[Enhancement]: SCIM Support

[Andrew-Chen-Wang]

What features would you like to see added?

SCIM provisioning and de provisioning groups

More details

With more fine grained access control, I would love to see groups being synced

Which components are impacted by your request?

Other

Pictures

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[chesaman12]

I think this might be possible but only through Entra ID in v0.8.0-rc3+ (top part on https://github.com/danny-avila/LibreChat/releases/tag/v0.8.0-rc3). I have a potential solution where I am syncing users and groups from okta to entra ID, and then using the entra ID integration with librechat to sign in and push user groups down that can be used for permissions in agents via the people picker.

[Andrew-Chen-Wang]

Idk whether to agree with you regarding implementation difficulty since it's near impossible to read #8654 because it just jams a ton of features into one PR. So who knows if it's difficult or more like is it vibe codeable.

Alternatively I was thinking of BoxyHQ handling SCIM with a nice OAuth integration in front of any SSO https://github.com/ory/polis you still run into the issue of syncing groups though, but it's at least abstracted by a provider that can do a lot more of the auth related stuff.

[chesaman12]

Yah thats a branch full of features. There are specific PR's for each feature. This is probably more of what you are looking for - #7804

[Andrew-Chen-Wang]

Thanks for pinning the PR

I actually found a free SAML SCIM OSS solution so sharing the love https://tesseral.com/docs/what-is-tesseral

I don't know what SAML and SCIM entails if we did it ourselves, but at work we used WorkOS, so I can imagine the number of edge cases it includes is torturous (especially with Okta).