AshScim.Auth.StaticBearer (ash_scim v0.1.0)

Copy Markdown View Source

Authenticates SCIM requests against one or more static bearer tokens.

Example

plug AshScim.Router,
  domains: [MyApp.Accounts],
  auth: {AshScim.Auth.StaticBearer, tokens: {:env, "SCIM_BEARER_TOKEN"}}

Options

  • :tokens — required. A list of accepted token strings, a single string, or a {:env, "VAR"} tuple to read at request time. Reading from the environment lazily avoids baking tokens into compiled releases. Multiple tokens are useful during rotation.
  • :actor — optional. The Ash actor to use for actions performed by authenticated requests. Defaults to nil. For most setups you will want to provide a service-account user record so that policies see a consistent identity in audit logs.

Constant-time comparison is used to match the presented token, so this module is safe against timing attacks even when tokens differ in length.