feat: adds SCIM provisioning fields and tightens attribute mapping schemas in config - #4332
Merged
Merged
Conversation
Contributor
ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThis PR refines the identity provider attribute mapping schemas in ChangesAttribute Mapping Schema Refinements
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
Author
This stack of pull requests is managed by Graphite. Learn more about stacking. |
18 tasks
|
|
roroghost17
changed the title
roroghost17
marked this pull request as ready for review
June 12, 2026 08:48
Contributor
Confidence Score: 4/5The schema changes are additive and isolated to config.schema.json; the Okta attributeTeamMappings Both defects are in transports/config.schema.json: Okta attributeTeamMappings still requires transports/config.schema.json — specifically the Okta attributeTeamMappings required array and the Keycloak mapping item definitions Important Files Changed
Reviews (2): Last reviewed commit: "feat: config.schema.json changes" | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
roroghost17
force-pushed
the
06-12-feat_config.schema.json_changes
branch
from
June 12, 2026 09:03
7da2309 to
4da321e
Compare
roroghost17
force-pushed
the
06-12-feat_adds_pubsub_kafka_to_config_json_with_plugin_span_filter
branch
from
June 12, 2026 09:03
44f14ea to
2b9a709
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@transports/config.schema.json`:
- Around line 4689-4705: The Keycloak schema definition for
keycloak_config.attributeRoleMappings is missing the optional fields
attributeType and attributeValue required by the SCIM/OIDC mapping contract;
update the object under attributeRoleMappings to include optional properties
"attributeType" (string, description e.g. "type of attribute like 'string' or
'array'") and "attributeValue" (string, description e.g. "normalized/expected
attribute value"), ensure they are not added to the "required" array and keep
additionalProperties false so the schema matches Okta/Entra and accepts valid
Keycloak SCIM role-mapping configs.
- Around line 1906-1951: The schema currently allows sasl_enabled: true without
providing a sasl object; add a JSON Schema conditional so SASL validation fails
closed: add an if/then block that checks if "sasl_enabled" is true (if: {
"properties": { "sasl_enabled": { "const": true } }, "required":
["sasl_enabled"] }) and in the then require the "sasl" property (then: {
"required": ["sasl"], "properties": { "sasl": { "required":
["mechanism","username","password"] } } }), ensuring the existing "sasl" object
shape (mechanism, username, password) is enforced when sasl_enabled is true;
keep additionalProperties:false for the "sasl" object.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: d72558da-f3c5-4af2-be5c-6f6d5e7cc63b
📒 Files selected for processing (1)
transports/config.schema.json
Contributor
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@transports/config.schema.json`:
- Around line 4689-4705: The Keycloak schema definition for
keycloak_config.attributeRoleMappings is missing the optional fields
attributeType and attributeValue required by the SCIM/OIDC mapping contract;
update the object under attributeRoleMappings to include optional properties
"attributeType" (string, description e.g. "type of attribute like 'string' or
'array'") and "attributeValue" (string, description e.g. "normalized/expected
attribute value"), ensure they are not added to the "required" array and keep
additionalProperties false so the schema matches Okta/Entra and accepts valid
Keycloak SCIM role-mapping configs.
- Around line 1906-1951: The schema currently allows sasl_enabled: true without
providing a sasl object; add a JSON Schema conditional so SASL validation fails
closed: add an if/then block that checks if "sasl_enabled" is true (if: {
"properties": { "sasl_enabled": { "const": true } }, "required":
["sasl_enabled"] }) and in the then require the "sasl" property (then: {
"required": ["sasl"], "properties": { "sasl": { "required":
["mechanism","username","password"] } } }), ensuring the existing "sasl" object
shape (mechanism, username, password) is enforced when sasl_enabled is true;
keep additionalProperties:false for the "sasl" object.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: d72558da-f3c5-4af2-be5c-6f6d5e7cc63b
📒 Files selected for processing (1)
transports/config.schema.json
🛑 Comments failed to post (2)
transports/config.schema.json (2)
1906-1951:
⚠️ Potential issue | 🟠 Major | ⚡ Quick winMake Kafka SASL validation fail-closed when SASL is enabled.
With current schema,
sasl_enabled: truecan pass without asaslobject or credentials. That permits insecure/accidental plaintext operation despite an explicit SASL toggle.Suggested fix
"config": { "type": "object", "description": "Configuration for the Kafka traces plugin (Enterprise). Publishes completed traces as JSON messages to a Kafka topic, keyed by trace ID.", "properties": { @@ "sasl": { "type": "object", "description": "SASL credentials, used when sasl_enabled is true", "properties": { @@ "password": { @@ } }, + "required": ["mechanism", "username", "password"], "additionalProperties": false }, @@ "plugin_span_filter": { "$ref": "`#/`$defs/plugin_span_filter" } }, + "allOf": [ + { + "if": { + "properties": { + "sasl_enabled": { "const": true } + }, + "required": ["sasl_enabled"] + }, + "then": { + "required": ["sasl"] + } + } + ], "required": ["brokers", "topic"], "additionalProperties": false }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@transports/config.schema.json` around lines 1906 - 1951, The schema currently allows sasl_enabled: true without providing a sasl object; add a JSON Schema conditional so SASL validation fails closed: add an if/then block that checks if "sasl_enabled" is true (if: { "properties": { "sasl_enabled": { "const": true } }, "required": ["sasl_enabled"] }) and in the then require the "sasl" property (then: { "required": ["sasl"], "properties": { "sasl": { "required": ["mechanism","username","password"] } } }), ensuring the existing "sasl" object shape (mechanism, username, password) is enforced when sasl_enabled is true; keep additionalProperties:false for the "sasl" object.Source: Coding guidelines
4689-4705:
⚠️ Potential issue | 🟠 Major | ⚡ Quick winAdd missing SCIM role-mapping fields to Keycloak schema.
keycloak_config.attributeRoleMappingsis missing the new optionalattributeTypeandattributeValuefields that are present for Okta/Entra and required by the SCIM/OIDC mapping contract. This creates provider-specific schema drift and rejects valid Keycloak SCIM role mapping configs.Suggested fix
"attributeRoleMappings": { "type": "array", "description": "Ordered list of attribute -> role mappings (first match wins).", "items": { "type": "object", "properties": { "attribute": { "type": "string", "description": "JWT claim name (supports dot paths, e.g. 'realm_access.roles')" }, "value": { "type": "string", "description": "Claim value to match (case-insensitive)" }, "role": { "type": "string", "description": "Bifrost role to assign on match" + }, + "attributeType": { + "type": "string", + "enum": ["user", "group"], + "description": "SCIM provisioning type: 'user' matches SCIM User attributes, 'group' matches SCIM Group displayName" + }, + "attributeValue": { + "type": "string", + "description": "SCIM attribute value to match (for attributeType 'user': the SCIM user attribute value; for 'group': the SCIM group displayName, auto-set to 'displayName')" } }, "required": ["attribute", "value", "role"], "additionalProperties": false } },📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements."type": "object", "properties": { "attribute": { "type": "string", "description": "JWT claim name (supports dot paths, e.g. 'realm_access.roles')" }, "value": { "type": "string", "description": "Claim value to match (case-insensitive)" }, "role": { "type": "string", "description": "Bifrost role to assign on match" }, "attributeType": { "type": "string", "enum": ["user", "group"], "description": "SCIM provisioning type: 'user' matches SCIM User attributes, 'group' matches SCIM Group displayName" }, "attributeValue": { "type": "string", "description": "SCIM attribute value to match (for attributeType 'user': the SCIM user attribute value; for 'group': the SCIM group displayName, auto-set to 'displayName')" } }, "required": ["attribute", "value", "role"], "additionalProperties": false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@transports/config.schema.json` around lines 4689 - 4705, The Keycloak schema definition for keycloak_config.attributeRoleMappings is missing the optional fields attributeType and attributeValue required by the SCIM/OIDC mapping contract; update the object under attributeRoleMappings to include optional properties "attributeType" (string, description e.g. "type of attribute like 'string' or 'array'") and "attributeValue" (string, description e.g. "normalized/expected attribute value"), ensure they are not added to the "required" array and keep additionalProperties false so the schema matches Okta/Entra and accepts valid Keycloak SCIM role-mapping configs.Source: Coding guidelines
Contributor
Merge activity
|
akshaydeo
changed the base branch from
06-12-feat_adds_pubsub_kafka_to_config_json_with_plugin_span_filter
to
graphite-base/4332
June 12, 2026 09:11
17 tasks
akshaydeo
pushed a commit
that referenced
this pull request
Jun 12, 2026
…hemas in config (#4332) ## Summary This PR tightens the JSON schema definitions for SSO attribute mapping configurations and adds SCIM provisioning support to the OIDC/JWT mapping blocks that previously lacked it. ## Changes - Added `attributeType` (`"user"` | `"group"`) and `attributeValue` fields to the SAML/SCIM `attributeRoleMappings` items, enabling SCIM-aware role assignment. - Expanded the previously untyped (`"type": "object"`) Keycloak `attributeRoleMappings`, `attributeTeamMappings`, and `attributeBusinessUnitMappings` items with fully typed property definitions, `required` constraints, and `additionalProperties: false`. - Added top-level `attributeRoleMappings`, `attributeTeamMappings`, and `attributeBusinessUnitMappings` arrays to the Azure AD / OIDC provider config block, mirroring the Keycloak equivalents and including SCIM `attributeType`/`attributeValue` fields. - Made `business_unit` optional in `attributeBusinessUnitMappings` (removed from `required`) to support wildcard `"*"` pass-through mappings where the claim value itself becomes the business unit name. - Clarified descriptions for `team`, `value`, and `business_unit` fields to document wildcard `"*"` behaviour and when fields should be left empty. ## Type of change - [ ] Bug fix - [ ] Feature - [x] Refactor - [ ] Documentation - [ ] Chore/CI ## Affected areas - [ ] Core (Go) - [x] Transports (HTTP) - [ ] Providers/Integrations - [ ] Plugins - [ ] UI (React) - [ ] Docs ## How to test Validate the schema against existing and new SSO configuration fixtures: ```sh # Validate schema syntax npx ajv compile -s transports/config.schema.json # Run transport tests go test ./transports/... ``` Verify that: - A Keycloak config with `attributeRoleMappings` containing `attribute`, `value`, and `role` passes validation. - An Azure AD config with `attributeTeamMappings` using `value: "*"` and no `team` field passes validation. - An `attributeBusinessUnitMappings` entry with `value: "*"` and no `business_unit` field passes validation. - Any mapping item with unknown extra properties fails validation (`additionalProperties: false`). ## Breaking changes - [x] Yes - [ ] No The Keycloak `attributeRoleMappings`, `attributeTeamMappings`, and `attributeBusinessUnitMappings` items now enforce `additionalProperties: false` and explicit `required` fields. Any existing config that passes undeclared properties in these arrays will fail schema validation. ## Related issues ## Security considerations The `attributeType`/`attributeValue` fields are used during SCIM provisioning to match users or groups. Ensure that group `displayName` values used in mappings are controlled and cannot be spoofed by end-users through SCIM payloads. ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [ ] I added/updated tests where appropriate - [ ] I updated documentation where needed - [ ] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Configuration Updates** * Enhanced identity provider mapping schema with new optional attributes for role mappings and richer mapping options. * Relaxed validation for team and business-unit mappings so they no longer require target fields, making mappings more flexible. * **Documentation** * Clarified descriptions for wildcard behavior and mapping semantics to reduce ambiguity. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR tightens the JSON schema definitions for SSO attribute mapping configurations and adds SCIM provisioning support to the OIDC/JWT mapping blocks that previously lacked it.
Changes
attributeType("user"|"group") andattributeValuefields to the SAML/SCIMattributeRoleMappingsitems, enabling SCIM-aware role assignment."type": "object") KeycloakattributeRoleMappings,attributeTeamMappings, andattributeBusinessUnitMappingsitems with fully typed property definitions,requiredconstraints, andadditionalProperties: false.attributeRoleMappings,attributeTeamMappings, andattributeBusinessUnitMappingsarrays to the Azure AD / OIDC provider config block, mirroring the Keycloak equivalents and including SCIMattributeType/attributeValuefields.business_unitoptional inattributeBusinessUnitMappings(removed fromrequired) to support wildcard"*"pass-through mappings where the claim value itself becomes the business unit name.team,value, andbusiness_unitfields to document wildcard"*"behaviour and when fields should be left empty.Type of change
Affected areas
How to test
Validate the schema against existing and new SSO configuration fixtures:
Verify that:
attributeRoleMappingscontainingattribute,value, androlepasses validation.attributeTeamMappingsusingvalue: "*"and noteamfield passes validation.attributeBusinessUnitMappingsentry withvalue: "*"and nobusiness_unitfield passes validation.additionalProperties: false).Breaking changes
The Keycloak
attributeRoleMappings,attributeTeamMappings, andattributeBusinessUnitMappingsitems now enforceadditionalProperties: falseand explicitrequiredfields. Any existing config that passes undeclared properties in these arrays will fail schema validation.Related issues
Security considerations
The
attributeType/attributeValuefields are used during SCIM provisioning to match users or groups. Ensure that groupdisplayNamevalues used in mappings are controlled and cannot be spoofed by end-users through SCIM payloads.Checklist
docs/contributing/README.mdand followed the guidelinesSummary by CodeRabbit
Configuration Updates
Documentation