providers/scim: fix vCenter compatibility mode (#21830)

authentik/providers/scim/clients/base.py

@@ -97,6 +97,9 @@ class SCIMClient[TModel: "Model", TConnection: "Model", TSchema: "BaseModel"](
         if cached_config is not None:
             return cached_config
 
+        if self.provider.compatibility_mode == SCIMCompatibilityMode.VCENTER:
+            return default_config
+
         # Attempt to fetch from remote
         path = "/ServiceProviderConfig"
         if self.provider.compatibility_mode == SCIMCompatibilityMode.SALESFORCE:

authentik/providers/scim/migrations/0019_scimprovider_group_filters_and_more.py

@@ -94,6 +94,7 @@ class Migration(migrations.Migration):
                     ("slack", "Slack"),
                     ("sfdc", "Salesforce"),
                     ("webex", "Webex"),
+                    ("vcenter", "vCenter"),
                 ],
                 default="default",
                 help_text="Alter authentik behavior for vendor-specific SCIM implementations.",

authentik/providers/scim/models.py

@@ -83,6 +83,7 @@ class SCIMCompatibilityMode(models.TextChoices):
     SLACK = "slack", _("Slack")
     SALESFORCE = "sfdc", _("Salesforce")
     WEBEX = "webex", _("Webex")
+    VCENTER = "vcenter", _("vCenter")
 
 
 class SCIMProvider(OutgoingSyncProvider, BackchannelProvider):

blueprints/schema.json

@@ -11099,7 +11099,8 @@
                         "aws",
                         "slack",
                         "sfdc",
-                        "webex"
+                        "webex",
+                        "vcenter"
                     ],
                     "title": "SCIM Compatibility Mode",
                     "description": "Alter authentik behavior for vendor-specific SCIM implementations."

packages/client-ts/src/models/CompatibilityModeEnum.ts

@@ -22,6 +22,7 @@ export const CompatibilityModeEnum = {
     Slack: "slack",
     Sfdc: "sfdc",
     Webex: "webex",
+    Vcenter: "vcenter",
     UnknownDefaultOpenApi: "11184809",
 } as const;
 export type CompatibilityModeEnum =

schema.yml

@@ -36180,6 +36180,7 @@ components:
       - slack
       - sfdc
       - webex
+      - vcenter
       type: string
     Config:
       type: object

web/src/admin/providers/scim/SCIMProviderFormForm.ts

@@ -206,6 +206,13 @@ export function renderForm({ provider, errors, update }: SCIMProviderFormProps)
                             value: CompatibilityModeEnum.Webex,
                             description: html`${msg("Altered behavior for usage with Cisco Webex.")}`,
                         },
+                        {
+                            label: msg("vCenter"),
+                            value: CompatibilityModeEnum.Vcenter,
+                            description: html`${msg(
+                                "Altered behavior for usage with VMware vCenter.",
+                            )}`,
+                        },
                     ]}
                     help=${msg(
                         "Alter authentik's behavior for vendor-specific SCIM implementations.",

website/docs/add-secure-apps/providers/scim/index.md

@@ -102,6 +102,7 @@ Available compatibility modes are:
 - **Slack**: Enables filtering support for Slack's SCIM implementation
 - **Salesforce**: Uses the non-standard `/ServiceProviderConfigs` endpoint
 - **Webex**: Uses the vendor-specific behavior required for Webex SCIM
+- **vCenter**: Skips the `ServiceProviderConfig` endpoint, which is not implemented in VMware vCenter
 
 To configure a compatibility mode, select the appropriate option in the **SCIM Compatibility Mode** field when creating or editing a SCIM provider.