From 9d0ab594fbbb18dbf015f1566bd11b9c2af2e7fd Mon Sep 17 00:00:00 2001
From: Steven Masley <Emyrk@users.noreply.github.com>
Date: Wed, 17 Jun 2026 09:44:01 -0700
Subject: [PATCH]  chore: unhide 'scim-use-legacy' flag (#26465)

---
 cli/testdata/coder_server_--help.golden            |  4 ++++
 cli/testdata/server-config.yaml.golden             |  4 ++++
 codersdk/deployment.go                             |  2 +-
 docs/reference/cli/server.md                       | 11 +++++++++++
 enterprise/cli/testdata/coder_server_--help.golden |  4 ++++
 5 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/cli/testdata/coder_server_--help.golden b/cli/testdata/coder_server_--help.golden
index ea137e1024..4e5d4a5599 100644
--- a/cli/testdata/coder_server_--help.golden
+++ b/cli/testdata/coder_server_--help.golden
@@ -982,5 +982,9 @@ These options are only available in the Enterprise Edition.
           Enables SCIM and sets the authentication header for the built-in SCIM
           server. New users are automatically created with OIDC authentication.
 
+      --scim-use-legacy bool, $CODER_SCIM_USE_LEGACY (default: true)
+          Use the legacy SCIM implementation instead of the SCIM 2.0 handler.
+          This is provided for backward compatibility for existing users.
+
 ———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/server-config.yaml.golden b/cli/testdata/server-config.yaml.golden
index 80350aefb2..0d844b6afd 100644
--- a/cli/testdata/server-config.yaml.golden
+++ b/cli/testdata/server-config.yaml.golden
@@ -519,6 +519,10 @@ sshKeygenAlgorithm: ed25519
 # URL to use for agent troubleshooting when not set in the template.
 # (default: https://coder.com/docs/admin/templates/troubleshooting, type: url)
 agentFallbackTroubleshootingURL: https://coder.com/docs/admin/templates/troubleshooting
+# Use the legacy SCIM implementation instead of the SCIM 2.0 handler. This is
+# provided for backward compatibility for existing users.
+# (default: true, type: bool)
+scimUseLegacy: true
 # Disable workspace apps that are not served from subdomains. Path-based apps can
 # make requests to the Coder API and pose a security risk when the workspace
 # serves malicious JavaScript. This is recommended for security purposes if a
diff --git a/codersdk/deployment.go b/codersdk/deployment.go
index 9caba9d1eb..392270235b 100644
--- a/codersdk/deployment.go
+++ b/codersdk/deployment.go
@@ -3585,7 +3585,7 @@ func (c *DeploymentValues) Options() serpent.OptionSet {
 			Description: "Use the legacy SCIM implementation instead of the SCIM 2.0 handler. This is provided for backward compatibility for existing users.",
 			Flag:        "scim-use-legacy",
 			Env:         "CODER_SCIM_USE_LEGACY",
-			Hidden:      true,
+			YAML:        "scimUseLegacy",
 			// TODO: When SCIM 2.0 has been tested more, flip this to false to default to the new scim
 			Default:     "true",
 			Annotations: serpent.Annotations{}.Mark(annotationEnterpriseKey, "true"),
diff --git a/docs/reference/cli/server.md b/docs/reference/cli/server.md
index 987fc849a8..9cd918b0fa 100644
--- a/docs/reference/cli/server.md
+++ b/docs/reference/cli/server.md
@@ -1131,6 +1131,17 @@ Whether Coder only allows connections to workspaces via the browser.
 
 Enables SCIM and sets the authentication header for the built-in SCIM server. New users are automatically created with OIDC authentication.
 
+### --scim-use-legacy
+
+|             |                                     |
+|-------------|-------------------------------------|
+| Type        | <code>bool</code>                   |
+| Environment | <code>$CODER_SCIM_USE_LEGACY</code> |
+| YAML        | <code>scimUseLegacy</code>          |
+| Default     | <code>true</code>                   |
+
+Use the legacy SCIM implementation instead of the SCIM 2.0 handler. This is provided for backward compatibility for existing users.
+
 ### --external-token-encryption-keys
 
 |             |                                                    |
diff --git a/enterprise/cli/testdata/coder_server_--help.golden b/enterprise/cli/testdata/coder_server_--help.golden
index 18c6da79cb..e88121f794 100644
--- a/enterprise/cli/testdata/coder_server_--help.golden
+++ b/enterprise/cli/testdata/coder_server_--help.golden
@@ -983,5 +983,9 @@ These options are only available in the Enterprise Edition.
           Enables SCIM and sets the authentication header for the built-in SCIM
           server. New users are automatically created with OIDC authentication.
 
+      --scim-use-legacy bool, $CODER_SCIM_USE_LEGACY (default: true)
+          Use the legacy SCIM implementation instead of the SCIM 2.0 handler.
+          This is provided for backward compatibility for existing users.
+
 ———
 Run `coder --help` for a list of global options.