scim v0

backend/windmill-api/src/lib.rs

@@ -8,6 +8,7 @@
 
 use crate::oauth2::AllClients;
 use crate::saml::{SamlSsoLogin, ServiceProviderExt};
+use crate::scim::has_basic_auth;
 use crate::{
     db::UserDB,
     oauth2::{build_oauth_clients, SlackVerifier},
@@ -210,8 +211,7 @@ pub async fn run_server(
                         )
                         .nest("/variables", variables::workspaced_service())
                         .nest("/workspaces", workspaces::workspaced_service())
-                        .nest("/openai", openai::workspaced_service())
-                        .nest("/scim", scim::workspaced_service()),
+                        .nest("/openai", openai::workspaced_service()),
                 )
                 .nest("/workspaces", workspaces::global_service())
                 .nest(
@@ -229,6 +229,10 @@ pub async fn run_server(
                     "/saml",
                     saml::global_service().layer(Extension(Arc::new(sp_extension.0))),
                 )
+                .nest(
+                    "/scim",
+                    saml::global_service().route_layer(axum::middleware::from_fn(has_basic_auth)),
+                )
                 .nest("/scripts_u", scripts::global_unauthed_service())
                 .nest(
                     "/w/:workspace_id/apps_u",

backend/windmill-api/src/scim.rs

@@ -7,19 +7,30 @@
  */
 
 use axum::{
+    middleware::Next,
     response::{IntoResponse, Response},
     routing::{get, post},
     Router,
 };
 use bytes::{BufMut, BytesMut};
-use hyper::{header, http::HeaderValue, StatusCode};
+use hyper::{header, http::HeaderValue, Request, StatusCode};
 use mime_guess::mime;
 use serde::Serialize;
 use windmill_common::error::{Error, Result};
 
+lazy_static::lazy_static! {
+    static ref SCIM_PASSWORD: Option<String> = std::env::var("SCIM_PASSWORD")
+        .ok();
+}
+
 #[derive(Debug, Clone, Copy, Default)]
 pub struct JsonScim<T>(pub T);
 
+pub async fn has_basic_auth<B>(request: Request<B>, next: Next<B>) -> Response {
+    let header = request.headers().get("Authorization");
+    next.run(request).await
+}
+
 pub type JsonScimResult<T> = std::result::Result<JsonScim<T>, Error>;
 
 impl<T> IntoResponse for JsonScim<T>
@@ -52,7 +63,7 @@ where
     }
 }
 
-pub fn workspaced_service() -> Router {
+pub fn global_service() -> Router {
     Router::new()
         .route("/authorize", post(authorize))
         .route("/Users", get(get_users))

docker/DockerfileOpenbb

@@ -73,6 +73,8 @@ ARG features=""
 
 COPY --from=planner /windmill/recipe.json recipe.json
 
+RUN apt-get update && apt-get install -y libxml2-dev libxmlsec1-dev clang libclang-dev
+
 RUN CARGO_NET_GIT_FETCH_WITH_CLI=true cargo chef cook --release --features "$features" --recipe-path recipe.json
 
 COPY ./openflow.openapi.yaml /openflow.openapi.yaml
@@ -90,7 +92,7 @@ FROM python:3.10.8-slim-buster
 ARG APP=/usr/src/app
 
 RUN apt-get update \
-    && apt-get install -y ca-certificates wget curl git jq libprotobuf-dev libnl-route-3-dev unzip build-essential pkg-config libcairo2-dev libwebkit2gtk-4.0-37 \
+    && apt-get install -y ca-certificates wget curl git jq libprotobuf-dev libnl-route-3-dev unzip build-essential pkg-config libcairo2-dev libwebkit2gtk-4.0-37 unixodbc xmlsec1 \
     && rm -rf /var/lib/apt/lists/*
 
 RUN arch="$(dpkg --print-architecture)"; arch="${arch##*-}"; \