SCIM token can be generated when group SAML is disabled

Summary

When a group's SAML integration is enabled and then disabled, the Generate a SCIM token button remains visible on the SAML SSO settings page. Clicking it successfully generates a token and the SCIM endpoint accepts requests with it, but SCIM provisioning will not function because SAML is disabled.

There are two root causes:

  1. View — ee/app/views/groups/saml_providers/show.html.haml renders the SCIM Token section unconditionally, with no check on @saml_provider.enabled?.
  2. Controller — Groups::ScimOauthController before_action guards (check_group_saml_available!, check_group_saml_configured) only verify the group_saml OmniAuth provider is globally configured and the feature is licensed. Neither checks whether the group's SamlProvider record has enabled: true, so token creation succeeds even when SAML is disabled.

Steps to reproduce

  1. On a GitLab.com group, go to Settings > SAML SSO.
  2. Enable SAML, configure it, and save.
  3. Disable SAML (uncheck Enable SAML authentication) and save.
  4. Observe the SCIM Token section still shows the Generate a SCIM token button.
  5. Click the button — a token is generated successfully.
  6. Attempt SCIM provisioning using the token — it will fail because SAML is disabled.

What is the current bug behavior?

The SCIM token generation button is visible and functional when the group SAML provider is disabled. A token can be generated and the SCIM endpoint accepts it, but provisioning does not work.

What is the expected correct behavior?

The SCIM Token section (and token generation) should be hidden and blocked when the group's SAML provider is disabled. This matches the behaviour of Groups::SsoController, which correctly guards actions behind require_enabled_provider!.

Possible fixes

View (ee/app/views/groups/saml_providers/show.html.haml): wrap the SCIM Token section with:

- if @saml_provider&.enabled?

Controller (ee/app/controllers/groups/scim_oauth_controller.rb): add a before_action that checks the provider is enabled:

before_action :check_saml_provider_enabled!

def check_saml_provider_enabled!
  render_404 unless @group.saml_provider&.enabled?
end

The controller fix is the more critical one as it prevents token generation even via direct API calls.

Relevant logs and/or screenshots

N/A — reproducible on GitLab.com with a group that has the group_saml feature available.

Edited by 🤖 GitLab Bot 🤖