Documentation

Ensure that unused team invitations are invalidated when the SCIM user gets deleted.

SCIM email metadata (type, primary) round-trips verbatim: spar persists what the IdP sends and echoes exactly that; users provisioned without metadata get back an email object with only value (strict echo).

Non-"work" email types are accepted and echoed verbatim (no normalization to "work").

RFC 7644 §3.5.2.2: removing a sub-attribute unassigns it and keeps the record; RFC 7643 §2.5 (and RFC 7644 §3.5.2): assigning null is equivalent to unassignment. Removing or nulling emails[type eq "work"].type must not erase the email value or the primary flag.

A SCIM PatchOp with the given op, path, and optional value.

Expected SCIM email object. spar echoes the type/primary metadata of the stored email entry exactly as provisioned (see synthesizeScimUser); fixtures in this module send no metadata, so the expected email object has only value.

in V6, create idp then scim without idp id and idp id is unique

in V6, name should be ignored

Normalize on Value level

Recursively sorts all JSON arrays. This produces a canonical form, where the initial order of elements doesn't matter. Only use this function when that's desired (i.e. there is no value in the order of elements).

In this test, the IdP attempts an IdP-initiated login, and the client gets redirected back to IdP from SP with a valid authentication request. This is to make some hypothetical attacks harder while still supporting login dashboards in IdP UIs.

The backend accepts an IdP descriptor whose signing cert is already expired, both at config-import time (POST /identity-providers) and at AuthnResponse verification time (POST ssofinalize-login).

This was probably built this way to not force team admins to reconfigure IdPs over and over again (and if they forget, having angry users who cannot login).

UTF-8 chars (non-Latin-1) caused issues in XML parsing.

in V6, create two idps then one scim should fail

This test may be covered by testScimUpdateEmailAddress and maybe can be removed.

create user with non-email externalId. then use put to add an email address.

changing externalId and emails subsequently:

1. create user with extid email;
2. add email to emails field;
3. change extId to uuid;
4. change extId back to *other* email.

(may overlap with testSsoLoginNoSamlEmailValidation.)

A pending email update (emailUnvalidated + activation code) must be invalidated when the user transitions to SCIM control. Getting a Wire-managed user via the SCIM API triggers getUserById -> synthesizeStoredUser -> ManagedByScim -> deletePendingEmailUpdate in spar, which calls the brig internal endpoint that deletes both the activation code and the pending email entry. See WPB-21744 / PR #5333.