Struct ScimPlugin 

pub struct ScimPlugin { /* private fields */ }

Implementations

impl ScimPlugin

pub fn reconcile_projection_endpoint( domain: &str, ) -> AuthResult<ServerEndpoint<Value>>

Request complete-state reconciliation of one provisioning domain.

Errors

Returns an error if arguments cannot be serialized.

pub fn decommission_managed_connection_endpoint( id: &str, domain: &str, actor: &str, ) -> AuthResult<ServerEndpoint<Value>>

Retire a managed connection and its active credentials through the trusted API.

Errors

Returns an error if arguments cannot be serialized.

pub fn decommission_connection_endpoint( id: &str, domain: Option<&str>, ) -> AuthResult<ServerEndpoint<Value>>

Permanently bind and retire a connection before its first provisioning request.

Errors

Returns an error if arguments cannot be serialized.

pub fn list_managed_connection_events_endpoint( id: &str, domain: &str, ) -> AuthResult<ServerEndpoint<Value>>

List the newest 100 connection events in ascending sequence order.

Errors

Returns an error if the arguments cannot be serialized.

pub fn revoke_managed_credential_endpoint( id: &str, domain: &str, credential: &str, actor: &str, ) -> AuthResult<ServerEndpoint<Value>>

Revoke one domain-owned credential through the trusted server API.

Errors

Returns an error if the arguments cannot be serialized.

pub fn rotate_managed_credential_endpoint( input: &ScimManagedCredentialRotationInput, ) -> AuthResult<ServerEndpoint<Value>>

Trusted rotation arguments with an actual Date expiry.

Errors

Returns an error if the arguments cannot be serialized.

pub fn get_managed_connection_endpoint( id: &str, domain: &str, ) -> AuthResult<ServerEndpoint<Value>>

Read domain-owned connection metadata and its current credential policy.

Errors

Returns an error if the arguments cannot be serialized.

pub fn list_managed_connections_endpoint( domain: &str, ) -> AuthResult<ServerEndpoint<Value>>

List durable connection metadata belonging to one provisioning domain.

Errors

Returns an error if the input cannot be serialized.

pub fn create_managed_connection_endpoint( input: &ScimManagedConnectionInput, ) -> AuthResult<ServerEndpoint<Value>>

Create a managed connection and one independently hashed bearer credential.

Errors

Returns an error if the arguments cannot be represented as logical input.

impl ScimPlugin

pub fn projection<S: AuthSchema>( self, projection: Arc<dyn ScimProjection<S>>, ) -> ConfiguredScimPlugin<S>

impl ScimPlugin

pub fn identity<S: AuthSchema>( self, identity: Arc<dyn ScimIdentity<S>>, ) -> ConfiguredScimPlugin<S>

impl ScimPlugin

pub fn authentication<S: AuthSchema>( self, verifier: Arc<dyn ScimBearerTokenVerifier<S>>, ) -> ConfiguredScimPlugin<S>

impl ScimPlugin

pub const fn new() -> Self

pub fn compatibility(self, options: ScimCompatibilityOptions) -> Self

Configure provisioning-client input compatibility.

pub fn managed_connections(self, options: ScimManagedConnectionOptions) -> Self

pub fn connections(self, connections: Vec<ScimConnectionOptions>) -> Self

pub fn delete_user_endpoint(id: &str) -> AuthResult<ServerEndpoint<()>>

Delete a canonical User and reconcile its durable identity and access state.

Errors

Returns an error if parameters cannot be serialized.

pub fn patch_group_endpoint(id: &str) -> AuthResult<ServerEndpoint<Value>>

Apply SCIM PATCH operations to a connection-owned canonical Group.

Errors

Returns an error if parameters cannot be serialized.

pub fn replace_group_endpoint(id: &str) -> AuthResult<ServerEndpoint<Value>>

Replace all mutable attributes of a connection-owned canonical Group.

Errors

Returns an error if parameters cannot be serialized.

pub fn delete_group_endpoint(id: &str) -> AuthResult<ServerEndpoint<()>>

Delete a connection-owned canonical SCIM Group.

Errors

Returns an error if parameters cannot be serialized.

pub fn patch_user_endpoint(id: &str) -> AuthResult<ServerEndpoint<Value>>

Apply ordered changes to a connection-owned canonical User.

Errors

Returns an error if parameters cannot be serialized.

pub fn replace_user_endpoint(id: &str) -> AuthResult<ServerEndpoint<Value>>

Replace the mutable attributes of a connection-owned canonical User.

Errors

Returns an error if parameters cannot be serialized.

pub const fn create_user_endpoint() -> ServerEndpoint<Value>

Provision a connection-owned canonical SCIM User.

pub const fn create_group_endpoint() -> ServerEndpoint<Value>

Create a connection-owned canonical SCIM Group.

pub const fn users_endpoint() -> ServerEndpoint<Value>

List the connection-owned SCIM Users through the server API.

pub const fn groups_endpoint() -> ServerEndpoint<Value>

List the connection-owned SCIM Groups through the server API.

pub fn user_endpoint(id: &str) -> AuthResult<ServerEndpoint<Value>>

Read a connection-owned SCIM User through the server API.

Errors

Returns an error if parameters cannot be serialized.

pub fn group_endpoint(id: &str) -> AuthResult<ServerEndpoint<Value>>

Read a connection-owned SCIM Group through the server API.

Errors

Returns an error if parameters cannot be serialized.

pub const fn service_provider_config_endpoint() -> ServerEndpoint<Value>

Discover the installed SCIM protocol capabilities without credentials.

pub const fn resource_types_endpoint() -> ServerEndpoint<Value>

List the SCIM resource types and their optional extensions.

pub const fn schemas_endpoint() -> ServerEndpoint<Value>

List the SCIM User, Enterprise User and Group schema contracts.

pub fn schema_endpoint(id: &str) -> AuthResult<ServerEndpoint<Value>>

Read a SCIM schema by its raw or URI-encoded identifier.

Errors

Returns an error if path parameters cannot be serialized.

pub fn resource_type_endpoint(id: &str) -> AuthResult<ServerEndpoint<Value>>

Read one case-sensitive SCIM resource type through the server API.

Errors

Returns an error if the path parameters cannot be serialized.

Trait Implementations

impl<S: AuthSchema> AuthPlugin<S> for ScimPlugin

fn on_http_request_action<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, req: &'life1 AuthRequest, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<Option<HttpRequestAction>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Inspect or replace the physical request. The default preserves existing on_http_request implementations. Request-local configuration has already been resolved from the incoming request, matching the Source HTTP handler.

fn static_openapi_metadata(&self) -> PluginOpenApiMetadata

Base declarations for documentation without an initialized auth instance.

fn openapi_metadata(&self, ctx: &AuthInitContext<S>) -> PluginOpenApiMetadata

Documentation annotations collected after all plugins initialize. Override this hook for custom endpoints and model field policies.

fn name(&self) -> &'static str

Plugin name - should be unique

fn allowed_media_types(&self, route: &AuthRoute) -> Vec<&'static str>

Media types accepted before request hooks and endpoint dispatch. An empty list disables the media restriction for an application-owned endpoint.

fn routes(&self) -> Vec<AuthRoute>

Routes that this plugin handles

fn server_endpoints(&self) -> Vec<EndpointDefinition>

Trusted operations available through host dispatch, independently of HTTP visibility.

fn validate_endpoint( &self, call: &EndpointCall, _ctx: &AuthContext<S>, ) -> AuthResult<EndpointInput>

Validate actual input after all before-hook patches have been applied.

fn on_init<'life0, 'life1, 'async_trait>( &'life0 self, _ctx: &'life1 mut AuthInitContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Called when the plugin is initialized

fn on_endpoint<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, call: &'life1 EndpointCall, ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<EndpointResponse>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Execute a registered operation with validated handler-phase context.

fn on_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, req: &'life1 AuthRequest, ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<Option<AuthResponse>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Called for each request - return Some(response) to handle, None to pass through

fn rate_limits(&self) -> Vec<PluginRateLimit>

Ordered rate-limit policies supplied by this installed plugin.

fn endpoint_hooks(&self) -> Vec<&dyn EndpointHook<S>>

Installed logical-call hooks, in this plugin’s registration order.

fn origin_check_skip_paths(&self) -> Vec<&'static str>

Protocol callback prefixes whose verified state replaces browser origin admission.

fn session_fields(&self) -> IndexMap<String, FieldConfig>

Session field policies contributed by this registered plugin.

fn user_fields(&self) -> IndexMap<String, FieldConfig>

fn account_fields(&self) -> IndexMap<String, FieldConfig>

fn on_http_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _req: &'life1 AuthRequest, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<Option<AuthResponse>, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Inspect the original physical HTTP request before routing, body parsing, origin validation and endpoint hooks. Disabled paths and transport/rate limiting middleware run first. Returning a response stops dispatch and later plugin hooks. Server-only endpoint calls do not invoke this hook.

fn on_http_response<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, _req: &'life1 AuthRequest, _ctx: &'life2 AuthContext<S>, _response: &'life3 AuthResponse, ) -> Pin<Box<dyn Future<Output = Result<Option<AuthResponse>, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait, Self: 'async_trait,

Observe the routed HTTP response before transport middleware (including CORS). Hooks run in registration order; the first replacement stops this chain. Early HTTP request-hook responses skip this stage. Errors escape dispatch; they cannot reverse writes already committed by an endpoint.

fn before_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _req: &'life1 AuthRequest, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<Option<BeforeRequestAction>, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Called after route matching and before endpoint dispatch.

fn on_http_endpoint<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, req: &'life1 AuthRequest, ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<Option<HttpEndpointResponse>, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Dispatch the resolved HTTP endpoint. Existing plugins return logical values through on_request; plugins returning a native raw response can override this method to bypass the endpoint after-hook pipeline.

fn after_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _req: &'life1 AuthRequest, _ctx: &'life2 AuthContext<S>, response: AuthResponse, ) -> Pin<Box<dyn Future<Output = Result<AuthResponse, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Transform a completed response, including redirects and rejections.

fn on_user_created<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _user: &'life1 <S as AuthSchema>::User, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<(), AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Called after a user is created

fn on_session_created<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _session: &'life1 <S as AuthSchema>::Session, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<(), AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Called after a session is created

fn on_user_deleted<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _user_id: &'life1 str, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<(), AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Called before a user is deleted

fn on_session_deleted<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _session_token: &'life1 str, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<(), AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Called before a session is deleted

impl Clone for ScimPlugin

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ScimPlugin

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ScimPlugin

fn default() -> Self

Returns the “default value” for a type.