Repository navigation
Replies: 1 comment
|
I opened an issue for this enhancement: #53837 |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
26.7 ships
keycloak-scim-core,-modeland-servicesbehind theSCIM_APIfeature — the inbound side, where Keycloak is the service provider. There's also akeycloak-scim-clientartifact published to Maven, though nothing in the server distribution depends on it. What I can't find is anything on the outbound side: pushing Keycloak users and groups into SaaS apps that expose a SCIM endpoint. The existing community extensions for this call SCIM synchronously from an event listener, in the authentication request thread, which doesn't survive an app being slow or down.We've built an engine for this and it's working in production-shaped tests. The protocol part is easy; the parts that took the time were:
userNamebefore creating, so an existing account is adopted rather than duplicated, including after a crash between the app's 201 and our commit;Before I PR, I'd rather ask than guess:
ComponentModelfor destinations,EventListenerProviderfor enqueue,TimerProvider+ClusterProviderfor the drainer,WorkflowStepProviderfor lifecycle triggers)? Is that the combination you'd expect, or is there a better-fitting extension point I've missed?keycloak-scim-clientintended for extension authors to use, or is it internal to the inbound implementation? It isn't in the distribution, so using it means bundling it plus Apache HttpClient and the RESTEasy client.I did a search of the existing discussions and issues, but wasn't able to find a similar discussion.
All reactions