Add SCIM ResourceTypes discovery endpoint

Ricardo Amarillarequested to merge
452118-scim-discovery-4-resource-types into master

What does this MR do and why?

Fourth and last MR of a stacked series that adds the SCIM service provider discovery endpoints (RFC 7644 §4). Depends on !258175 (merged).

Adds GET /ResourceTypes and GET /ResourceTypes/:id (RFC 7643 §6):

  • Group SCIM (/api/scim/v2/groups/:group_path): User only, since group SCIM has no /Groups resource.
  • Instance SCIM (/api/scim/v2/application): User and Group.

Each resource type references its schema URN from /Schemas (!257947 (merged)). Behind the scim_discovery_endpoints feature flag.

With this MR, all three discovery endpoints requested in #452118 (ServiceProviderConfig, ResourceTypes, Schemas) are available behind the flag.

Stacked MRs

  1. !257943 (merged): schema definitions (merged)
  2. gitlab-org/cells/http-router!1406 (merged): HTTP Router routes for all three discovery endpoints, merged right before !257947 (merged)
  3. !257947 (merged): /Schemas + feature flag + docs
  4. !258175 (merged): /ServiceProviderConfig
  5. This MR: /ResourceTypes

HTTP Router

This MR adds routes to config/routing/gitlab_routes.json. The HTTP Router routes for all three discovery MRs are added at once in gitlab-org/cells/http-router!1406 (merged), which is merged right before !257947 (merged). As the top of the stack, this branch's routes snapshot should match the router's, so cells-routes:router-in-sync is expected to pass here once that MR is merged and this MR is rebased.

References

  • #452118: Complete implementation of SCIM 2.0 per RFC7644

Screenshots or screen recordings

Not applicable (API only). Example response in the docs changes.

How to set up and validate locally

  1. Set up a group with SAML SSO and a group SCIM token, and enable the flag, as described in !257947 (merged).
  2. List the resource types (only User for group SCIM): 
    curl "http://gdk.test:3000/api/scim/v2/groups/scim-demo/ResourceTypes" --header "Authorization: Bearer <token>"
  3. Verify GET .../ResourceTypes/Group returns 404 for group SCIM.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

🤖 Generated with Claude Code

Edited by Ricardo Amarilla

Merge request reports