Authenticates SCIM requests using JWTs issued by AshAuthentication.
The bearer token is verified against the host app's signing key, its
purpose claim is checked, the JTI is verified against the
AshAuthentication.TokenResource so revocations are honored, and the
sub claim is resolved into a user record. That user is returned as the
Ash actor for the request.
Example
plug AshScim.Router,
domains: [MyApp.Accounts],
auth: {AshScim.Auth.AshAuthenticationToken, otp_app: :my_app}Revocation is handled transparently by AshAuthentication.Jwt.verify/2,
which checks the JTI against the resource's token resource as part of
validation. There is no separate revocation check inside this module.
Options
:otp_app— required. The OTP application name configured by AshAuthentication. Used to discover the user resource(s).:purpose— required claim value to match. Defaults to"scim". Tokens issued for other purposes (sign-in, magic link, confirmation) cannot be used to access SCIM endpoints.
Issuing tokens
Generate a SCIM token from the host app — typically from an admin UI or an
iex console — by minting a JWT with purpose: "scim" for a service-account
user and persisting it in the token resource. A mix ash_scim.gen.token
task is provided for local development convenience but should not be used
against production.