Crate rustauth_scim

Expand description

Server-side SCIM 2.0 provisioning for RustAuth.

§Provider connections

Each row in scim_providers is keyed by a globally unique provider_id (Better Auth uses the same model). That id names one SCIM integration — for example a single Okta enterprise app — not a tenant or organization by itself. Optional organization_id on the row and in the bearer token limits which users may be provisioned.

If you need two independent tokens for the same vendor, use two provider ids (okta-workforce, okta-partners). Regenerating a token updates the existing row via upsert instead of deleting it first.

§List filters

Database pushdown: userName eq "user@example.com" (filters::list_user_filter_uses_database_pushdown).
In-memory evaluation: any other expression accepted by filters::parse_filter, including extension attributes stored in SCIM user profiles.

See the crate README for route coverage and parity notes versus Better Auth.

Modules§

errors: SCIM error responses.
filters: SCIM filter parsing.
metadata: SCIM metadata resources.
resources: SCIM resource mapping.
validation: SCIM request validation helpers.

Structs§

AfterScimTokenGeneratedInput: Payload for after_token_generated.
BeforeScimTokenGeneratedInput: Payload for before_token_generated.
DefaultScimProvider: A statically configured SCIM provider.
ProviderOwnershipOptions: Provider ownership configuration.
ScimAuditEvent: Audit event emitted by the SCIM plugin.
ScimAuditEventResolver: Async sink for SCIM audit events.
ScimHookError: Error returned by SCIM hooks to abort a management request.
ScimOptions: SCIM plugin options.
ScimOrganizationMember: Organization member details passed to SCIM hooks.

Enums§

ScimAuditEventKind: SCIM audit event kind.
ScimAuditSeverity: Severity level for SCIM audit events.
ScimBulkMode: How POST /scim/v2/Bulk applies database changes.
ScimDeprovisionMode: How DELETE /scim/v2/Users/:id (and bulk user delete) deprovisions users.
ScimTokenStorage: Built-in SCIM token storage modes.

Constants§

UPSTREAM_PLUGIN_ID: Better Auth upstream plugin identifier used for endpoint and schema parity.
VERSION: Current crate version.

Functions§

scim: Build the server-side SCIM plugin.

Type Aliases§

AfterScimTokenGeneratedHook: Hook invoked after a SCIM token provider is persisted.
BeforeScimTokenGeneratedHook: Hook invoked before a SCIM token provider is persisted.
ScimHookFuture: Boxed future returned by SCIM hooks.
ScimTokenStorageFuture: Boxed future returned by custom token storage callbacks.
ScimTokenTransform: Custom token transformation callback.