) {
+			return nil, nil
+		}
+
+		return nil, err
+	}
+
+	return types.NewSCIMConfiguration(scimConfiguration), nil
+}
+
+// Connector is the resolver for the connector field.
+func (r *sCIMBridgeResolver) Connector(ctx context.Context, obj *types.SCIMBridge) (*types.Connector, error) {
+	if obj.Connector == nil {
+		return nil, nil
+	}
+
+	// Authorize based on the SCIM configuration (connector accessed via bridge is a sub-resource)
+	if err := r.authorize(ctx, obj.ScimConfiguration.ID, iam.ActionSCIMConfigurationGet); err != nil {
+		return nil, err
+	}
+
+	if gqlutils.OnlyIDSelected(ctx) {
+		return &types.Connector{
+			ID: obj.Connector.ID,
+		}, nil
+	}
+
+	// Use metadata-only loading since we don't need the encrypted connection data
+	connector, err := r.iam.OrganizationService.GetConnectorMetadataByID(ctx, obj.Connector.ID)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot get connector", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewConnector(connector), nil
+}
+
+// Permission is the resolver for the permission field.
+func (r *sCIMBridgeResolver) Permission(ctx context.Context, obj *types.SCIMBridge, action string) (bool, error) {
+	return r.Resolver.Permission(ctx, obj, action)
+}
+
 // EndpointURL is the resolver for the endpointUrl field.
 func (r *sCIMConfigurationResolver) EndpointURL(ctx context.Context, obj *types.SCIMConfiguration) (string, error) {
 	return r.baseURL.WithPath("/api/connect/v1/scim/2.0").MustString(), nil
@@ -1609,6 +1685,31 @@ func (r *sCIMConfigurationResolver) Organization(ctx context.Context, obj *types
 	return types.NewOrganization(organization), nil
 }
 
+// Bridge is the resolver for the bridge field.
+func (r *sCIMConfigurationResolver) Bridge(ctx context.Context, obj *types.SCIMConfiguration) (*types.SCIMBridge, error) {
+
+	if obj.Bridge == nil {
+		return nil, nil
+	}
+
+	if err := r.authorize(ctx, obj.ID, iam.ActionSCIMConfigurationGet); err != nil {
+		return nil, err
+	}
+
+	bridge, err := r.iam.OrganizationService.GetSCIMBridgeByID(ctx, obj.Bridge.ID)
+	if err != nil {
+		var errSCIMBridgeNotFound *iam.ErrSCIMBridgeNotFound
+		if errors.As(err, &errSCIMBridgeNotFound) {
+			return nil, nil
+		}
+
+		r.logger.ErrorCtx(ctx, "cannot get scim bridge", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewSCIMBridge(bridge), nil
+}
+
 // Events is the resolver for the events field.
 func (r *sCIMConfigurationResolver) Events(ctx context.Context, obj *types.SCIMConfiguration, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.SCIMEventOrderBy) (*types.SCIMEventConnection, error) {
 	if err := r.authorize(ctx, obj.ID, iam.ActionSCIMEventList); err != nil {
@@ -1734,6 +1835,9 @@ func (r *sessionConnectionResolver) TotalCount(ctx context.Context, obj *types.S
 	return nil, gqlutils.Internal(ctx)
 }
 
+// Connector returns schema.ConnectorResolver implementation.
+func (r *Resolver) Connector() schema.ConnectorResolver { return &connectorResolver{r} }
+
 // Identity returns schema.IdentityResolver implementation.
 func (r *Resolver) Identity() schema.IdentityResolver { return &identityResolver{r} }
 
@@ -1785,6 +1889,9 @@ func (r *Resolver) SAMLConfigurationConnection() schema.SAMLConfigurationConnect
 	return &sAMLConfigurationConnectionResolver{r}
 }
 
+// SCIMBridge returns schema.SCIMBridgeResolver implementation.
+func (r *Resolver) SCIMBridge() schema.SCIMBridgeResolver { return &sCIMBridgeResolver{r} }
+
 // SCIMConfiguration returns schema.SCIMConfigurationResolver implementation.
 func (r *Resolver) SCIMConfiguration() schema.SCIMConfigurationResolver {
 	return &sCIMConfigurationResolver{r}
@@ -1806,6 +1913,7 @@ func (r *Resolver) SessionConnection() schema.SessionConnectionResolver {
 	return &sessionConnectionResolver{r}
 }
 
+type connectorResolver struct{ *Resolver }
 type identityResolver struct{ *Resolver }
 type invitationResolver struct{ *Resolver }
 type invitationConnectionResolver struct{ *Resolver }
@@ -1819,6 +1927,7 @@ type personalAPIKeyConnectionResolver struct{ *Resolver }
 type queryResolver struct{ *Resolver }
 type sAMLConfigurationResolver struct{ *Resolver }
 type sAMLConfigurationConnectionResolver struct{ *Resolver }
+type sCIMBridgeResolver struct{ *Resolver }
 type sCIMConfigurationResolver struct{ *Resolver }
 type sCIMEventResolver struct{ *Resolver }
 type sCIMEventConnectionResolver struct{ *Resolver }

pkg/server/api/console/v1/resolver.go

@@ -21,6 +21,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"net/url"
 	"strings"
 
 	"github.com/go-chi/chi/v5"
@@ -76,7 +77,7 @@ func NewMux(
 
 		r.Get("/connectors/initiate", func(w http.ResponseWriter, r *http.Request) {
 			provider := r.URL.Query().Get("provider")
-			if provider != "SLACK" {
+			if provider != "SLACK" && provider != "GOOGLE_WORKSPACE" {
 				httpserver.RenderError(w, http.StatusBadRequest, fmt.Errorf("unsupported provider"))
 				return
 			}
@@ -118,9 +119,15 @@ func NewMux(
 				panic(fmt.Errorf("cannot initiate connector: %w", err))
 			}
 
-			// Allow external redirects for Slack OAuth only for now
+			// Allow external redirects for OAuth providers
-			slackSafeRedirect := &saferedirect.SafeRedirect{AllowedHost: "slack.com"}
+			var oauthSafeRedirect *saferedirect.SafeRedirect
-			slackSafeRedirect.Redirect(w, r, redirectURL, "/", http.StatusSeeOther)
+			switch provider {
+			case "SLACK":
+				oauthSafeRedirect = &saferedirect.SafeRedirect{AllowedHost: "slack.com"}
+			case "GOOGLE_WORKSPACE":
+				oauthSafeRedirect = &saferedirect.SafeRedirect{AllowedHost: "accounts.google.com"}
+			}
+			oauthSafeRedirect.Redirect(w, r, redirectURL, "/", http.StatusSeeOther)
 		})
 
 		r.Get("/connectors/complete", func(w http.ResponseWriter, r *http.Request) {
@@ -134,6 +141,8 @@ func NewMux(
 			switch provider {
 			case "SLACK":
 				connectorProvider = coredata.ConnectorProviderSlack
+			case "GOOGLE_WORKSPACE":
+				connectorProvider = coredata.ConnectorProviderGoogleWorkspace
 			default:
 				httpserver.RenderError(w, http.StatusBadRequest, fmt.Errorf("unsupported provider"))
 				return
@@ -145,16 +154,14 @@ func NewMux(
 				return
 			}
 
-			connection, organizationID, err := connectorRegistry.Complete(r.Context(), provider, r)
+			connection, organizationID, continueURL, err := connectorRegistry.Complete(r.Context(), provider, r)
 			if err != nil {
 				panic(fmt.Errorf("cannot complete connector: %w", err))
 			}
 
-			continueURL := r.URL.Query().Get("continue")
-
 			svc := proboSvc.WithTenant(organizationID.TenantID())
 
-			_, err = svc.Connectors.Create(
+			connector, err := svc.Connectors.Create(
 				r.Context(),
 				probo.CreateConnectorRequest{
 					OrganizationID: *organizationID,
@@ -167,12 +174,22 @@ func NewMux(
 				panic(fmt.Errorf("cannot create or update connector: %w", err))
 			}
 
-			if continueURL != "" {
+			// Append connector_id to the redirect URL so frontend can create the bridge
-				safeRedirect.Redirect(w, r, continueURL, "/", http.StatusSeeOther)
+			redirectURL := continueURL
-			} else {
+			if redirectURL == "" {
-				redirectURL := baseURL.WithPath("/organizations/" + organizationID.String()).MustString()
+				redirectURL = baseURL.WithPath("/organizations/" + organizationID.String()).MustString()
-				safeRedirect.Redirect(w, r, redirectURL, "/", http.StatusSeeOther)
 			}
+
+			parsedURL, err := url.Parse(redirectURL)
+			if err != nil {
+				logger.ErrorCtx(r.Context(), "cannot parse redirect URL", log.Error(err))
+				parsedURL, _ = url.Parse(baseURL.WithPath("/organizations/" + organizationID.String()).MustString())
+			}
+			q := parsedURL.Query()
+			q.Set("connector_id", connector.ID.String())
+			parsedURL.RawQuery = q.Encode()
+
+			safeRedirect.Redirect(w, r, parsedURL.String(), "/", http.StatusSeeOther)
 		})
 	})