Note to first-time contributors: Please open a discussion post in Discussions and describe your changes before submitting a pull request.
Before submitting, make sure you've checked the following:
Target branch: Please verify that the pull request targets the dev branch.
Description: Provide a concise description of the changes made in this pull request.
Changelog: Ensure a changelog entry following the format of Keep a Changelog is added at the bottom of the PR description.
Documentation: Have you updated relevant documentation Open WebUI Docs, or other documentation sources?
Dependencies: Are there any new dependencies? Have you updated the dependency versions in the documentation?
Testing: Have you written and run sufficient tests to validate the changes?
Code review: Have you performed a self-review of your code, addressing any coding standard issues and ensuring adherence to the project's coding standards?
Prefix: To clearly categorize this pull request, prefix the pull request title using one of the following:
BREAKING CHANGE: Significant changes that may affect compatibility
build: Changes that affect the build system or external dependencies
ci: Changes to our continuous integration processes or workflows
chore: Refactor, cleanup, or other non-functional code changes
docs: Documentation update or addition
feat: Introduces a new feature or enhancement to the codebase
fix: Bug fix or error correction
i18n: Internationalization or localization changes
perf: Performance improvement
refactor: Code restructuring for better maintainability, readability, or scalability
style: Changes that do not affect the meaning of the code (white space, formatting, missing semi-colons, etc.)
test: Adding missing tests or correcting existing tests
WIP: Work in progress, a temporary label for incomplete or ongoing work
Changelog Entry
Description
Implements SCIM 2.0 (System for Cross-domain Identity Management) protocol support to enable automated user and group provisioning from identity providers like Okta, Azure AD, and Google Workspace. Configuration is managed through environment variables only, without UI exposure for enhanced security.
Added
SCIM 2.0 compliant API endpoints at /api/v1/scim/v2/ for:
User provisioning (create, read, update, delete)
Group management (create, read, update, delete with member management)
Service provider configuration
Resource types and schemas endpoints
Filtering and pagination support
Bearer token authentication for SCIM endpoints
Environment-based configuration:
SCIM_ENABLED: Enable/disable SCIM support
SCIM_TOKEN: Bearer token for SCIM authentication
SCIM-compliant error responses with proper schema
Automatic token synchronization from environment on startup
Security
SCIM authentication token is only configurable via environment variables
Bearer token authentication required for all SCIM endpoints
No exposure of sensitive configuration through web interface
By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/open-webui/open-webui/pull/15694
**Author:** [@dieu-bis](https://github.com/dieu-bis)
**Created:** 7/13/2025
**Status:** ✅ Merged
**Merged:** 8/6/2025
**Merged by:** [@tjbck](https://github.com/tjbck)
**Base:** `dev` ← **Head:** `feat/scim-2.0-support`
---
### 📝 Commits (7)
- [`f4d54c5`](https://github.com/open-webui/open-webui/commit/f4d54c518e97304ebd276a23308002bcf10d1cfb) feat: Add SCIM 2.0 support for enterprise user provisioning
- [`39bcee3`](https://github.com/open-webui/open-webui/commit/39bcee3f7baa640c9618c6fcd72f0b0c0d5a25df) remove ui config
- [`c9fda79`](https://github.com/open-webui/open-webui/commit/c9fda793e2c7a56d344c7481aeeeed35211915bb) udpate
- [`1d9c1f7`](https://github.com/open-webui/open-webui/commit/1d9c1f741d7866a64d8533626a2241498d6ab078) Update scim.py
- [`519b7af`](https://github.com/open-webui/open-webui/commit/519b7af6d8410366c76cf5efb5dd77fe4a49d47d) remove useless
- [`6469822`](https://github.com/open-webui/open-webui/commit/6469822af1491f09797f89a8d575e308b7f29611) Update configs.py
- [`41faec7`](https://github.com/open-webui/open-webui/commit/41faec758bcd8b35205aa21239d15395748a7dc2) Merge branch 'dev' into feat/scim-2.0-support
### 📊 Changes
**6 files changed** (+957 additions, -2 deletions)
<details>
<summary>View changed files</summary>
📝 `.gitignore` (+2 -1)
📝 `README.md` (+2 -0)
📝 `backend/open_webui/config.py` (+16 -0)
📝 `backend/open_webui/main.py` (+19 -0)
📝 `backend/open_webui/routers/configs.py` (+1 -1)
➕ `backend/open_webui/routers/scim.py` (+917 -0)
</details>
### 📄 Description
# Pull Request Checklist
### Note to first-time contributors: Please open a discussion post in [Discussions](https://github.com/open-webui/open-webui/discussions) and describe your changes before submitting a pull request.
**Before submitting, make sure you've checked the following:**
- [x] **Target branch:** Please verify that the pull request targets the `dev` branch.
- [x] **Description:** Provide a concise description of the changes made in this pull request.
- [x] **Changelog:** Ensure a changelog entry following the format of [Keep a Changelog](https://keepachangelog.com/) is added at the bottom of the PR description.
- [x] **Documentation:** Have you updated relevant documentation [Open WebUI Docs](https://github.com/open-webui/docs), or other documentation sources?
- [x] **Dependencies:** Are there any new dependencies? Have you updated the dependency versions in the documentation?
- [x] **Testing:** Have you written and run sufficient tests to validate the changes?
- [x] **Code review:** Have you performed a self-review of your code, addressing any coding standard issues and ensuring adherence to the project's coding standards?
- [x] **Prefix:** To clearly categorize this pull request, prefix the pull request title using one of the following:
- **BREAKING CHANGE**: Significant changes that may affect compatibility
- **build**: Changes that affect the build system or external dependencies
- **ci**: Changes to our continuous integration processes or workflows
- **chore**: Refactor, cleanup, or other non-functional code changes
- **docs**: Documentation update or addition
- **feat**: Introduces a new feature or enhancement to the codebase
- **fix**: Bug fix or error correction
- **i18n**: Internationalization or localization changes
- **perf**: Performance improvement
- **refactor**: Code restructuring for better maintainability, readability, or scalability
- **style**: Changes that do not affect the meaning of the code (white space, formatting, missing semi-colons, etc.)
- **test**: Adding missing tests or correcting existing tests
- **WIP**: Work in progress, a temporary label for incomplete or ongoing work
# Changelog Entry
### Description
- Implements SCIM 2.0 (System for Cross-domain Identity Management) protocol support to enable automated user and group provisioning from identity providers like Okta, Azure AD, and Google Workspace. Configuration is managed through environment variables only, without UI exposure for enhanced security.
### Added
- SCIM 2.0 compliant API endpoints at `/api/v1/scim/v2/` for:
- User provisioning (create, read, update, delete)
- Group management (create, read, update, delete with member management)
- Service provider configuration
- Resource types and schemas endpoints
- Filtering and pagination support
- Bearer token authentication for SCIM endpoints
- Environment-based configuration:
- `SCIM_ENABLED`: Enable/disable SCIM support
- `SCIM_TOKEN`: Bearer token for SCIM authentication
- SCIM-compliant error responses with proper schema
- Automatic token synchronization from environment on startup
### Security
- SCIM authentication token is only configurable via environment variables
- Bearer token authentication required for all SCIM endpoints
- No exposure of sensitive configuration through web interface
### Additional Information
- Follows SCIM 2.0 RFC specifications (RFC 7642, RFC 7643, RFC 7644)
- Tested with standard SCIM client libraries
- Supports standard SCIM operations including PATCH for partial updates
- Maps Open WebUI user roles: `user` = active, `pending` = inactive
- Related discussion: [link to your discussion post]
### Screenshots or Videos
SCIM integration test via Runscope Blazemeter
https://github.com/user-attachments/assets/756c434d-d976-4863-b09f-a5ac8b6e7bb7
SCIM User + Groups integration via Okta
https://github.com/user-attachments/assets/eb7403cc-01df-4c7b-a2ed-f9aa93de4188
### Discussion
[15693](https://github.com/open-webui/open-webui/discussions/15693)
### Documentation
[620](https://github.com/open-webui/docs/pull/620)
### Contributor License Agreement
By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/open-webui/open-webui/pull/15694
Author: @dieu-bis
Created: 7/13/2025
Status: ✅ Merged
Merged: 8/6/2025
Merged by: @tjbck
Base:
dev← Head:feat/scim-2.0-support📝 Commits (7)
f4d54c5feat: Add SCIM 2.0 support for enterprise user provisioning39bcee3remove ui configc9fda79udpate1d9c1f7Update scim.py519b7afremove useless6469822Update configs.py41faec7Merge branch 'dev' into feat/scim-2.0-support📊 Changes
6 files changed (+957 additions, -2 deletions)
View changed files
📝
.gitignore(+2 -1)📝
README.md(+2 -0)📝
backend/open_webui/config.py(+16 -0)📝
backend/open_webui/main.py(+19 -0)📝
backend/open_webui/routers/configs.py(+1 -1)➕
backend/open_webui/routers/scim.py(+917 -0)📄 Description
Pull Request Checklist
Note to first-time contributors: Please open a discussion post in Discussions and describe your changes before submitting a pull request.
Before submitting, make sure you've checked the following:
devbranch.Changelog Entry
Description
Added
/api/v1/scim/v2/for:SCIM_ENABLED: Enable/disable SCIM supportSCIM_TOKEN: Bearer token for SCIM authenticationSecurity
Additional Information
user= active,pending= inactiveScreenshots or Videos
SCIM integration test via Runscope Blazemeter
https://github.com/user-attachments/assets/756c434d-d976-4863-b09f-a5ac8b6e7bb7
SCIM User + Groups integration via Okta
https://github.com/user-attachments/assets/eb7403cc-01df-4c7b-a2ed-f9aa93de4188
Discussion
15693
Documentation
620
Contributor License Agreement
By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.