feat: add attributeType/attributeValue SCIM provisioning fields to team and business unit attribute mappings

[BearTS]

Summary

Adds optional attributeType and attributeValue fields to attributeTeamMappings and attributeBusinessUnitMappings to enable SCIM provisioning on a per-mapping basis. When these fields are present, a mapping can be matched against either a SCIM User attribute (attributeType: "user") or a SCIM Group displayName (attributeType: "group").

Changes

• Added attributeType (enum: "user" | "group") and attributeValue (string) as optional properties to attributeTeamMappings and attributeBusinessUnitMappings in both helm-charts/bifrost/values.schema.json and transports/config.schema.json.
• Added inline description fields to existing attribute, value, team, and business_unit properties for improved schema documentation.
• Added commented-out examples in values.yaml demonstrating SCIM provisioning via user attribute matching and group displayName matching.
• For attributeType: "group", attributeValue is always expected to be "displayName" and is auto-set accordingly.

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

Configure attributeTeamMappings or attributeBusinessUnitMappings with the new fields and verify schema validation accepts valid inputs and rejects invalid ones (e.g., an attributeType value outside ["user", "group"] or extra properties beyond those declared).

# Validate schema changes
go test ./...

Example mapping to validate:

attributeTeamMappings:
  - attribute: "department"
    value: "engineering"
    team: "eng-team"
    attributeType: "user"
    attributeValue: "engineering"
  - attribute: "groups"
    value: "Engineering"
    team: "eng-team"
    attributeType: "group"
    attributeValue: "displayName"

Breaking changes

• Yes
• No

Related issues

Security considerations

No new auth flows or secrets handling introduced. The new fields extend existing JWT claim-to-team/business-unit mapping logic with SCIM provisioning metadata only.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

Summary by CodeRabbit

• New Features
  • Enhanced team and business-unit attribute mappings with two new optional fields to support SCIM provisioning metadata, enabling more flexible attribute-based provisioning.
• Documentation
  • Updated commented configuration examples to illustrate the new SCIM attribute/type/value mapping patterns.

[coderabbitai]

Caution

Review failed

Failed to post review comments

📝 Walkthrough

Walkthrough

This PR extends Okta JWT/SCIM attribute mapping schemas in Helm values and transport config to add optional attributeType and attributeValue fields for team and business unit mappings and adds commented example mappings in Helm values.

Changes

SCIM Provisioning Metadata Support

Layer / File(s)	Summary
Team mappings schema extension helm-charts/bifrost/values.schema.json, transports/config.schema.json	attributeTeamMappings item schemas now include optional attributeType (enum: user/group) and attributeValue fields with updated descriptions referencing SCIM provisioning; required fields remain attribute, value, and team.
Business unit mappings schema extension helm-charts/bifrost/values.schema.json, transports/config.schema.json	attributeBusinessUnitMappings item schemas now include optional attributeType (enum: user/group) and attributeValue fields with updated descriptions; required fields remain attribute, value, and business_unit.
SCIM provisioning configuration examples helm-charts/bifrost/values.yaml	Commented example SCIM provisioning mappings added demonstrating attribute-based matching with attributeType and attributeValue usage; no active config changes.

Estimated Code Review Effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly Related PRs

• maximhq/bifrost#3544: Prior changes to Helm values.schema.json for Okta SCIM attributeTeamMappings and attributeBusinessUnitMappings.
• maximhq/bifrost#3857: Related edits to Okta SCIM mapping schemas across Helm values and transport config.

Suggested Reviewers

• danpiths
• akshaydeo

Poem

🐰 SCIM fields hop into place with cheer,
attributeType and value now appear,
Team and unit maps extend their sight,
Examples tucked in comments, quiet and bright,
Hooray — schemas snug, ready to steer!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main feature being added: new SCIM provisioning fields (attributeType/attributeValue) for attribute mappings.
Description check	✅ Passed	The PR description comprehensively covers all template sections: includes a clear summary, detailed changes, correctly marked feature type, affected areas, testing instructions, and a security assessment.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 06-02-chore_update_config_json_for_new_scim_attributes

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[BearTS]

• feat: add attributeType/attributeValue SCIM provisioning fields to team and business unit attribute mappings #3974 👈 (View in Graphite)
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Confidence Score: 3/5

Not safe to merge as-is for Entra, Keycloak, Zitadel, and Google Helm users — the new SCIM mapping fields are blocked by additionalProperties:false in those provider schemas.

The new fields work end-to-end only for Okta Helm deployments. Operators using any of the other four SCIM providers who configure attributeType/attributeValue will get an immediate Helm schema validation failure and cannot deploy the feature at all.

helm-charts/bifrost/values.schema.json — the Entra, Keycloak, Zitadel, and Google provider blocks each need attributeType/attributeValue added to their attributeTeamMappings and attributeBusinessUnitMappings item schemas

Important Files Changed

Filename	Overview
helm-charts/bifrost/values.schema.json	New attributeType/attributeValue fields added to Okta provider schema only; Entra, Keycloak, Zitadel, and Google schemas retain additionalProperties:false without the new properties, causing Helm validation errors for those providers
transports/config.schema.json	attributeType/attributeValue added consistently to the detailed attributeTeamMappings and attributeBusinessUnitMappings definitions; secondary Keycloak-section uses loose object types so no blocking issue there
helm-charts/bifrost/values.yaml	Commented-out SCIM examples added for user-attribute and group-displayName matching; no functional risk

_{Reviews (2): Last reviewed commit: "Merge branch 'dev' into 06-02-chore_upda..." | Re-trigger Greptile}

[coderabbitai]

Actionable comments posted: 3

♻️ Duplicate comments (1)

transports/config.schema.json (1)

3719-3727: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick win

Same conditional validation recommendation applies here.

The attributeBusinessUnitMappings schema has the same independently-optional attributeType and attributeValue fields as attributeTeamMappings. The same conditional validation constraint recommended in the previous comment should be applied here for consistency.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@transports/config.schema.json` around lines 3719 - 3727, The
attributeBusinessUnitMappings schema currently allows attributeType and
attributeValue to be optional independently — mirror the fix applied to
attributeTeamMappings by adding conditional validation so attributeValue is
required when attributeType is present (or vice versa) to prevent partial
mappings; update the schema for attributeBusinessUnitMappings to include the
same conditional/if-then JSON Schema rules referencing attributeType and
attributeValue (matching the logic used in attributeTeamMappings) so both fields
are validated together.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@helm-charts/bifrost/values.schema.json`:
- Around line 1819-1830: The description for the "attributeValue" field in the
business unit mapping schema is ambiguous about what "auto-set to 'displayName'"
means; update the "attributeValue" description (adjacent to "attribute",
"business_unit", and "attributeType") to clearly state that when "attributeType"
is "group", "attributeValue" is ignored and the SCIM group's displayName will be
used (e.g., "SCIM attribute value to match; for 'user' this is the SCIM user
attribute value; for 'group' this is ignored and the SCIM group's displayName is
used"), ensuring consistency with the team mappings wording.
- Around line 1796-1807: The description for attributeValue is ambiguous about
"auto-set to 'displayName'"; update the attributeValue schema description to
clearly state that when attributeType is "group" the field is the value to match
against the SCIM group's displayName attribute (and not a literal default
value), e.g. rephrase to: "SCIM attribute value to match (for 'user': SCIM user
attribute value; for 'group': value to match against the SCIM group's
displayName attribute)"; reference attributeValue and attributeType when making
this change.

In `@transports/config.schema.json`:
- Around line 3696-3704: Add a conditional JSON Schema constraint so
attributeType and attributeValue are validated together: use an anyOf/allOf
block referencing the existing attributeType and attributeValue definitions to
require that if one is present the other must be present (i.e., both appear
together), and add a subschema that when attributeType is "group" enforces
attributeValue === "displayName" (or tighten the attributeValue enum for that
case); also update the attributeValue description to state that for group
mappings it must be the literal "displayName".

---

Duplicate comments:
In `@transports/config.schema.json`:
- Around line 3719-3727: The attributeBusinessUnitMappings schema currently
allows attributeType and attributeValue to be optional independently — mirror
the fix applied to attributeTeamMappings by adding conditional validation so
attributeValue is required when attributeType is present (or vice versa) to
prevent partial mappings; update the schema for attributeBusinessUnitMappings to
include the same conditional/if-then JSON Schema rules referencing attributeType
and attributeValue (matching the logic used in attributeTeamMappings) so both
fields are validated together.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 1fb4eebb-9112-4a12-87f1-a3d39f32f51b

📥 Commits

Reviewing files that changed from the base of the PR and between 8eb0a50 and c8a1717.

📒 Files selected for processing (3)

• helm-charts/bifrost/values.schema.json
• helm-charts/bifrost/values.yaml
• transports/config.schema.json

[akshaydeo]

Merge activity

• Jun 2, 8:14 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jun 2, 8:15 AM UTC: @akshaydeo merged this pull request with Graphite.