Logo Logo

AshScim

Welcome! AshScim is a SCIM 2.0 server extension for the Ash Framework. It lets identity providers (Okta, Azure AD / Entra, OneLogin, JumpCloud, …) provision users and groups into your application by exposing standards-compliant SCIM endpoints over your existing Ash resources. This documentation is best viewed on hexdocs.

AshScim is intentionally orthogonal to authentication: SCIM only describes how user and group records are synchronized — login itself remains the responsibility of ash_authentication (or any other strategy you choose). The two integrate cleanly: AshScim can authenticate IdP requests using JWTs minted and stored by AshAuthentication.

About the Documentation

Tutorials walk you through a series of steps to accomplish a goal. These are learning-oriented, and are a great place for beginners to start.

Topics provide a high level overview of a specific concept or feature. These are understanding-oriented, and are perfect for discovering design patterns, features, and tools related to a given topic.

Reference documentation is produced automatically from our source code. It comes in the form of module documentation and DSL documentation. This documentation is information-oriented. Use the sidebar and the search bar to find relevant reference information.

Tutorials

Get Started

Topics

Multi-valued attributes — single-attribute vs relationship-backed multivalueds.
Filter syntax — operators, dotted paths, security guarantees.
PATCH operations — what the router does with each kind of PatchOp.
Authentication — StaticBearer and AshAuthentication-backed JWTs.
Policies & the bypass check — letting the router run unimpeded by application policies.
Multi-tenancy — attribute and context strategies, per-tenant IdPs.
Limitations — known gaps.

Reference

AshScim.User DSL
AshScim.Group DSL
For other reference documentation, see the sidebar & search bar.

Demo app & compliance testing

A working Phoenix app using AshScim lives at demo/. It wires AshAuthentication, ash_postgres, and AshScim together with User, Group, and Membership resources.

To run it locally:

cd demo
mix deps.get
mix ash.setup
mix run priv/repo/seeds.exs   # prints a SCIM bearer token
PORT=4002 mix phx.server

To validate against the scim2-tester compliance suite:

pipx install scim2-cli
TOKEN=...   # paste from seeds output
scim -u http://localhost:4002/scim/v2 -h "Authorization:Bearer $TOKEN" test

CI runs this suite on every push and pull request — see .github/workflows/scim_compliance.yml. The job fails on any ERROR line.