Advanced SSO Integration

# ============================================
# SCIM PROVIDER SETTINGS
# ============================================

Name: "GitHub Enterprise SCIM"
Protocol: "SCIM"

# Target application URL (where users are provisioned)
URL: "https://api.github.com/scim/v2/organizations/YOUR_ORG"

# Bearer token for authentication
Token: "ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxx"

# Which users to provision
Filter Group: "github-users"

# Attribute Mapping
User Mapping:
  - userName → user.username
  - name.givenName → user.name
  - name.familyName → user.attributes.last_name
  - emails[0].value → user.email
  - active → user.is_active

# ============================================
# COMMON SCIM ENDPOINTS
# ============================================

# GitHub Enterprise
https://api.github.com/scim/v2/organizations/{org}

# Slack Enterprise Grid
https://api.slack.com/scim/v2

# AWS SSO
https://scim.{region}.amazonaws.com/{tenant-id}/scim/v2

# Zoom
https://api.zoom.us/scim2

#!/usr/bin/env python3
"""
============================================
MOCK SCIM 2.0 SERVER
Test Authentik SCIM provisioning locally
============================================
"""

from flask import Flask, request, jsonify
import sqlite3
import uuid
from datetime import datetime

app = Flask(__name__)

# Initialize database
def init_db():
    conn = sqlite3.connect('scim_users.db')
    cursor = conn.cursor()
    cursor.execute('''
        CREATE TABLE IF NOT EXISTS users (
            id TEXT PRIMARY KEY,
            userName TEXT UNIQUE NOT NULL,
            givenName TEXT,
            familyName TEXT,
            email TEXT,
            active INTEGER DEFAULT 1,
            created_at TEXT,
            updated_at TEXT
        )
    ''')
    conn.commit()
    conn.close()


# ============================================
# SCIM 2.0 ENDPOINTS
# ============================================

@app.route('/scim/v2/Users', methods=['POST'])
def create_user():
    """SCIM Create User - Called when user added to provisioned group"""
    data = request.get_json()
    user_id = str(uuid.uuid4())
    
    conn = sqlite3.connect('scim_users.db')
    cursor = conn.cursor()
    
    try:
        cursor.execute('''
            INSERT INTO users (id, userName, givenName, familyName, email, active, created_at, updated_at)
            VALUES (?, ?, ?, ?, ?, ?, ?, ?)
        ''', (
            user_id,
            data.get('userName'),
            data.get('name', {}).get('givenName'),
            data.get('name', {}).get('familyName'),
            data.get('emails', [{}])[0].get('value'),
            1 if data.get('active', True) else 0,
            datetime.utcnow().isoformat(),
            datetime.utcnow().isoformat()
        ))
        conn.commit()
        
        print(f"✅ SCIM CREATE: {data.get('userName')}")
        
        return jsonify({
            "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
            "id": user_id,
            "userName": data.get('userName'),
            "active": data.get('active', True),
            "meta": {
                "resourceType": "User",
                "created": datetime.utcnow().isoformat(),
                "location": f"/scim/v2/Users/{user_id}"
            }
        }), 201
    except sqlite3.IntegrityError:
        return jsonify({"error": "User already exists"}), 409
    finally:
        conn.close()


@app.route('/scim/v2/Users/<user_id>', methods=['PATCH'])
def update_user(user_id):
    """SCIM Update User - Called on attribute changes or deprovisioning"""
    data = request.get_json()
    
    conn = sqlite3.connect('scim_users.db')
    cursor = conn.cursor()
    
    # Process SCIM PATCH operations
    for op in data.get('Operations', []):
        if op.get('path') == 'active':
            active = 1 if op.get('value') else 0
            cursor.execute('UPDATE users SET active = ?, updated_at = ? WHERE id = ?',
                          (active, datetime.utcnow().isoformat(), user_id))
            
            status = "ENABLED" if active else "DISABLED"
            print(f"⚠️ SCIM UPDATE: User {user_id} - {status}")
    
    conn.commit()
    conn.close()
    
    return jsonify({"id": user_id, "status": "updated"}), 200


@app.route('/scim/v2/Users/<user_id>', methods=['DELETE'])
def delete_user(user_id):
    """SCIM Delete User - Full deprovisioning"""
    conn = sqlite3.connect('scim_users.db')
    cursor = conn.cursor()
    cursor.execute('DELETE FROM users WHERE id = ?', (user_id,))
    conn.commit()
    conn.close()
    
    print(f"🗑️ SCIM DELETE: User {user_id}")
    return '', 204


@app.route('/scim/v2/Users', methods=['GET'])
def list_users():
    """SCIM List Users - For reconciliation"""
    conn = sqlite3.connect('scim_users.db')
    cursor = conn.cursor()
    cursor.execute('SELECT * FROM users')
    users = cursor.fetchall()
    conn.close()
    
    return jsonify({
        "schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
        "totalResults": len(users),
        "Resources": [{
            "id": u[0], "userName": u[1], "active": bool(u[5])
        } for u in users]
    })


if __name__ == '__main__':
    init_db()
    print("🚀 SCIM Mock Server: http://localhost:5005/scim/v2")
    app.run(host='0.0.0.0', port=5005, debug=True)

# ============================================
# RISK-BASED AUTHENTICATION FLOW
# ============================================

# 1. Create GeoIP Policy
Policy Type: "Expression Policy"
Name: "block-high-risk-countries"

Expression:
"""
# Block logins from high-risk countries
BLOCKED_COUNTRIES = ["RU", "CN", "KP", "IR"]

# Get GeoIP data from request context
geo_country = request.context.get("geoip", {}).get("country", "")

if geo_country in BLOCKED_COUNTRIES:
    ak_message("Access denied from your location")
    return False
    
return True
"""

# ============================================
# 2. Create New Device Detection Policy
# ============================================

Policy Type: "Expression Policy"
Name: "detect-new-device"

Expression:
"""
# Check if this is a new device/browser
from authentik.core.models import AuthenticatedSession

user = request.user
client_ip = request.context.get("client_ip", "")

# Check for existing sessions from this IP
existing_sessions = AuthenticatedSession.objects.filter(
    user=user,
    last_ip=client_ip
).exists()

# If new device, set flag for MFA requirement
if not existing_sessions:
    request.context["new_device"] = True
    
return True
"""

# ============================================
# 3. Create Sensitive App Policy
# ============================================

Policy Type: "Expression Policy"
Name: "sensitive-app-mfa"

Expression:
"""
# Always require MFA for sensitive applications
SENSITIVE_APPS = ["vault", "aws-console", "production-db"]

app_slug = request.context.get("application", {}).get("slug", "")

if app_slug in SENSITIVE_APPS:
    request.context["require_mfa"] = True
    
return True
"""

# ============================================
# 4. Bind Policies to Flow Stages
# ============================================

# Add policies to stage bindings:
# - block-high-risk-countries → identification stage
# - detect-new-device → password stage
# - sensitive-app-mfa → mfa-validation stage

# ============================================
# ADD TO YOUR docker-compose.yml
# ============================================

  prometheus:
    image: prom/prometheus:v2.47.0
    container_name: prometheus
    ports:
      - "9090:9090"
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml
      - prometheus-data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
    networks:
      - authentik

  grafana:
    image: grafana/grafana:10.1.0
    container_name: grafana
    ports:
      - "3000:3000"
    environment:
      GF_SECURITY_ADMIN_PASSWORD: "admin123"
      GF_AUTH_GENERIC_OAUTH_ENABLED: "true"
      GF_AUTH_GENERIC_OAUTH_NAME: "Authentik"
      GF_AUTH_GENERIC_OAUTH_CLIENT_ID: "grafana"
      GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: "your-secret"
      GF_AUTH_GENERIC_OAUTH_AUTH_URL: "https://authentik.yourdomain.com/application/o/authorize/"
      GF_AUTH_GENERIC_OAUTH_TOKEN_URL: "https://authentik.yourdomain.com/application/o/token/"
      GF_AUTH_GENERIC_OAUTH_API_URL: "https://authentik.yourdomain.com/application/o/userinfo/"
    volumes:
      - grafana-data:/var/lib/grafana
    depends_on:
      - prometheus
    networks:
      - authentik

volumes:
  prometheus-data:
  grafana-data:

# ============================================
# PROMETHEUS CONFIGURATION
# prometheus.yml
# ============================================

global:
  scrape_interval: 15s
  evaluation_interval: 15s

scrape_configs:
  # Authentik metrics
  - job_name: 'authentik'
    static_configs:
      - targets: ['authentik-server:9300']
    metrics_path: '/metrics'

  # Authentik worker metrics
  - job_name: 'authentik-worker'
    static_configs:
      - targets: ['authentik-worker:9300']

  # Prometheus itself
  - job_name: 'prometheus'
    static_configs:
      - targets: ['localhost:9090']