mirror of
https://github.com/snipe/snipe-it.git
synced 2024-12-25 13:44:06 -08:00
Re-do the entire SCIM config so it no longer inherits
This commit is contained in:
Brady Wetherington
parent
6b729502c6
commit
91cf683f3d
|
|
@ -12,92 +12,7 @@ class SnipeSCIMConfig extends \ArieTimmerman\Laravel\SCIMServer\SCIMConfig
|
||||||
{
|
{
|
||||||
public function getUserConfig()
|
public function getUserConfig()
|
||||||
{
|
{
|
||||||
$config = parent::getUserConfig();
|
|
||||||
|
|
||||||
// Much of this is copied verbatim from the library, then adjusted for our needs
|
// Much of this is copied verbatim from the library, then adjusted for our needs
|
||||||
$config['class'] = SCIMUser::class;
|
|
||||||
|
|
||||||
unset($config['mapping']['example:name:space']);
|
|
||||||
|
|
||||||
$config['map_unmapped'] = false; // anything we don't explicitly map will _not_ show up.
|
|
||||||
|
|
||||||
$core_namespace = 'urn:ietf:params:scim:schemas:core:2.0:User';
|
|
||||||
$core = $core_namespace.':';
|
|
||||||
$mappings =& $config['mapping'][$core_namespace]; //grab this entire key, we don't want to be repeating ourselves
|
|
||||||
|
|
||||||
//username - *REQUIRED*
|
|
||||||
$config['validations'][$core.'userName'] = 'required';
|
|
||||||
$mappings['userName'] = AttributeMapping::eloquent('username');
|
|
||||||
|
|
||||||
//human name - *FIRST NAME REQUIRED*
|
|
||||||
$config['validations'][$core.'name.givenName'] = 'required';
|
|
||||||
$config['validations'][$core.'name.familyName'] = 'string'; //not required
|
|
||||||
|
|
||||||
$mappings['name']['familyName'] = AttributeMapping::eloquent("last_name");
|
|
||||||
$mappings['name']['givenName'] = AttributeMapping::eloquent("first_name");
|
|
||||||
$mappings['name']['formatted'] = (new AttributeMapping())->ignoreWrite()->setRead(
|
|
||||||
function (&$object) {
|
|
||||||
return $object->getFullNameAttribute();
|
|
||||||
}
|
|
||||||
);
|
|
||||||
|
|
||||||
// externalId support
|
|
||||||
$config['validations'][$core.'externalId'] = 'string|nullable'; // not required, but supported mostly just for Okta
|
|
||||||
// note that the mapping is *not* namespaced like the other $mappings
|
|
||||||
$config['mapping']['externalId'] = AttributeMapping::eloquent('scim_externalid');
|
|
||||||
|
|
||||||
$config['validations'][$core.'emails'] = 'nullable|array'; // emails are not required in Snipe-IT...
|
|
||||||
$config['validations'][$core.'emails.*.value'] = 'email'; // ...(had to remove the recommended 'required' here)
|
|
||||||
|
|
||||||
$mappings['emails'] = [[
|
|
||||||
"value" => AttributeMapping::eloquent("email"),
|
|
||||||
"display" => null,
|
|
||||||
"type" => AttributeMapping::constant("work")->ignoreWrite(),
|
|
||||||
"primary" => AttributeMapping::constant(true)->ignoreWrite()
|
|
||||||
]];
|
|
||||||
|
|
||||||
//active
|
|
||||||
$config['validations'][$core.'active'] = 'boolean';
|
|
||||||
|
|
||||||
$mappings['active'] = AttributeMapping::eloquent('activated');
|
|
||||||
|
|
||||||
//phone
|
|
||||||
$config['validations'][$core.'phoneNumbers'] = 'nullable|array';
|
|
||||||
$config['validations'][$core.'phoneNumbers.*.value'] = 'string'; // another one where want to say 'we don't _need_ a phone number, but if you have one it better have a value.
|
|
||||||
|
|
||||||
$mappings['phoneNumbers'] = [[
|
|
||||||
"value" => AttributeMapping::eloquent("phone"),
|
|
||||||
"display" => null,
|
|
||||||
"type" => AttributeMapping::constant("work")->ignoreWrite(),
|
|
||||||
"primary" => AttributeMapping::constant(true)->ignoreWrite()
|
|
||||||
]];
|
|
||||||
|
|
||||||
//address
|
|
||||||
$config['validations'][$core.'addresses'] = 'nullable|array';
|
|
||||||
$config['validations'][$core.'addresses.*.streetAddress'] = 'string';
|
|
||||||
$config['validations'][$core.'addresses.*.locality'] = 'string';
|
|
||||||
$config['validations'][$core.'addresses.*.region'] = 'nullable|string';
|
|
||||||
$config['validations'][$core.'addresses.*.postalCode'] = 'nullable|string';
|
|
||||||
$config['validations'][$core.'addresses.*.country'] = 'string';
|
|
||||||
|
|
||||||
$mappings['addresses'] = [[
|
|
||||||
'type' => AttributeMapping::constant("work")->ignoreWrite(),
|
|
||||||
'formatted' => AttributeMapping::constant("n/a")->ignoreWrite(), // TODO - is this right? This doesn't look right.
|
|
||||||
'streetAddress' => AttributeMapping::eloquent("address"),
|
|
||||||
'locality' => AttributeMapping::eloquent("city"),
|
|
||||||
'region' => AttributeMapping::eloquent("state"),
|
|
||||||
'postalCode' => AttributeMapping::eloquent("zip"),
|
|
||||||
'country' => AttributeMapping::eloquent("country"),
|
|
||||||
'primary' => AttributeMapping::constant(true)->ignoreWrite() //this isn't in the example?
|
|
||||||
]];
|
|
||||||
|
|
||||||
//title
|
|
||||||
$config['validations'][$core.'title'] = 'string';
|
|
||||||
$mappings['title'] = AttributeMapping::eloquent('jobtitle');
|
|
||||||
|
|
||||||
//Preferred Language
|
|
||||||
$config['validations'][$core.'preferredLanguage'] = 'string';
|
|
||||||
$mappings['preferredLanguage'] = AttributeMapping::eloquent('locale');
|
|
||||||
|
|
||||||
/*
|
/*
|
||||||
more snipe-it attributes I'd like to check out (to map to 'enterprise' maybe?):
|
more snipe-it attributes I'd like to check out (to map to 'enterprise' maybe?):
|
||||||
|
|
@ -108,66 +23,213 @@ class SnipeSCIMConfig extends \ArieTimmerman\Laravel\SCIMServer\SCIMConfig
|
||||||
- company_id to "organization?"
|
- company_id to "organization?"
|
||||||
*/
|
*/
|
||||||
|
|
||||||
$enterprise_namespace = 'urn:ietf:params:scim:schemas:extension:enterprise:2.0:User';
|
|
||||||
$ent = $enterprise_namespace.':';
|
|
||||||
|
|
||||||
// we remove the 'example' namespace and add the Enterprise one
|
$user_prefix = 'urn:ietf:params:scim:schemas:core:2.0:User:';
|
||||||
$config['mapping']['schemas'] = AttributeMapping::constant( [$core_namespace, $enterprise_namespace] )->ignoreWrite();
|
$enterprise_prefix = 'urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:';
|
||||||
|
|
||||||
$config['validations'][$ent.'employeeNumber'] = 'string';
|
return [
|
||||||
$config['validations'][$ent.'department'] = 'string';
|
|
||||||
$config['validations'][$ent.'manager'] = 'nullable';
|
|
||||||
$config['validations'][$ent.'manager.value'] = 'string';
|
|
||||||
|
|
||||||
$config['mapping'][$enterprise_namespace] = [
|
// Set to 'null' to make use of auth.providers.users.model (App\User::class)
|
||||||
'employeeNumber' => AttributeMapping::eloquent('employee_num'),
|
'class' => SCIMUser::class,
|
||||||
'department' =>(new AttributeMapping())->setAdd( // FIXME parent?
|
|
||||||
function ($value, &$object) {
|
'validations' => [
|
||||||
$department = Department::where("name", $value)->first();
|
$user_prefix . 'userName' => 'required',
|
||||||
if ($department) {
|
$user_prefix . 'name.givenName' => 'required',
|
||||||
$object->department_id = $department->id;
|
$user_prefix . 'name.familyName' => 'string',
|
||||||
}
|
$user_prefix . 'externalId' => 'string|nullable',
|
||||||
}
|
$user_prefix . 'emails' => 'nullable|array',
|
||||||
)->setReplace(
|
$user_prefix . 'emails.*.value' => 'email',
|
||||||
function ($value, &$object) {
|
$user_prefix . 'active' => 'boolean',
|
||||||
$department = Department::where("name", $value)->first();
|
$user_prefix . 'phoneNumbers' => 'nullable|array',
|
||||||
if ($department) {
|
$user_prefix . 'phoneNumbers.*.value' => 'string',
|
||||||
$object->department_id = $department->id;
|
$user_prefix . 'addresses' => 'nullable|array',
|
||||||
|
$user_prefix . 'addresses.*.streetAddress' => 'string',
|
||||||
|
$user_prefix . 'addresses.*.locality' => 'string',
|
||||||
|
$user_prefix . 'addresses.*.region' => 'nullable|string',
|
||||||
|
$user_prefix . 'addresses.*.postalCode' => 'nullable|string',
|
||||||
|
$user_prefix . 'addresses.*.country' => 'string',
|
||||||
|
$user_prefix . 'title' => 'string',
|
||||||
|
$user_prefix . 'preferredLanguage' => 'string',
|
||||||
|
|
||||||
|
// Enterprise validations:
|
||||||
|
$enterprise_prefix . 'employeeNumber' => 'string',
|
||||||
|
$enterprise_prefix . 'department' => 'string',
|
||||||
|
$enterprise_prefix . 'manager' => 'nullable',
|
||||||
|
$enterprise_prefix . 'manager.value' => 'string'
|
||||||
|
],
|
||||||
|
|
||||||
|
'singular' => 'User',
|
||||||
|
'schema' => [Schema::SCHEMA_USER],
|
||||||
|
|
||||||
|
//eager loading
|
||||||
|
'withRelations' => [],
|
||||||
|
'map_unmapped' => false,
|
||||||
|
// 'unmapped_namespace' => 'urn:ietf:params:scim:schemas:laravel:unmapped',
|
||||||
|
'description' => 'User Account',
|
||||||
|
|
||||||
|
// Map a SCIM attribute to an attribute of the object.
|
||||||
|
'mapping' => [
|
||||||
|
|
||||||
|
'id' => AttributeMapping::eloquent("id")->disableWrite(),
|
||||||
|
|
||||||
|
'externalId' => AttributeMapping::eloquent('scim_externalid'), // FIXME - I have a PR that changes a lot of this.
|
||||||
|
|
||||||
|
'meta' => [
|
||||||
|
'created' => AttributeMapping::eloquent("created_at")->disableWrite(),
|
||||||
|
'lastModified' => AttributeMapping::eloquent("updated_at")->disableWrite(),
|
||||||
|
|
||||||
|
'location' => (new AttributeMapping())->setRead(
|
||||||
|
function ($object) {
|
||||||
|
return route(
|
||||||
|
'scim.resource',
|
||||||
|
[
|
||||||
|
'resourceType' => 'Users',
|
||||||
|
'resourceObject' => $object->id
|
||||||
|
]
|
||||||
|
);
|
||||||
}
|
}
|
||||||
}
|
)->disableWrite(),
|
||||||
)->setRead(
|
|
||||||
function (&$object) {
|
'resourceType' => AttributeMapping::constant("User")
|
||||||
return $object->department ? $object->department->name : null;
|
],
|
||||||
}
|
|
||||||
),
|
'schemas' => AttributeMapping::constant(
|
||||||
'manager' => [
|
[
|
||||||
// FIXME - manager writes are disabled. This kinda works but it leaks errors all over the place. Not cool.
|
'urn:ietf:params:scim:schemas:core:2.0:User',
|
||||||
// '$ref' => (new AttributeMapping())->ignoreWrite()->ignoreRead(),
|
'urn:ietf:params:scim:schemas:extension:enterprise:2.0:User'
|
||||||
// 'displayName' => (new AttributeMapping())->ignoreWrite()->ignoreRead(),
|
]
|
||||||
// NOTE: you could probably do a 'plain' Eloquent mapping here, but we don't for future-proofing
|
)->ignoreWrite(),
|
||||||
'value' => (new AttributeMapping())->setAdd(
|
|
||||||
function ($value, &$object) {
|
'urn:ietf:params:scim:schemas:core:2.0:User' => [
|
||||||
$manager = User::find($value);
|
|
||||||
if ($manager) {
|
'userName' => AttributeMapping::eloquent("username"),
|
||||||
$object->manager_id = $manager->id;
|
|
||||||
|
'name' => [
|
||||||
|
'formatted' => (new AttributeMapping())->ignoreWrite()->setRead(
|
||||||
|
function (&$object) {
|
||||||
|
return $object->getFullNameAttribute();
|
||||||
|
}
|
||||||
|
),
|
||||||
|
'familyName' => AttributeMapping::eloquent("last_name"),
|
||||||
|
'givenName' => AttributeMapping::eloquent("first_name"),
|
||||||
|
'middleName' => null,
|
||||||
|
'honorificPrefix' => null,
|
||||||
|
'honorificSuffix' => null
|
||||||
|
],
|
||||||
|
|
||||||
|
'displayName' => null,
|
||||||
|
'nickName' => null,
|
||||||
|
'profileUrl' => null,
|
||||||
|
'title' => AttributeMapping::eloquent('jobtitle'),
|
||||||
|
'userType' => null,
|
||||||
|
'preferredLanguage' => AttributeMapping::eloquent('locale'), // Section 5.3.5 of [RFC7231]
|
||||||
|
'locale' => null, // see RFC5646
|
||||||
|
'timezone' => null, // see RFC6557
|
||||||
|
'active' => AttributeMapping::eloquent('activated'),
|
||||||
|
|
||||||
|
'password' => AttributeMapping::eloquent('password')->disableRead(),
|
||||||
|
|
||||||
|
// Multi-Valued Attributes
|
||||||
|
'emails' => [[
|
||||||
|
"value" => AttributeMapping::eloquent("email"),
|
||||||
|
"display" => null,
|
||||||
|
"type" => AttributeMapping::constant("work")->ignoreWrite(),
|
||||||
|
"primary" => AttributeMapping::constant(true)->ignoreWrite()
|
||||||
|
]],
|
||||||
|
|
||||||
|
'phoneNumbers' => [[
|
||||||
|
"value" => AttributeMapping::eloquent("phone"),
|
||||||
|
"display" => null,
|
||||||
|
"type" => AttributeMapping::constant("work")->ignoreWrite(),
|
||||||
|
"primary" => AttributeMapping::constant(true)->ignoreWrite()
|
||||||
|
]],
|
||||||
|
|
||||||
|
'ims' => [[
|
||||||
|
"value" => null,
|
||||||
|
"display" => null,
|
||||||
|
"type" => null,
|
||||||
|
"primary" => null
|
||||||
|
]], // Instant messaging addresses for the User
|
||||||
|
|
||||||
|
'photos' => [[
|
||||||
|
"value" => null,
|
||||||
|
"display" => null,
|
||||||
|
"type" => null,
|
||||||
|
"primary" => null
|
||||||
|
]],
|
||||||
|
|
||||||
|
'addresses' => [[
|
||||||
|
'type' => AttributeMapping::constant("work")->ignoreWrite(),
|
||||||
|
'formatted' => AttributeMapping::constant("n/a")->ignoreWrite(), // TODO - is this right? This doesn't look right.
|
||||||
|
'streetAddress' => AttributeMapping::eloquent("address"),
|
||||||
|
'locality' => AttributeMapping::eloquent("city"),
|
||||||
|
'region' => AttributeMapping::eloquent("state"),
|
||||||
|
'postalCode' => AttributeMapping::eloquent("zip"),
|
||||||
|
'country' => AttributeMapping::eloquent("country"),
|
||||||
|
'primary' => AttributeMapping::constant(true)->ignoreWrite() //this isn't in the example?
|
||||||
|
]],
|
||||||
|
|
||||||
|
'groups' => [[
|
||||||
|
'value' => null,
|
||||||
|
'$ref' => null,
|
||||||
|
'display' => null,
|
||||||
|
'type' => null,
|
||||||
|
'type' => null
|
||||||
|
]],
|
||||||
|
|
||||||
|
'entitlements' => null,
|
||||||
|
'roles' => null,
|
||||||
|
'x509Certificates' => null
|
||||||
|
],
|
||||||
|
|
||||||
|
'urn:ietf:params:scim:schemas:extension:enterprise:2.0:User' => [
|
||||||
|
'employeeNumber' => AttributeMapping::eloquent('employee_num'),
|
||||||
|
'department' => (new AttributeMapping())->setAdd( // FIXME parent?
|
||||||
|
function ($value, &$object) {
|
||||||
|
$department = Department::where("name", $value)->first();
|
||||||
|
if ($department) {
|
||||||
|
$object->department_id = $department->id;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
|
||||||
)->setReplace(
|
)->setReplace(
|
||||||
function ($value, &$object) {
|
function ($value, &$object) {
|
||||||
$manager = User::find($value);
|
$department = Department::where("name", $value)->first();
|
||||||
if ($manager) {
|
if ($department) {
|
||||||
$object->manager_id = $manager->id;
|
$object->department_id = $department->id;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
)->setRead(
|
)->setRead(
|
||||||
function (&$object) {
|
function (&$object) {
|
||||||
return $object->manager_id;
|
return $object->department ? $object->department->name : null;
|
||||||
}
|
}
|
||||||
),
|
),
|
||||||
|
'manager' => [
|
||||||
|
// FIXME - manager writes are disabled. This kinda works but it leaks errors all over the place. Not cool.
|
||||||
|
// '$ref' => (new AttributeMapping())->ignoreWrite()->ignoreRead(),
|
||||||
|
// 'displayName' => (new AttributeMapping())->ignoreWrite()->ignoreRead(),
|
||||||
|
// NOTE: you could probably do a 'plain' Eloquent mapping here, but we don't for future-proofing
|
||||||
|
'value' => (new AttributeMapping())->setAdd(
|
||||||
|
function ($value, &$object) {
|
||||||
|
$manager = User::find($value);
|
||||||
|
if ($manager) {
|
||||||
|
$object->manager_id = $manager->id;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
)->setReplace(
|
||||||
|
function ($value, &$object) {
|
||||||
|
$manager = User::find($value);
|
||||||
|
if ($manager) {
|
||||||
|
$object->manager_id = $manager->id;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
)->setRead(
|
||||||
|
function (&$object) {
|
||||||
|
return $object->manager_id;
|
||||||
|
}
|
||||||
|
),
|
||||||
|
]
|
||||||
|
]
|
||||||
]
|
]
|
||||||
];
|
];
|
||||||
|
|
||||||
return $config;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue