feat(scim): ADR 0024 - Phase 1+2

Cargo.toml

@@ -22,6 +22,7 @@ members = [
   "crates/resource-driver-sql",
   "crates/role-driver-sql",
   "crates/revoke-driver-sql",
+  "crates/scim-driver-raft",
   "crates/storage",
   "crates/storage-api",
   "crates/storage-crypto",
@@ -127,6 +128,7 @@ openstack-keystone-idmapping-driver-sql = { version = "0.1", path = "crates/idma
 openstack-keystone-resource-driver-sql = { version = "0.1", path = "crates/resource-driver-sql/" }
 openstack-keystone-revoke-driver-sql = { version = "0.1", path = "crates/revoke-driver-sql/" }
 openstack-keystone-role-driver-sql = { version = "0.1", path = "crates/role-driver-sql/" }
+openstack-keystone-scim-driver-raft = { version = "0.1", path = "crates/scim-driver-raft/" }
 openstack-keystone-token-driver-fernet = { version = "0.1.0", path = "crates/token-driver-fernet" }
 openstack-keystone-token-restriction-driver-sql = { version = "0.1", path = "crates/token-restriction-driver-sql/" }
 openstack-keystone-trust-driver-sql = { version = "0.1", path = "crates/trust-driver-sql/" }

crates/api-types/src/error.rs

@@ -89,6 +89,13 @@ pub enum KeystoneApiError {
     #[error("rate limit exceeded, retry later")]
     TooManyRequests,
 
+    /// Request is syntactically valid but semantically invalid (RFC 4918
+    /// §11.2 / RFC 7231 §6.5.1's `422` successor). Used for write-time
+    /// validation failures that are not simple malformed-request errors
+    /// (e.g. ADR 0024 §2.C's `Authorization::Project` prohibition).
+    #[error("{0}.")]
+    UnprocessableEntity(String),
+
     #[error("The request you have made requires authentication.")]
     UnauthorizedNoContext,
 

crates/api-types/src/error_conv.rs

@@ -35,6 +35,7 @@ use openstack_keystone_core_types::mapping::MappingProviderError;
 use openstack_keystone_core_types::resource::ResourceProviderError;
 use openstack_keystone_core_types::revoke::RevokeProviderError;
 use openstack_keystone_core_types::role::RoleProviderError;
+use openstack_keystone_core_types::scim::{ScimRealmProviderError, ScimResourceProviderError};
 use openstack_keystone_core_types::token::TokenProviderError;
 
 use crate::error::KeystoneApiError;
@@ -55,6 +56,7 @@ impl IntoResponse for KeystoneApiError {
                 StatusCode::INTERNAL_SERVER_ERROR
             }
             KeystoneApiError::TooManyRequests => StatusCode::TOO_MANY_REQUESTS,
+            KeystoneApiError::UnprocessableEntity(_) => StatusCode::UNPROCESSABLE_ENTITY,
             _ => StatusCode::BAD_REQUEST,
         };
 
@@ -328,6 +330,14 @@ impl From<MappingProviderError> for KeystoneApiError {
             MappingProviderError::ApiClientNonDomainScopeForbidden(x) => Self::BadRequest(format!(
                 "rule '{x}' grants a non-domain scope, which is forbidden for API Key (ApiClient) mapping rulesets (only domain scope is accepted)"
             )),
+            MappingProviderError::ScimRealmProjectScopeForbidden(x) => {
+                Self::UnprocessableEntity(format!(
+                    "rule '{x}' grants project scope, which is forbidden for a mapping ruleset bound to an active SCIM realm"
+                ))
+            }
+            MappingProviderError::RoleNotFound(x) => Self::UnprocessableEntity(format!(
+                "rule references role '{x}' which does not exist"
+            )),
             MappingProviderError::RaftNotAvailable => Self::InternalError(
                 "raft storage is not available in the mapping provider".to_string(),
             ),
@@ -349,6 +359,64 @@ impl From<MappingProviderError> for KeystoneApiError {
     }
 }
 
+impl From<ScimRealmProviderError> for KeystoneApiError {
+    fn from(value: ScimRealmProviderError) -> Self {
+        match value {
+            ScimRealmProviderError::NotFound(x) => Self::NotFound {
+                resource: "scim_realm".into(),
+                identifier: x,
+            },
+            ScimRealmProviderError::Conflict(x) => Self::Conflict(x),
+            ScimRealmProviderError::RaftNotAvailable => Self::InternalError(
+                "raft storage is not available in the scim_realm provider".to_string(),
+            ),
+            ScimRealmProviderError::RaftStoreError { source } => {
+                Self::InternalError(format!("raft storage error: {source}"))
+            }
+            ScimRealmProviderError::Driver { source } => {
+                Self::InternalError(format!("backend driver error: {source}"))
+            }
+            ScimRealmProviderError::UnsupportedDriver(x) => {
+                Self::InternalError(format!("unsupported driver `{x}`"))
+            }
+            ScimRealmProviderError::StructBuilder(e) => {
+                Self::InternalError(format!("structure builder error: {e}"))
+            }
+            // ScimRealmProviderError is non-exhaustive; catch any future variants
+            _ => Self::InternalError(value.to_string()),
+        }
+    }
+}
+
+impl From<ScimResourceProviderError> for KeystoneApiError {
+    fn from(value: ScimResourceProviderError) -> Self {
+        match value {
+            ScimResourceProviderError::NotFound(x) => Self::NotFound {
+                resource: "scim_resource".into(),
+                identifier: x,
+            },
+            ScimResourceProviderError::Conflict(x) => Self::Conflict(x),
+            ScimResourceProviderError::RaftNotAvailable => Self::InternalError(
+                "raft storage is not available in the scim_resource provider".to_string(),
+            ),
+            ScimResourceProviderError::RaftStoreError { source } => {
+                Self::InternalError(format!("raft storage error: {source}"))
+            }
+            ScimResourceProviderError::Driver { source } => {
+                Self::InternalError(format!("backend driver error: {source}"))
+            }
+            ScimResourceProviderError::UnsupportedDriver(x) => {
+                Self::InternalError(format!("unsupported driver `{x}`"))
+            }
+            ScimResourceProviderError::StructBuilder(e) => {
+                Self::InternalError(format!("structure builder error: {e}"))
+            }
+            // ScimResourceProviderError is non-exhaustive; catch any future variants
+            _ => Self::InternalError(value.to_string()),
+        }
+    }
+}
+
 impl From<TokenProviderError> for KeystoneApiError {
     fn from(value: TokenProviderError) -> Self {
         match value {

crates/api-types/src/v3/user_conv.rs

@@ -90,6 +90,7 @@ impl From<api_types::UserCreateRequest> for provider_types::UserCreate {
             name: user.name,
             options: user.options.map(Into::into),
             password: user.password,
+            user_type: provider_types::UserType::Local,
         }
     }
 }

crates/api-types/src/v4.rs

@@ -15,10 +15,13 @@
 pub mod api_key;
 pub mod auth;
 pub mod mapping;
+pub mod scim_realm;
 pub mod token_restriction;
 pub mod user;
 
 #[cfg(feature = "conv")]
 mod api_key_conv;
 #[cfg(feature = "conv")]
+mod scim_realm_conv;
+#[cfg(feature = "conv")]
 mod token_restriction_conv;

crates/api-types/src/v4/scim_realm.rs

@@ -0,0 +1,151 @@
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// SPDX-License-Identifier: Apache-2.0
+//! SCIM realm API types (ADR 0024 §2).
+
+use serde::{Deserialize, Serialize};
+#[cfg(feature = "validate")]
+use validator::Validate;
+
+use crate::Link;
+
+/// A registered SCIM realm.
+#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+#[cfg_attr(feature = "validate", derive(validator::Validate))]
+pub struct ScimRealm {
+    /// Domain owning this realm.
+    #[cfg_attr(feature = "validate", validate(length(min = 1, max = 64)))]
+    pub domain_id: String,
+
+    /// The `provider_id` coordinate this realm authorizes for SCIM resource
+    /// provisioning.
+    #[cfg_attr(feature = "validate", validate(length(min = 1, max = 64)))]
+    pub provider_id: String,
+
+    /// The federation `IdentityProvider.id` this realm provisions users for.
+    #[cfg_attr(feature = "validate", validate(length(min = 1, max = 64)))]
+    pub idp_id: String,
+
+    /// Administrative display name for the realm.
+    #[cfg_attr(feature = "validate", validate(length(min = 1, max = 256)))]
+    pub display_name: String,
+
+    /// Whether the realm currently authorizes SCIM resource provisioning.
+    pub enabled: bool,
+
+    /// UTC epoch seconds.
+    pub created_at: i64,
+
+    /// UTC epoch seconds.
+    pub updated_at: i64,
+}
+
+/// SCIM realm creation payload.
+#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+#[cfg_attr(feature = "validate", derive(validator::Validate))]
+pub struct ScimRealmCreate {
+    /// Domain owning this realm.
+    #[cfg_attr(feature = "validate", validate(length(min = 1, max = 64)))]
+    pub domain_id: String,
+
+    /// The `provider_id` coordinate this realm authorizes.
+    #[cfg_attr(feature = "validate", validate(length(min = 1, max = 64)))]
+    pub provider_id: String,
+
+    /// The federation `IdentityProvider.id` this realm provisions users for.
+    /// Must resolve to an existing identity provider.
+    #[cfg_attr(feature = "validate", validate(length(min = 1, max = 64)))]
+    pub idp_id: String,
+
+    /// Administrative display name for the realm.
+    #[cfg_attr(feature = "validate", validate(length(min = 1, max = 256)))]
+    pub display_name: String,
+}
+
+/// SCIM realm creation request wrapper.
+#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+#[cfg_attr(feature = "validate", derive(validator::Validate))]
+pub struct ScimRealmCreateRequest {
+    /// SCIM realm creation payload.
+    #[cfg_attr(feature = "validate", validate(nested))]
+    pub scim_realm: ScimRealmCreate,
+}
+
+/// SCIM realm update payload. `None` fields are left unchanged.
+#[derive(Clone, Debug, Default, Deserialize, PartialEq, Serialize)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+#[cfg_attr(feature = "validate", derive(validator::Validate))]
+pub struct ScimRealmUpdate {
+    /// New linked `IdentityProvider.id`. Must resolve to an existing
+    /// identity provider.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(feature = "validate", validate(length(min = 1, max = 64)))]
+    pub idp_id: Option<String>,
+
+    /// New display name.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(feature = "validate", validate(length(min = 1, max = 256)))]
+    pub display_name: Option<String>,
+
+    /// Enable/disable toggle (ADR 0024 §2.B, the Realm Activation Gate).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub enabled: Option<bool>,
+}
+
+/// SCIM realm update request wrapper.
+#[derive(Clone, Debug, Default, Deserialize, PartialEq, Serialize)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+#[cfg_attr(feature = "validate", derive(validator::Validate))]
+pub struct ScimRealmUpdateRequest {
+    /// SCIM realm update payload.
+    #[cfg_attr(feature = "validate", validate(nested))]
+    pub scim_realm: ScimRealmUpdate,
+}
+
+/// SCIM realm response.
+#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+#[cfg_attr(feature = "validate", derive(validator::Validate))]
+pub struct ScimRealmResponse {
+    /// SCIM realm object.
+    #[cfg_attr(feature = "validate", validate(nested))]
+    pub scim_realm: ScimRealm,
+}
+
+/// SCIM realm list response.
+#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+pub struct ScimRealmList {
+    /// Pagination links.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub links: Option<Vec<Link>>,
+    /// Collection of SCIM realms.
+    pub scim_realms: Vec<ScimRealm>,
+}
+
+/// SCIM realm list query parameters.
+#[derive(Clone, Debug, Default, Deserialize, PartialEq, Serialize)]
+#[cfg_attr(feature = "openapi", derive(utoipa::IntoParams))]
+#[cfg_attr(feature = "validate", derive(validator::Validate))]
+pub struct ScimRealmListParameters {
+    /// Domain to list realms for.
+    #[cfg_attr(feature = "validate", validate(length(min = 1, max = 64)))]
+    pub domain_id: String,
+
+    /// Filter by enabled/disabled state.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub enabled: Option<bool>,
+}

crates/api-types/src/v4/scim_realm_conv.rs

@@ -0,0 +1,68 @@
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// SPDX-License-Identifier: Apache-2.0
+//! SCIM realm conversion implementations.
+
+use openstack_keystone_core_types::scim as core;
+
+use crate::v4::scim_realm as api;
+
+impl From<api::ScimRealmCreateRequest> for core::ScimRealmResourceCreate {
+    fn from(value: api::ScimRealmCreateRequest) -> Self {
+        Self {
+            domain_id: value.scim_realm.domain_id,
+            provider_id: value.scim_realm.provider_id,
+            idp_id: value.scim_realm.idp_id,
+            display_name: value.scim_realm.display_name,
+        }
+    }
+}
+
+impl From<api::ScimRealmUpdateRequest> for core::ScimRealmResourceUpdate {
+    fn from(value: api::ScimRealmUpdateRequest) -> Self {
+        value.scim_realm.into()
+    }
+}
+
+impl From<api::ScimRealmUpdate> for core::ScimRealmResourceUpdate {
+    fn from(value: api::ScimRealmUpdate) -> Self {
+        Self {
+            idp_id: value.idp_id,
+            display_name: value.display_name,
+            enabled: value.enabled,
+        }
+    }
+}
+
+impl From<core::ScimRealmResource> for api::ScimRealm {
+    fn from(value: core::ScimRealmResource) -> Self {
+        Self {
+            domain_id: value.domain_id,
+            provider_id: value.provider_id,
+            idp_id: value.idp_id,
+            display_name: value.display_name,
+            enabled: value.enabled,
+            created_at: value.created_at,
+            updated_at: value.updated_at,
+        }
+    }
+}
+
+impl From<api::ScimRealmListParameters> for core::ScimRealmResourceListParameters {
+    fn from(value: api::ScimRealmListParameters) -> Self {
+        Self {
+            domain_id: value.domain_id,
+            enabled: value.enabled,
+        }
+    }
+}