Skip to content

Navigation Menu

Appearance settings

View all features
- BY COMPANY SIZE
  Enterprises
  Small and medium teams
  Startups
  Nonprofits
- BY USE CASE
  App Modernization
  DevSecOps
  DevOps
  CI/CD
  View all use cases
- BY INDUSTRY
  Healthcare
  Financial services
  Manufacturing
  Government
  View all industries
View all solutions
- EXPLORE BY TOPIC
  AI
  Software Development
  DevOps
  Security
  View all topics
- EXPLORE BY TYPE
  Customer stories
  Events & webinars
  Ebooks & reports
  Business insights
  GitHub Skills
- SUPPORT & SERVICES
  Documentation
  Customer support
  Community forum
  Trust center
  Partners
View all resources
- COMMUNITY
  GitHub SponsorsFund open source developers
- PROGRAMS
  Security Lab
  Maintainer Community
  Accelerator
  GitHub Stars
  Archive Program
- REPOSITORIES
  Topics
  Trending
  Collections
- ENTERPRISE SOLUTIONS
  Enterprise platformAI-powered developer platform
- AVAILABLE ADD-ONS
  GitHub Advanced SecurityEnterprise-grade security features
  Copilot for BusinessEnterprise-grade AI features
  Premium SupportEnterprise-grade 24/7 support
Pricing

Search code, repositories, users, issues, pull requests...

Search

Clear

Search syntax tips

Provide feedback

We read every piece of feedback, and take your input very seriously.

Include my email address so I can be contacted

Saved searches

Use saved searches to filter your results more quickly

Name

Query

To see all available qualifiers, see our documentation.

Appearance settings

You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

Uh oh!

There was an error while loading. Please reload this page.

graphql-hive / console Public

Notifications You must be signed in to change notification settings
Fork 144
Star 483

Code
Issues 205
Pull requests 55
Discussions
Actions
Security and quality
Insights

Additional navigation options

Code
Issues
Pull requests
Discussions
Actions
Security and quality
Insights

feat: scim group and user provisioning - #8096

#8096

Draft

n1ru4l wants to merge 126 commits into

maingraphql-hive/console:mainfrom

feat-scim-user-group-provisioninggraphql-hive/console:feat-scim-user-group-provisioningCopy head branch name to clipboard

Conversation Commits126 (126)Checks Files changed

Draft

feat: scim group and user provisioning#8096
n1ru4l wants to merge 126 commits into
mainfrom
feat-scim-user-group-provisioning

Commits

Commits on Jul 31, 2026

wip groups support
n1ru4l
committed
indices
n1ru4l
committed
issa unique
n1ru4l
committed
typo
n1ru4l
committed
implement managing mappings
n1ru4l
committed
implement delete
n1ru4l
committed
these are missing lol
n1ru4l
committed
feat: some more wip; display groups for user and use groups for authz
n1ru4l
committed
scimming?
n1ru4l
committed
cpu time revolution
n1ru4l
committed
damnnnn
n1ru4l
committed
typo
n1ru4l
committed
groups innit
n1ru4l
committed
fix dem types
n1ru4l
committed
some types
n1ru4l
committed
some lint
n1ru4l
committed
a bit more safety wont hurt
n1ru4l
committed
oidc integration resolution and todo comments
n1ru4l
committed
more todos
n1ru4l
committed
wire up plugin
n1ru4l
committed
not proud of it but
n1ru4l
committed
more
n1ru4l
committed
finally some tests
n1ru4l
committed
more context
n1ru4l
committed
wip
n1ru4l
committed
update external id
n1ru4l
committed
patch
n1ru4l
committed
:)
n1ru4l
committed
move things around
n1ru4l
committed
no escape needed
n1ru4l
committed
sum cleanup
n1ru4l
committed
more tests
n1ru4l
committed
run some more things in a transaction
n1ru4l
committed
the most basic rate limiting
n1ru4l
committed
offset-based pagination 久しぶり！
n1ru4l
committed
tests and fixes for get pagination!
n1ru4l
committed
path validation
n1ru4l
committed
run these in a transaction just in case
n1ru4l
committed
take over existing oidc account if the sub/externalId is shared
n1ru4l
committed
support setting custom id claim mapping
n1ru4l
committed
no soft delete groups for now
n1ru4l
committed
facepalm
n1ru4l
committed
feat: restrict SCIM provisioning to only domains verified with the organizationand add a flag to enforce login through oidc
n1ru4l
committed
feat: control "userProvisioningRequired" and "oidcForVerifiedDomainsRequired" flags via the GraphQL API; implement guard for "oidcForVerifiedDomainsRequired" when another oidc integration attempts …
n1ru4l
committed
feat: only update supertokens user attributes if not provisioned
n1ru4l
committed
add future note
n1ru4l
committed
feat: ensure that a organization admin can still sign in when oidc login is enforced
n1ru4l
committed
fix typescript interference
n1ru4l
committed
enable feature for integration tests
n1ru4l
committed
satisfy the linter
n1ru4l
committed
add basic crud tests for GraphQL fields "Organization.group", "Organization.groups" and "Mutation.addGroupMappingToGroup"
n1ru4l
committed
cover "Mutation.Mutation.removeGroupMapping" and "Mutation.updateGroupMapping" with tests
n1ru4l
committed
use correct sign-in url
n1ru4l
committed
the situation is a bit messy due to all the things that happen within Storage.ensureUserExists. This change should resolve the situation for now and makes the test for auto-updating the oidc provid…
n1ru4l
committed
remove old input parameter
n1ru4l
committed
store record creation date on new tables and introduce stable sort for role assignments to avoid test flakiness
n1ru4l
committed
use relative imports to address lint issue
n1ru4l
committed
add assertion just to be sure
n1ru4l
committed
add tests to ensure provisioned user use groups for resolving permissions and a disabled user is not able to log in
n1ru4l
committed
use the scim endpoints for the disable and infer group assignment tests
n1ru4l
committed
one import
n1ru4l
committed
run patch operation updates as single batch according to RFC 7644 paragraph 3.5.2
n1ru4l
committed
store updated_at value for groups and users and expose it via the required scim meta attributes
n1ru4l
committed
fix "totalResults" returning the total amount of rows (RFC 7644 3.4.2)
n1ru4l
committed
format the code
n1ru4l
committed
include groups property in Users resource to conform with strict SCIM provider requirements
n1ru4l
committed
add scim testkit
n1ru4l
committed
use provisioned user deactivation state and group memberships for resolving effective permissions and resources for personal access tokens
n1ru4l
committed
add support for previding user list during group creation via SCIM API
n1ru4l
committed
use shared helper for performing "createPersonalAccessToken" mutation
n1ru4l
committed
adjust whoami command implementation being able to show group role assignment permissions
n1ru4l
committed
add skeleton loader and empty state for group list overview
n1ru4l
committed
remove non-existing classes and fix typo message
n1ru4l
committed
add script for seeding scim users and groups
n1ru4l
committed
add new badge component
n1ru4l
committed
improve string perf
n1ru4l
committed
refine styles of organization member list. Display groups and disabled state and make it obvious if a user was provisioned via SCIM
n1ru4l
committed
add missing seed script
n1ru4l
committed
implement group filtering
n1ru4l
committed
use groups table look for members
n1ru4l
committed
fix pluralization
n1ru4l
committed
improve group page styles by using new badge component
n1ru4l
committed
fix eslint issues
n1ru4l
committed
rename page
n1ru4l
committed
disallow updating user properties via `User.updateMe` mutation of the user was provisioned via SCIM
n1ru4l
committed
disallow provisioned users creating organizations
n1ru4l
committed
prevent user from leaving the organization
n1ru4l
committed
prevent provisioned user being removed from organization
n1ru4l
committed
run all tests
n1ru4l
committed
restrict direct assignment of a role/group to a provisioned user
n1ru4l
committed
prevent provisioned users from joining another organization
n1ru4l
committed
prevent organization ownership transfer to a provisioned user
n1ru4l
committed
prevent account linking to provisioned account
n1ru4l
committed
sync db types
n1ru4l
committed
support button variants for alert dialog action
n1ru4l
committed
fix destructive state of delete role assignment confirm button
n1ru4l
committed
allow managing the user id claim from the organization oidc settings
n1ru4l
committed
small ui tweaks
n1ru4l
committed
entra id adjustments
n1ru4l
committed
refactor test cases to use testkit
n1ru4l
committed
move `UpdateOIDCIntegrationInput.userProvisioningRequired` and `UpdateOIDCIntegrationInput.oidcForVerifiedDomainsRequired` fields from `UpdateOIDCIntegrationInput` to ` UpdateOIDCRestrictionsInput`
n1ru4l
committed
implement ui for enforcing login through the oidc provider and enforcing scim provisioning
n1ru4l
committed
remove unused vars
n1ru4l
committed
prevent assigning a member role form a different organization to a role
n1ru4l
committed
ensure the correct content type is used
n1ru4l
committed
support `excludeAttributes=members` for the `GET /Groups/:id` endpoint.
n1ru4l
committed
correctly handle patch user operation with mixed filtered email update
n1ru4l
committed
ensure that batched user additions and removals are applied in sequence; make user and group lookup via secondary attributes case insensitive
n1ru4l
committed
i dont want to cd into integreation-tests anymore
n1ru4l
committed
ensure operations are atomic
n1ru4l
committed
remove unused method
n1ru4l
committed
fix tests
n1ru4l
committed
add audit log
n1ru4l
committed
introduce dedicated permission `scim:provision` for all scim operations
n1ru4l
committed
fix clickhouse import
n1ru4l
committed
pass null in case no user id claim is set
n1ru4l
committed
expose scim endpoint via deployment config
n1ru4l
committed
do not include the user id claim as a requested scope
n1ru4l
committed
:facepalm: of shame
n1ru4l
committed
add index for invalidating supertoken sessions
n1ru4l
committed
cleanup code
n1ru4l
committed
improve class name
n1ru4l
committed
remove codegen comments
n1ru4l
committed
no trpc
n1ru4l
committed
oops
n1ru4l
committed
fix imports
n1ru4l
committed

Footer

© 2026 GitHub, Inc.

Footer navigation

Terms
Privacy
Security
Status
Community
Docs
Contact

You can’t perform that action at this time.