Repository navigation
Add User Management inbound SCIM provisioning sample - #391
Merged
Merged
Conversation
- Connect a simulated upstream directory to IdentityServer using Aspire and Mailpit. - Demonstrate SCIM discovery, user and group provisioning, bulk requests, and active profile data. - Support provisioned-only OTP sign-in with ownership and subject checks. - Document preview limitations and apply minimal Bootstrap styling.
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Resilience timeouts bypass the intended warning that provisioning changes may already have committed.
1 open issue
What changed in this PR
Adds an inbound SCIM provisioning sample to the IdentityServer v8 User Management examples, demonstrating directory provisioning followed by email OTP sign-in.
Changes:
- Adds a simulated directory for discovery, user provisioning, groups, and Bulk requests.
- Adds a destination with in-memory storage and provisioned-subject OTP sign-in.
- Connects services through Aspire and documents preview limitations.
Paths below are relative to IdentityServer/v8/UserManagement/ScimProvisioning/, except root samples.slnx.
| File | Description |
|---|---|
samples.slnx |
Registers the sample projects. |
ScimProvisioning.slnx |
Defines the standalone solution. |
ScimProvisioning.IdentityServer/wwwroot/lib/bootstrap/LICENSE |
Includes Bootstrap licensing. |
ScimProvisioning.IdentityServer/wwwroot/css/bootstrap-overrides.css |
Adds Duende styling. |
ScimProvisioning.IdentityServer/ScimProvisioning.IdentityServer.csproj |
Declares destination dependencies. |
ScimProvisioning.IdentityServer/Properties/launchSettings.json |
Configures local HTTPS launch. |
ScimProvisioning.IdentityServer/Program.cs |
Configures SCIM, storage, and authentication. |
ScimProvisioning.IdentityServer/Pages/Shared/_Layout.cshtml |
Adds shared navigation and styling. |
ScimProvisioning.IdentityServer/Pages/Index.cshtml.cs |
Loads provisioned users and groups. |
ScimProvisioning.IdentityServer/Pages/Index.cshtml |
Displays records and session subject. |
ScimProvisioning.IdentityServer/Pages/Error.cshtml |
Provides error guidance. |
ScimProvisioning.IdentityServer/Pages/Account/VerifyOtp.cshtml.cs |
Verifies OTP and subject before sign-in. |
ScimProvisioning.IdentityServer/Pages/Account/VerifyOtp.cshtml |
Adds code-entry form. |
ScimProvisioning.IdentityServer/Pages/Account/Logout.cshtml.cs |
Clears authentication state. |
ScimProvisioning.IdentityServer/Pages/Account/Logout.cshtml |
Adds sign-out form. |
ScimProvisioning.IdentityServer/Pages/Account/Login.cshtml.cs |
Requests OTP for existing profiles. |
ScimProvisioning.IdentityServer/Pages/Account/Login.cshtml |
Adds provisioned-user sign-in form. |
ScimProvisioning.IdentityServer/Pages/_ViewStart.cshtml |
Selects shared layout. |
ScimProvisioning.IdentityServer/Pages/_ViewImports.cshtml |
Enables Razor tag helpers. |
ScimProvisioning.IdentityServer/OtpCookie.cs |
Protects expiring OTP state. |
ScimProvisioning.IdentityServer/appsettings.json |
Sets issuer, SMTP, and logging defaults. |
ScimProvisioning.Directory/wwwroot/lib/bootstrap/LICENSE |
Includes Bootstrap licensing. |
ScimProvisioning.Directory/wwwroot/css/bootstrap-overrides.css |
Adds Duende styling. |
ScimProvisioning.Directory/ScimProvisioning.Directory.csproj |
Declares client dependencies. |
ScimProvisioning.Directory/ScimClient.cs |
Implements sample SCIM operations. |
ScimProvisioning.Directory/Properties/launchSettings.json |
Configures local HTTPS launch. |
ScimProvisioning.Directory/Program.cs |
Configures credentials and HTTP resilience. |
ScimProvisioning.Directory/Pages/Index.cshtml.cs |
Handles provisioning actions and errors. |
ScimProvisioning.Directory/Pages/Index.cshtml |
Presents employees and provisioning controls. |
ScimProvisioning.Directory/Pages/Error.cshtml |
Provides directory error guidance. |
ScimProvisioning.Directory/Pages/_ViewImports.cshtml |
Enables Razor tag helpers. |
ScimProvisioning.Directory/EmployeeDirectory.cs |
Seeds employees and departments. |
ScimProvisioning.Directory/appsettings.json |
Sets SCIM connection defaults. |
ScimProvisioning.AppHost/ScimProvisioning.AppHost.csproj |
References orchestrated projects. |
ScimProvisioning.AppHost/Properties/launchSettings.json |
Configures dashboard launch. |
ScimProvisioning.AppHost/AppHost.cs |
Connects applications and Mailpit. |
README.md |
Documents setup, walkthrough, and limitations. |
Review effort: Balanced
- Catch Polly TimeoutRejectedException so timed-out provisioning requests show the restart-before-retry warning.
StuFrankish
marked this pull request as ready for review
October 21, 2026 12:24
maartenba
approved these changes
Oct 21, 2026
maartenba
left a comment
maartenba
left a comment
Member
There was a problem hiding this comment.
Looks good! Couple of small comments.
When you do docs, can you make sure to add this to the User Management samples page as well?
- Remove Aspire from the opening sentence as requested in review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Demonstrate how an upstream directory provisions users and groups into Duende User Management, then let a provisioned user sign in with email OTP.
The sample lives at
IdentityServer/v8/UserManagement/ScimProvisioning/. Aspire connects IdentityServer, Mailpit, and a small simulated upstream directory. The Directory uses a hand-written SCIM client to demonstrate inbound provisioning; it is not a Duende outbound SCIM feature.active=false, group membership, and Bulk requests using client credentials.activeremains stored data and does not block sign-in.Preview limitations
Targets User Management
2.0.0-preview.6. Includes the documentedDuendeScimBearerAuthority workaround for signing-key discovery and a filtered profile lookup workaround. The README also documents the missingexternalIdresponse attribute and development-only shortcuts.Verification
Release solution build passes. Earlier local runs without a license key covered authenticated SCIM provisioning, authorization gates, Bulk and group operations, and OTP sign-in with matching provisioned/session subjects. License warnings are logged.