# `AshScim.Test.SourceExample.Auth`
[🔗](https://github.com/ash-project/ash_scim/blob/main/test/support/source_example/auth.ex#L5)

Realistic per-source auth implementation: each SCIM client carries a
JWT issued by AshAuthentication, and the JWT contains a custom
`scim_source` claim identifying which IdP the request is from.

This implementation:

  1. Verifies the JWT via `AshAuthentication.Jwt.verify/2` (signature,
     expiry, JTI presence in the token resource — the same checks
     `AshScim.Auth.AshAuthenticationToken` does).
  2. Confirms the token's `purpose` claim is `"scim"`.
  3. Reads the custom `scim_source` claim and stashes it on the conn
     via `Ash.PlugHelpers.set_context/2` so the router threads it
     through every Ash call.
  4. Resolves the JWT subject into a service-account user record, used
     as the Ash actor for the request.

The router never sees `scim_source` — it just merges whatever context
the auth implementation set. The resource's `change` and `prepare`
modules read `context.private.scim_source` to enforce per-source
isolation.

---

*Consult [api-reference.md](api-reference.md) for complete listing*