Skip to content

docs: document SCIM 2.0 handler opt-in and legacy flag#27469

Open
Emyrk wants to merge 5 commits into
mainfrom
emyrk/docs-scim2-opt-in
Open

docs: document SCIM 2.0 handler opt-in and legacy flag#27469
Emyrk wants to merge 5 commits into
mainfrom
emyrk/docs-scim2-opt-in

Conversation

@Emyrk

@Emyrk Emyrk commented Jul 23, 2026

Copy link
Copy Markdown
Member

Documents the SCIM 2.0 handler introduced in #25572 and how to opt in.

Adds a "SCIM 2.0 handler" subsection to the SCIM section of docs/admin/users/oidc-auth/index.md:

  • The handler follows RFC 7644 and supports user provisioning/deprovisioning and user listing.
  • Opt in with CODER_SCIM_USE_LEGACY=false (also --scim-use-legacy / scimUseLegacy); requires a server restart.
  • Behavior notes: delete/deactivate suspends (never hard-deletes), reactivation goes through dormant, usernames are immutable.
  • Notes it will eventually become the default behavior.

Behavior details were verified against enterprise/coderd/scimroutes.go, enterprise/coderd/scim/, and the SCIM Use Legacy option in codersdk/deployment.go.

make lint/markdown and make lint/emdash pass.


Generated by Coder Agents on behalf of @Emyrk.

@github-actions

github-actions Bot commented Jul 23, 2026

Copy link
Copy Markdown

Docs preview

Check off each page once it's been reviewed. If a page changes in a later push, its checkbox clears automatically so it gets a fresh look. Pages not yet wired into the docs navigation aren't listed here.

@Emyrk
Emyrk marked this pull request as ready for review July 23, 2026 20:24
@Emyrk
Emyrk requested a review from a team as a code owner July 23, 2026 20:24
@Emyrk
Emyrk requested a review from matifali July 23, 2026 20:24
@coder-tasks

coder-tasks Bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

Documentation Check

This PR is a docs change. One accuracy issue in the new prose:

Updates Needed

  • docs/admin/users/oidc-auth/index.md - The behavior note "Attempts to change userName via PUT or PATCH return a mutability error" does not match the code in enterprise/coderd/scim/users.go:

    • PUT (Replace) returns a plain 400 via scimErrors.ScimErrorBadRequest("changing the 'userName' field is not supported ..."). That helper sets no scimType, so it is not a mutability-typed error (there is a separate ScimErrorMutability the code does not use).
    • PATCH (Patch) only processes the active attribute and silently ignores userName (see the // TODO: Honor mutability rules of fields like userName at users.go:323), so it returns no error at all.

    Suggested reword: keep "Usernames are immutable," but describe the actual behavior, e.g. that a PUT with a changed userName is rejected with a 400 Bad Request, and PATCH currently only applies the active attribute and ignores other fields.

The rest of the section checks out against the code: opt-in via CODER_SCIM_USE_LEGACY=false / --scim-use-legacy / scimUseLegacy (default true, so false opts in), DELETE and active: false both suspend (never hard-delete), and re-activation/re-creation of a suspended user goes through the dormant state (scimUserStatus).


Automated review via Coder Agents

@nickvigilante nickvigilante left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved with changes. Thanks for this! :shipit: 🚀

Comment thread docs/admin/users/oidc-auth/index.md Outdated
Comment thread docs/admin/users/oidc-auth/index.md Outdated
Comment thread docs/admin/users/oidc-auth/index.md Outdated
@Emyrk Emyrk closed this Jul 23, 2026
@github-actions github-actions Bot locked and limited conversation to collaborators Jul 23, 2026
@Emyrk
Emyrk deleted the emyrk/docs-scim2-opt-in branch July 23, 2026 20:45
@Emyrk
Emyrk restored the emyrk/docs-scim2-opt-in branch July 23, 2026 21:08
@Emyrk

Emyrk commented Jul 23, 2026

Copy link
Copy Markdown
Member Author

I did not mean to close this

@Emyrk Emyrk reopened this Jul 23, 2026
Emyrk and others added 3 commits July 23, 2026 16:09
Co-authored-by: Nick Vigilante <nickvigilante@users.noreply.github.com>
Co-authored-by: Nick Vigilante <nickvigilante@users.noreply.github.com>
Co-authored-by: Nick Vigilante <nickvigilante@users.noreply.github.com>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants