rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Preserve shared connector on SCIM disconnect

Browse Source 
DeleteSCIMConfiguration unconditionally deleted the underlying OAuth2
connector together with the SCIM bridge and config. When the same
connector was also referenced from access_sources -- which happens
when Google Workspace is used for both SCIM and access reviews -- the
access_sources.connector_id foreign key (NO ACTION) rejected the
DELETE, aborting the whole transaction. Nothing was deleted and the
resolver returned an INTERNAL error.

Check the access_sources reference count before deleting the connector
and skip the connector delete when it is still in use. The bridge's
own connector_id FK is ON DELETE SET NULL, so dropping the bridge
alone is sufficient to unbind SCIM; leaving the connector untouched
keeps the access source working.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
This commit is contained in:
Aurélien Sibiril
2026-04-16 14:14:02 +02:00
committed by Sacha Al Himdani
parent 2ea5f56ad6
commit f15936dcdf
1 changed files with 16 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
pkg/iam/organization_service.go
View File

@@ -1580,12 +1580,23 @@ func (s OrganizationService) DeleteSCIMConfiguration(
}
if err == nil {
// Bridge exists, delete connector if it has one
// Bridge exists. Only delete the underlying connector if nothing
// else references it (e.g. access_sources). Otherwise leave it in
// place — the bridge's FK is ON DELETE SET NULL, so deleting the
// bridge alone is sufficient to unbind SCIM from the connector.
if bridge.ConnectorID != nil {
connector := &coredata.Connector{ID: *bridge.ConnectorID}
err = connector.Delete(ctx, tx, scope)
if err != nil && err != coredata.ErrResourceNotFound {
return fmt.Errorf("cannot delete connector: %w", err)
accessSources := &coredata.AccessSources{}
count, err := accessSources.CountByConnectorID(ctx, tx, scope, *bridge.ConnectorID)
if err != nil {
return fmt.Errorf("cannot count access sources for connector: %w", err)
}
if count == 0 {
connector := &coredata.Connector{ID: *bridge.ConnectorID}
err = connector.Delete(ctx, tx, scope)
if err != nil && err != coredata.ErrResourceNotFound {
return fmt.Errorf("cannot delete connector: %w", err)
}
}
}