feat(scim): Add SCIM 2.0 provisioning support

Implements SCIM 2.0 discovery (ServiceProviderConfig, Schemas,
ResourceTypes), Users and Groups CRUD, the Me endpoint, search, eq/and
filtering, group PATCH, per
RFC 7643 and RFC 7644.

Refs #3089

Author: ravindu439

api/scim.yaml

@@ -415,6 +415,30 @@ packages:
       structname: '{{.InterfaceName}}Mock'
       pkgname: attestation
       filename: "{{.InterfaceName}}_mock_test.go"
+      
+  github.com/thunder-id/thunderid/internal/scim/discovery:
+    config:
+      all: true
+      dir: internal/scim/discovery
+      structname: '{{.InterfaceName}}Mock'
+      pkgname: discovery
+      filename: "{{.InterfaceName}}_mock_test.go"
+
+  github.com/thunder-id/thunderid/internal/scim/groups:
+    config:
+      all: true
+      dir: internal/scim/groups
+      structname: '{{.InterfaceName}}Mock'
+      pkgname: groups
+      filename: "{{.InterfaceName}}_mock_test.go"
+
+  github.com/thunder-id/thunderid/internal/scim/users:
+    config:
+      all: true
+      dir: internal/scim/users
+      structname: '{{.InterfaceName}}Mock'
+      pkgname: users
+      filename: "{{.InterfaceName}}_mock_test.go"
 
   github.com/thunder-id/thunderid/internal/system/resourcedependency:
     config:

backend/.mockery.private.yml

@@ -728,3 +728,24 @@ packages:
       structname: '{{.InterfaceName}}Mock'
       pkgname: presentationmock
       filename: "{{.InterfaceName}}_mock.go"
+  github.com/thunder-id/thunderid/internal/scim/discovery:
+    config:
+      all: true
+      dir: tests/mocks/scim/discoverymock
+      structname: '{{.InterfaceName}}Mock'
+      pkgname: discoverymock
+      filename: "{{.InterfaceName}}_mock.go"
+  github.com/thunder-id/thunderid/internal/scim/groups:
+    config:
+      all: true
+      dir: tests/mocks/scim/groupsmock
+      structname: '{{.InterfaceName}}Mock'
+      pkgname: groupsmock
+      filename: "{{.InterfaceName}}_mock.go"
+  github.com/thunder-id/thunderid/internal/scim/users:
+    config:
+      all: true
+      dir: tests/mocks/scim/usersmock
+      structname: '{{.InterfaceName}}Mock'
+      pkgname: usersmock
+      filename: "{{.InterfaceName}}_mock.go"

backend/.mockery.public.yml

@@ -136,7 +136,7 @@
       "validity_period": 3600
     },
     "dcr": {
-      "enabled" : true,
+      "enabled": true,
       "insecure": false
     },
     "par": {
@@ -152,14 +152,26 @@
     },
     "allow_wildcard_redirect_uri": false,
     "send_server_errors_to_client": false,
-    "allowed_auth_methods" :["client_secret_basic", "client_secret_post", "private_key_jwt", "none"],
-    "allowed_response_types" : ["code"],
-    "allowed_grant_types" : ["client_credentials", "authorization_code", "refresh_token", "urn:ietf:params:oauth:grant-type:token-exchange", "urn:openid:params:grant-type:ciba", "urn:ietf:params:oauth:grant-type:jwt-bearer"],
-    "token_revocation" : {
-      "enabled" : true
+    "allowed_auth_methods": [
+      "client_secret_basic",
+      "client_secret_post",
+      "private_key_jwt",
+      "none"
+    ],
+    "allowed_response_types": ["code"],
+    "allowed_grant_types": [
+      "client_credentials",
+      "authorization_code",
+      "refresh_token",
+      "urn:ietf:params:oauth:grant-type:token-exchange",
+      "urn:openid:params:grant-type:ciba",
+      "urn:ietf:params:oauth:grant-type:jwt-bearer"
+    ],
+    "token_revocation": {
+      "enabled": true
     },
-    "logout" : {
-      "enabled" : true
+    "logout": {
+      "enabled": true
     },
     "revocation": {
       "token_family": {
@@ -191,6 +203,10 @@
   "group": {
     "store": "composite"
   },
+  "scim": {
+    "core_attrs_on_get": false,
+    "core_user_type_id": "01900000-0000-7000-8000-000000000010"
+  },
   "declarative_resources": {
     "enabled": false
   },

backend/cmd/server/config/default.json

@@ -78,3 +78,6 @@ email:
     from_address: "noreply@thunderid.dev"
     enable_start_tls: false
     enable_authentication: true
+
+gate_client:
+  port: 5190

backend/cmd/server/deployment.yaml

@@ -70,6 +70,8 @@ import (
 	"github.com/thunder-id/thunderid/internal/resource"
 	"github.com/thunder-id/thunderid/internal/role"
 	"github.com/thunder-id/thunderid/internal/runtimestore"
+	"github.com/thunder-id/thunderid/internal/scim"
+	scimconfig "github.com/thunder-id/thunderid/internal/scim/config"
 	"github.com/thunder-id/thunderid/internal/serverconfig"
 	"github.com/thunder-id/thunderid/internal/system/cache"
 	"github.com/thunder-id/thunderid/internal/system/cmodels"
@@ -208,6 +210,15 @@ func registerServices(mux *http.ServeMux, cacheManager cache.CacheManagerInterfa
 	fatalOnError(ctx, logger, err, "Failed to initialize Resource Service")
 	exporters = append(exporters, resourceExporter)
 
+	// Initialize SCIM service.
+	scim.Initialize(
+		mux,
+		userService,
+		entityTypeService,
+		groupService,
+		scimconfig.FromServerRuntime(),
+	)
+
 	roleService, roleAssignmentService, ouRoleResolver, roleExporter, err := role.Initialize(
 		mux, entityService, groupService, ouService, resourceService, entityTypeService, ouAuthzService,
 	)