README

SCIM 2.0 provisioning server for Magento 2 admin users.

MageDevGroup_AdminScim turns Magento into a SCIM 2.0 (RFC 7643/7644) provisioning server, so an identity provider such as Okta or Entra can create, update, and deactivate Magento admin users automatically — without anyone logging in. It complements SSO login: where JIT provisioning acts at login time, SCIM adds background provisioning and, crucially, deprovisioning.

Scope is admin users only (Users plus Groups → ACL roles). B2C/B2B customer provisioning is out of scope.

Endpoints

The IdP is the SCIM client; Magento is the server. All endpoints live under the admin-scim/v2 route area, derived from the store base URL:

https://<your-store>/admin-scim/v2

Unsupported verbs answer 501 Not Implemented. Errors use the RFC 7644 error schema (urn:ietf:params:scim:api:messages:2.0:Error) with the correct status.

Setup

1. Install the module and run bin/magento setup:upgrade.
2. In the admin panel go to Stores → Configuration → MageDevGroup → Admin SCIM.
3. Enable Admin SCIM = Yes. The endpoint is disabled by default.
4. Bearer Token — set a long random value. It is stored encrypted and is the credential the IdP presents. Point your IdP's SCIM app at the base URL above and configure it to send Authorization: Bearer <token>.
5. Group → Role Map — one displayName=role_id per line, mapping a SCIM group to a Magento admin role id (# lines ignored). A provisioned member gets the first matching role (admins hold a single role).
6. Default Role Id — role assigned when a member's groups match no rule. Leave empty to deny (no role) unmapped members.

Supported features

Advertised honestly in ServiceProviderConfig:

Provider quirks

The core is strict-RFC. IdP SCIM clients deviate — Entra especially (flat complex attrs in PATCH, value in group-member remove, ADD/REPLACE inconsistency). Those quirks are not in the core; a per-IdP plugin (admin-scim-okta, admin-scim-azure) absorbs them via a normalization seam:

• The plugin implements MageDevGroup\AdminScim\Api\RequestNormalizerInterface — a pure, total normalize(resourceType, operation, payload) that rewrites the decoded body toward RFC shape and returns unchanged payloads it does not own.
• It di-merges the normalizer into RequestNormalizerChain (see etc/di.xml), which runs before every create/replace/patch. With no plugin installed the chain is empty and bodies pass through untouched.

Running against a real IdP therefore needs the matching provider plugin.

Security notes

• The bearer token is a full admin-provisioning credential. It is stored encrypted (Magento Encrypted backend model) and compared in constant time (hash_equals).
• Rotate the token by setting a new value; the old value stops working immediately.
• The endpoint is disabled by default and every request must authenticate — there is no anonymous read path.
• Auth failures return generic 401 messages that never reveal whether a token is configured. Unexpected errors are logged server-side and returned as a 500 with no internals leaked.
• Serve over TLS only — the token travels in the Authorization header.
• active=false deprovisions an admin account, so treat the token with the same care as an admin password.

Requirements

• Magento 2.4.x
• PHP 8.3 – 8.5

License

OSL-3.0 © MageDevGroup. Commercial licensing and support: https://magedevgroup.com.