kobotoolbox / kpi / 23218570559 / 6

82%

master: 76%

push

github

feat(scim): add groups and service provider config endpoints DEV-1815 (#6797)

### 📣 Summary
This PR complements the SCIM implementation in kobo with Groups and
ServiceProviderConfig endpoints, which are required for providers like
Okta and Authentik.

* Added a ScimGroup model to store synced groups natively. 
* Created the /ServiceProviderConfig endpoint mapping to statically
announce our SCIM capabilities (e.g. PATCH is supported, bulk operations
are disabled).
* Created the /Groups CRUD endpoints to support list, create, update,
and patch requests from the IdP.
* Updated urls.py and serializers to correctly route and validate the
new payloads.
* Added unit tests in test_scim_groups_api.py
* Added simple provisioning to enable proper integration with test cases
* Handling of multi tenant IdP

### 👀 Preview steps

1. Test ServiceProviderConfig. The IdP uses this endpoint on
initialization to figure out what Kobo's SCIM layer supports.

```
curl -X GET http://localhost:8000/api/scim/v2/{idp_slug}/ServiceProviderConfig \
  -H "Authorization: Bearer {SCIM_TOKEN}"
```

2. Create a group, test how the IdP provisions a completely new group
directly to Kobo.

```
curl -X POST http://localhost:8000/api/scim/v2/{idp_slug}/Groups \
  -H "Authorization: Bearer {SCIM_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Group"],
    "displayName": "Test Admins Group",
    "externalId": "ext-group-123"
  }'
```
Note the returned id for the next step.

3. List groups, the IdP uses this to verify the initial sync state.
```
curl -X GET http://localhost:8000/api/scim/v2/{idp_slug}/Groups \
  -H "Authorization: Bearer {SCIM_TOKEN}"
```
4. Patch a Group (Add Members) simulating the IdP adding a user to the
group during an assignment event. (Replace group_id with the SCG id from
step 2, and user_id with a valid Django User ID).

```
curl -X PATCH http://localhost:8000/api/scim/v2/{idp_slug}/Groups/{group_id} \... (continued)

4594 of 11678 branches covered (39.34%)

21768 of 35508 relevant lines covered (61.3%)

0.61 hits per line