AshScim.Test.SourceExample.Auth (ash_scim v0.1.0)

Copy Markdown View Source

Realistic per-source auth implementation: each SCIM client carries a JWT issued by AshAuthentication, and the JWT contains a custom scim_source claim identifying which IdP the request is from.

This implementation:

  1. Verifies the JWT via AshAuthentication.Jwt.verify/2 (signature, expiry, JTI presence in the token resource — the same checks AshScim.Auth.AshAuthenticationToken does).
  2. Confirms the token's purpose claim is "scim".
  3. Reads the custom scim_source claim and stashes it on the conn via Ash.PlugHelpers.set_context/2 so the router threads it through every Ash call.
  4. Resolves the JWT subject into a service-account user record, used as the Ash actor for the request.

The router never sees scim_source — it just merges whatever context the auth implementation set. The resource's change and prepare modules read context.private.scim_source to enforce per-source isolation.