{"id":31847912,"url":"https://github.com/wireapp/ldap-scim-bridge","last_synced_at":"2025-10-12T09:58:33.104Z","repository":{"id":37097000,"uuid":"392792917","full_name":"wireapp/ldap-scim-bridge","owner":"wireapp","description":"Command-line translator between LDAP and SCIM systems.","archived":false,"fork":false,"pushed_at":"2025-02-12T09:38:13.000Z","size":105,"stargazers_count":14,"open_issues_count":6,"forks_count":2,"subscribers_count":15,"default_branch":"master","last_synced_at":"2025-08-18T17:28:26.584Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Haskell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/wireapp.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-08-04T18:36:45.000Z","updated_at":"2025-05-12T17:49:49.000Z","dependencies_parsed_at":"2025-01-21T09:22:31.284Z","dependency_job_id":"01f2d642-09be-4f53-8d99-d5e14540e221","html_url":"https://github.com/wireapp/ldap-scim-bridge","commit_stats":{"total_commits":27,"total_committers":3,"mean_commits":9.0,"dds":0.07407407407407407,"last_synced_commit":"14bff67c0a246c1c7e922395a510afda1a0d8007"},"previous_names":[],"tags_count":17,"template":false,"template_full_name":null,"purl":"pkg:github/wireapp/ldap-scim-bridge","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wireapp%2Fldap-scim-bridge","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wireapp%2Fldap-scim-bridge/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wireapp%2Fldap-scim-bridge/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wireapp%2Fldap-scim-bridge/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/wireapp","download_url":"https://codeload.github.com/wireapp/ldap-scim-bridge/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/wireapp%2Fldap-scim-bridge/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279010951,"owners_count":26084841,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-12T02:00:06.719Z","response_time":53,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-10-12T09:58:29.303Z","updated_at":"2025-10-12T09:58:33.096Z","avatar_url":"https://github.com/wireapp.png","language":"Haskell","funding_links":[],"categories":[],"sub_categories":[],"readme":"## ldap-scim-bridge\n\n[![GitHub CI](https://github.com/wireapp/ldap-scim-bridge/workflows/CI/badge.svg)](https://github.com/wireapp/ldap-scim-bridge/actions)\n[![Hackage](https://img.shields.io/hackage/v/ldap-scim-bridge.svg?logo=haskell)](https://hackage.haskell.org/package/ldap-scim-bridge)\n[![Stackage Lts](http://stackage.org/package/ldap-scim-bridge/badge/lts)](http://stackage.org/lts/package/ldap-scim-bridge)\n[![Stackage Nightly](http://stackage.org/package/ldap-scim-bridge/badge/nightly)](http://stackage.org/nightly/package/ldap-scim-bridge)\n[![AGPL-3.0-only license](https://img.shields.io/badge/license-AGPL--3.0--only-blue.svg)](LICENSE)\n\n## intro\n\nThis is a small command line tool to pull data from an LDAP server and\npush it to a SCIM peer.  It is currently used in production togethre\nwith [wire-server](https://github.com/wireapp/wire-server), but is\ndesigned as a more general tool.\n\nIt supports fields `externalId`, `userName`, `displayName`, `emails`,\nin the `User` schema.  It may not support any other fields, and it\ndoes not support scim `Group`s.\n\nIf you extend this to other fields, groups, or other use cases and setups, we\nwould highly appreciate pull requests, tickets, or emails (no matter how half-baked).\n\nThere is a yaml config file that describes both how to reach the LDAP\nserver (including the desired directory object(s)) and the SCIM peer,\nhow to map attributes between the two worlds, and anything else that's\nneeded like log level.\n\nEvery communication is logged to stdout.  When called\nwithout arguments, the tool will print out usage info:\n\n```\n*** Exception: bad number of arguments: []\n\nusage: ldap-scim-bridge \u003cconfig.yaml\u003e\nsee https://github.com/wireapp/ldap-scim-bridge for a sample config.\n```\n\nSee [ldif](./ldif/README.md) for a few sample user records to play with.\nA working example can be found in `./examples/wire-server`.\n\n## usage\n\nIf you have gotten here as a\n[wire-server](https://github.com/wireapp/wire-server) administrator and want to\nuse this to populate your teams, you've got three options to run\n`ldap-scim-bridge`:\n\n1. Execute the plain executable.\n1. Run the Docker (container) image.\n1. Deploy it via the Helm chart.\n\nThe `ldap-scim-bridge` can be configured to use unencrypted connections (by\nsetting the configuration options `ldapSource.tls` or `scimTarget.tls` to\n`false`.) Please *ONLY* do so if the connection target (Wire or LDAP server) and\n`ldap-scim-bridge` run in the same trusted network. This can be accomplished by\nrunning the components e.g. in the same Kubernetes cluster or using a VPN.\n\nIn general, `ldapSource.tls` or `scimTarget.tls` should be set to true in a\nproduction-level setup.\n\n### execute plain executable\n\nThe easiest way is to leave building the executable and running it in the right\ncontext to Nix; e.g.:\n\n```sh\nnix shell --command bash -c \"ldap-scim-bridge examples/wire-server/conf1.yaml\"\n```\n\n### docker\n\nYou can use the docker image we're building from this repo. As we do not\nguarantee full backwards-compatibility (there may be breaking changes e.g.\nregarding CLI options), please always provide the image's tag. \n\n```sh\ndocker pull quay.io/wire/ldap-scim-bridge:$IMAGE_TAG\n```\n\nUsually, `IMAGE_TAG` should be the latest release name without the `v`-prefix.\nE.g. for `v0.10.3` the `IMAGE_TAG` is `0.10.3`.\n\nYou need to create a config file that contains your setup.  If in doubt, you can start with [this example](./examples/wire-server/conf1.yaml), or [this one](./examples/wire-server/conf2.yaml).  Name the file `config.yaml` and place it into `/config-path`.\n\n```sh\ndocker run -it --network=host \\\n  --mount type=bind,src=/config-path,target=/mnt \\\n  quay.io/wire/ldap-scim-bridge:$IMAGE_TAG \\\n  ldap-scim-bridge /mnt/config.yaml\n```\n\nThis should work fine for Windows if you make sure the file path under `src` points to the right place.  You may need to you `\\` instead of `/`.\n\nIf you need to add trusted certificates for TLS-encrypted connections to the store in `/etc/ssl/certs/`, you can just mount it:\n\n```sh\ndocker run -it --network=host \\\n  --mount type=bind,src=/config-path,target=/mnt \\\n  --mount type=bind,src=/etc/ssl/certs,target=/etc/ssl/certs \\\n  quay.io/wire/ldap-scim-bridge:$IMAGE_TAG \\\n  ldap-scim-bridge /mnt/config.yaml\n```\n\n### helm\n\nThere is a Helm chart to deploy `ldap-scim-bridge` to a Kubernetes cluster:\nhttps://github.com/wireapp/wire-server/tree/master/charts/ldap-scim-bridge\n\nPlease refer to its documentation.\n\n## the config file\n\nThe config file consists of three main sections:\n\n```\nldapSource: # where does the ldap data come from?\n  [...]\nscimTarget: # where does it go?\n  [...]\nmapping: # which ldap attributes map on which scim attributes?\n  [...]\nlogLevel: \"Debug\"  # one of Trace,Debug,Info,Warn,Error,Fatal; `Fatal` is least noisy, `Trace` most.\n```\n\nThe full example is from [here](./examples/wire-server/conf2.yaml).\nLet's go through each section separately.\n\n```\nldapSource:\n  host: \"localhost\"\n  port: 389\n\n  # Whether to use TLS (with default settings).  If this doesn't work,\n  # set to false, use a tls tunnel on the host OS, and please file a\n  # bug report.\n  tls: true\n\n  # login details (distinguished name)\n  dn: \"cn=admin,dc=nodomain\"\n  password: \"***\"\n\n  # utf8 or latin1.  if you're unsure, pick utf8, and if you get\n  # strange characters in the scim data, switch to latin1.\n  codec: \"utf8\"\n\n  # search query for retrieving the source data\n  search:\n    base: \"ou=NoPeople,dc=nodomain\"\n    objectClass: \"account\"\n```\n\nIn order to remove accounts in SCIM that have been removed in LDAP,\nyou need to specify the LDAP location of the deleted users, plus an\noptional filter for which entries should be considered deleted:\n\n```\n  deleteFromDirectory:\n    base: \"ou=DeletedPeople,dc=nodomain\"\n    objectClass: \"account\"\n  deleteOnAttribute:\n    key: \"deleted\"\n    value: \"true\"\n```\n\nTarget is a bit more familiar if you are used to REST APIs:\n\n```\nscimTarget:\n  host: \"localhost\"\n  port: 8088\n  tls: true\n  # http request root path of the SCIM API.\n  path: \"/scim/v2\"\n  # the token you have created in the team management app.\n  token: \"Bearer RRhtCL/VF9IYcmb3E9zaDo3rP6w3mZ3Ww3da7d2RDR8=\"\n```\n\nFinally, you need to decide which LDAP attributes are written into\nwhich SCIM attributes.  `mapping` is simply a YAML record with SCIM\nattributes as keys and associated LDAP attributes as string values:\n\n```\nmapping:\n  userName: \"uidNumber\"\n  externalId: \"email\"\n  email: \"email\"\n```\n\nIn this example, `uidNumber` in LDAP is written into SCIM attribute\n`userName`; `email` is written into `externalId`, and so on.\n\nSupported SCIM attributes as are:\n\n- `displayName`\n- `userName`\n- `externalId`\n- `email`\n- `roles`\n\n## developers\n\nFor running unit tests, try `cabal test`.\n\nIntegration tests is a bit more involved, since we need ldap and\nwire-server running.  See `./examples/wire-server/run.sh`.\n\n### Nix\n\n`direnv` (`.envrc`) calls the Nix flake to provide a development environment.\nAnother way to get into this environment is to call:\n\n```sh\nnix develop\n```\n\nTo develop with a specific GHC version call e.g.:\n```sh\nnix develop .\\#ghc96\n```\n\nThe Docker image can be build and loaded with:\n\n```sh\nnix build .\\#dockerImage\ndocker load -i result\n```\n\nTo use Treefmt to format the whole project (according to the `./treefmt.toml`)\nrun:\n\n```sh\nnix fmt\n```\n\nTo validate the Nix code itself:\n\n```sh\nnix flake check\n```\n\nTo update the Nix dependencies:\n```sh\nnix flake update\n```\n\n### CI\n\nTag your PR with the label `ghc-matrix` to build this package with many\ndifferent GHC versions. Most are unfortunately - shame on us! - expected to\nfail.\n\n## cutting a new release\n\n- Make sure master is up to date\n- `git tag v0.*`\n- `git push --tags`\n\nThis will trigger a github workflow that builds and uploads the docker\nimages to quay.io.\n\n- consider releasing to hackage (see `./admin/publish.sh`)\n- bump version in cabal file to upcoming version\n\n## future work\n\nSee https://github.com/wireapp/ldap-scim-bridge/issues\n\n## further reading\n\n- [https://devconnected.com/how-to-setup-openldap-server-on-debian-10/](https://devconnected.com/how-to-setup-openldap-server-on-debian-10/)\n- [https://www.lepide.com/how-to/restore-deleted-objects-in-active-directory.html](https://www.lepide.com/how-to/restore-deleted-objects-in-active-directory.html)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwireapp%2Fldap-scim-bridge","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fwireapp%2Fldap-scim-bridge","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwireapp%2Fldap-scim-bridge/lists"}