opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

docs: document SCIM 2.0 handler opt-in and legacy flag (#27469)

Browse Source 
Documents the SCIM 2.0 handler introduced in #25572 and how to opt in.

Adds a "SCIM 2.0 handler" subsection to the SCIM section of
`docs/admin/users/oidc-auth/index.md`:

- The handler follows RFC 7644 and supports user
provisioning/deprovisioning and user listing.
- Opt in with `CODER_SCIM_USE_LEGACY=false` (also `--scim-use-legacy` /
`scimUseLegacy`); requires a server restart.
- Behavior notes: delete/deactivate suspends (never hard-deletes),
reactivation goes through dormant, usernames are immutable.
- Notes it will eventually become the default behavior.

Behavior details were verified against
`enterprise/coderd/scimroutes.go`, `enterprise/coderd/scim/`, and the
`SCIM Use Legacy` option in `codersdk/deployment.go`.

`make lint/markdown` and `make lint/emdash` pass.

---

Generated by Coder Agents on behalf of @Emyrk.

---------

Co-authored-by: Nick Vigilante <nickvigilante@users.noreply.github.com>
This commit is contained in:
Steven Masley
2026-07-27 08:20:27 -05:00
committed by GitHub
co-authored by Nick Vigilante
parent fd2faaa2f8
commit 92d45a0411
1 changed files with 25 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/admin/users/oidc-auth/index.md
+25
View File
@@ -161,6 +161,31 @@ it the Coder server.
CODER_SCIM_AUTH_HEADER="your-api-key"
```
### SCIM 2.0 handler
Coder includes an opt-in SCIM 2.0 handler that follows [RFC 7644](https://datatracker.ietf.org/doc/html/rfc7644) and has been verified against an external SCIM 2.0 compliance suite.
It supports the following:
- User provisioning and deprovisioning
- User listing
To opt in, set:
```dotenv
CODER_SCIM_USE_LEGACY=false
```
This is also available as the `--scim-use-legacy` server flag and the `scimUseLegacy` YAML option.
Changing it requires a restart of the Coder server.
Behavior notes:
- Coder never hard-deletes users. `DELETE /scim/v2/Users/{id}` and deactivation (`active: false`) both [suspend](../index.md#suspend-a-user) the user.
- Re-activating or re-creating a previously suspended user places them in the dormant state, and they become active again on their next login.
- Usernames are immutable. Attempts to change `userName` via `PUT` or `PATCH` return a `mutability` error.
The SCIM 2.0 handler will eventually become the default behavior.
## TLS
If your OpenID Connect provider requires client TLS certificates for