mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-06 08:16:43 +00:00
25ebe5600a
* fix(scim): stop provisioning nested group ids as internal users POST/PUT/PATCH /scim/v2/Groups treated every member.value as a user id, so with the default scim_upsert_user=true an unknown id was auto-created as an internal user. Entra sends nested groups as members carrying "type": "Group", which meant every nested group produced a phantom internal user whose id and email were the group GUID, and those users counted toward licensed seats. Group members are now classified before they are used: members typed "Group" are skipped without a database hit, an id that names an existing team is skipped too (Okta sends untyped ids through filtered paths, so the type alone is not enough), and only ids that resolve to a user, or that resolve to nothing at all, keep today's behavior. The user lookup runs before the team lookup so a user whose id collides with a team id keeps syncing. The type was previously dropped at parse time on POST/PUT because SCIMMember had no such field, and on PATCH because the raw member dicts were reduced to bare ids; both paths now share one resolver and one parser that preserves it. Member removals no longer upsert: a remove of an id we do not know is an idempotent no-op rather than a reason to create a user and immediately drop it, and strict mode (scim_upsert_user=false) no longer rejects it. Removal of an id that is on the roster but has no user row still cleans up membership. Responses now state members are of type "User" instead of emitting a null, and the advertised Group schema documents the members.type sub-attribute. * fix(scim): harden group member classification after adversarial review Removals now bypass classification and drop exactly the ids they name, restoring cleanup of roster entries the old bug left behind. The team-id fallback only applies to untyped members, so an explicit User type always provisions even when the id collides with a team. Member types are normalized before matching; a type other than User or Group only skips when the id is not an existing user. Non-string type values are tolerated as absent on every verb instead of failing validation. Admitted member ids are deduped order-preserving, which also closes a pre-existing duplicate-row hazard on group creation. * fix(scim): only treat scim-managed teams as nested groups A PR reviewer flagged that an untyped SCIM member whose id collides with an admin-created team was silently skipped, suppressing that user's provisioning. SCIM group writes (POST, PUT, and every PATCH) now stamp the team with scim_managed metadata, and the typeless team-id skip only applies to teams carrying that marker or the scim_data blob older PUTs already wrote. Admin-created teams stay unmarked, so a colliding untyped member provisions the user in permissive mode and returns the standard unknown-user 400 in strict mode. Teams SCIM touched before this change adopt the marker on their next group write. |
||
|---|---|---|
| .. | ||
| test_scim_key_deactivation.py | ||
| test_scim_patch_user.py | ||
| test_scim_transformations.py | ||
| test_scim_v2_discovery.py | ||
| test_scim_v2_endpoints.py | ||