[Web] Add SCIM 2.0 provider for IdP user provisioning

data/conf/nginx/templates/sites-default.conf.j2

@@ -104,6 +104,10 @@ location ~ ^/api/v1/(.*)$ {
     try_files $uri $uri/ /json_api.php?query=$1&$args;
 }
 
+location ~ ^/scim/v2/(.*)$ {
+    try_files $uri $uri/ /scim.php?path=$1&$args;
+}
+
 location ~ ^/cache/(.*)$ {
     try_files $uri $uri/ /resource.php?file=$1;
 }

data/web/admin/system.php

@@ -86,6 +86,11 @@
 $f2b_data = fail2ban('get');
 // mbox templates
 $mbox_templates = mailbox('get', 'mailbox_templates');
+// SCIM
+$scim_tokens    = scim_token('get_all');
+$scim_new_token = $_SESSION['scim_new_token'] ?? null;
+$scim_base_url  = getBaseUrl() . '/scim/v2/';
+unset($_SESSION['scim_new_token']);
 
 $template = 'admin.twig';
 $template_data = [
@@ -121,6 +126,9 @@
   'is_https' => isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on',
   'iam_settings' => $iam_settings,
   'mbox_templates' => $mbox_templates,
+  'scim_tokens' => $scim_tokens,
+  'scim_new_token' => $scim_new_token,
+  'scim_base_url' => $scim_base_url,
   'lang_admin' => json_encode($lang['admin']),
   'lang_datatables' => json_encode($lang['datatables'])
 ];

data/web/edit.php

@@ -139,6 +139,7 @@
           'user_acls' => acl('get', 'user', $mailbox),
           'mailbox_details' => $result,
           'iam_settings' => $iam_settings,
+          'scim_tokens' => scim_token('get_all'),
         ];
       }
     }

data/web/inc/functions.auth.inc.php

@@ -429,6 +429,63 @@ function user_login($user, $pass, $extra = null){
         }
       }
     break;
+    case 'scim':
+      // SCIM is a provisioning protocol; authentication is handled by the configured IAM provider.
+      // If LDAP is the IAM, verify credentials against LDAP directly.
+      if ($iam_settings['authsource'] === 'ldap') {
+        $result = ldap_mbox_login($user, $pass, array('is_internal' => $is_internal));
+        if ($result !== false) {
+          $stmt = $pdo->prepare("SELECT * FROM `mailbox`
+          INNER JOIN domain on mailbox.domain = domain.domain
+          WHERE `kind` NOT REGEXP 'location|thing|group'
+            AND `mailbox`.`active`='1'
+            AND `domain`.`active`='1'
+            AND `username` = :user");
+          $stmt->execute(array(':user' => $user));
+          $row = $stmt->fetch(PDO::FETCH_ASSOC);
+          if (empty($row)) {
+            return false;
+          }
+          $row['attributes'] = json_decode($row['attributes'], true);
+          $authenticators = get_tfa($user);
+          if (isset($authenticators['additional']) && is_array($authenticators['additional']) && count($authenticators['additional']) > 0 && !$is_internal) {
+            $_SESSION['pending_mailcow_cc_username'] = $user;
+            $_SESSION['pending_mailcow_cc_role'] = "user";
+            $_SESSION['pending_tfa_methods'] = $authenticators['additional'];
+            unset($_SESSION['ldelay']);
+            $_SESSION['return'][] = array(
+              'type' => 'success',
+              'log'  => array(__FUNCTION__, $user, '*', 'Provider: LDAP (SCIM user)'),
+              'msg'  => array('logged_in_as', $user)
+            );
+            return "pending";
+          } else if (!isset($authenticators['additional']) || !is_array($authenticators['additional']) || count($authenticators['additional']) == 0) {
+            if (!$is_internal) {
+              unset($_SESSION['ldelay']);
+              $stmt = $pdo->prepare("UPDATE `tfa` SET `active`='1' WHERE `username` = :user");
+              $stmt->execute(array(':user' => $user));
+              if (intval($row['attributes']['force_tfa']) == 1 && !tfa_exists($user)) {
+                $_SESSION['pending_tfa_setup'] = true;
+              }
+              $_SESSION['return'][] = array(
+                'type' => 'success',
+                'log'  => array(__FUNCTION__, $user, '*', 'Provider: LDAP (SCIM user)'),
+                'msg'  => array('logged_in_as', $user)
+              );
+            }
+            return "user";
+          }
+        }
+        return $result;
+      }
+      // For OIDC-based providers (Keycloak, Generic-OIDC), login goes through verify-sso, not here.
+      $_SESSION['return'][] = array(
+        'type' => 'danger',
+        'log'  => array(__FUNCTION__, $user, 'SCIM account must authenticate via the configured identity provider'),
+        'msg'  => 'login_failed'
+      );
+      return false;
+    break;
   }
 
   return false;

data/web/inc/functions.inc.php

@@ -2866,7 +2866,7 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
       $stmt->execute(array(':user' => $info['email']));
       $row = $stmt->fetch(PDO::FETCH_ASSOC);
       if ($row){
-        if (!in_array($row['authsource'], array("keycloak", "generic-oidc"))) {
+        if (!in_array($row['authsource'], array("keycloak", "generic-oidc", "scim"))) {
           clear_session();
           $_SESSION['return'][] =  array(
             'type' => 'danger',

data/web/inc/functions.mailbox.inc.php

@@ -1053,7 +1053,8 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
             return false;
           }
           if ($_data['authsource'] == "mailcow" ||
-              in_array($_data['authsource'], array('keycloak', 'generic-oidc', 'ldap')) && $iam_settings['authsource'] == $_data['authsource']){
+              in_array($_data['authsource'], array('keycloak', 'generic-oidc', 'ldap')) && $iam_settings['authsource'] == $_data['authsource'] ||
+              $_data['authsource'] == 'scim'){
             $authsource = $_data['authsource'];
           }
           if (empty($name)) {
@@ -1122,7 +1123,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
           }
           $quota_b    = ($quota_m * 1048576);
           $attribute_hash = (!empty($_data['attribute_hash'])) ? $_data['attribute_hash'] : '';
-          if (in_array($authsource, array('keycloak', 'generic-oidc', 'ldap'))){
+          if (in_array($authsource, array('keycloak', 'generic-oidc', 'ldap', 'scim'))){
             $force_pw_update = 0;
           }
           if ($authsource == 'generic-oidc'){
@@ -3149,10 +3150,11 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
               $attribute_hash       = (!empty($_data['attribute_hash'])) ? $_data['attribute_hash'] : '';
               $authsource           = $is_now['authsource'];
               if ($_data['authsource'] == "mailcow" ||
-                  in_array($_data['authsource'], array('keycloak', 'generic-oidc', 'ldap')) && $iam_settings['authsource'] == $_data['authsource']){
+                  in_array($_data['authsource'], array('keycloak', 'generic-oidc', 'ldap')) && $iam_settings['authsource'] == $_data['authsource'] ||
+                  $_data['authsource'] == 'scim'){
                 $authsource = $_data['authsource'];
               }
-              if (in_array($authsource, array('keycloak', 'generic-oidc', 'ldap'))){
+              if (in_array($authsource, array('keycloak', 'generic-oidc', 'ldap', 'scim'))){
                 $force_pw_update = 0;
               }
               if ($authsource == 'generic-oidc'){