new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

Better Auth · Plugins · all subjects

scim/configuration

8 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

SCIM token provider restriction

A SCIM token is always restricted to a provider and the providerId must be specified. It can be any provider the instance supports, such as built-in providers like credentials or external providers from plugins like @better-auth/sso.

SCIM default token configuration

A default SCIM token can be configured for testing without setting up providers in the database. Configure via defaultSCIM option with an array of objects containing providerId, scimToken, and optional organizationId.

SCIM token base64 encoding requirement

SCIM tokens must be base64 encoded in the format base64(scimToken:providerId[:organizationId]) before use. For example, encoding 'some-scim-token:default-scim:the-org' results in 'c29tZS1zY2ltLXRva2VuOmRlZmF1bHQtc2NpbTp0aGUtb3Jn'.

SCIM provider connection ownership feature

Provider connection ownership tracks who generated a connection and restricts later management operations to the same user for personal connections. Enable via scim({ providerOwnership: { enabled: true } }). When enabled, requires a database migration.

SCIM provider ownership behavior

When provider ownership is enabled, personal connections store the creating user's userId and only the owner can regenerate, list, inspect, or delete those personal connections. Organization-scoped connections continue to use organization role checks configured by requiredRole.

SCIM attribute mapping configuration

By default, SCIM provisioning automatically maps: user.email to user's primary email or first available email; user.name derived from name.formatted or name.givenName + name.familyName, falling back to user primary email; account.providerId to provider associated with the SCIM token; account.accountId defaults to externalId and falls back to userName; member.organizationId to organization associated with the provider.

SCIM active attribute mapping

The SCIM active attribute maps to the user's disabled state. active: false deactivates the user via the admin plugin's banned state and revokes their sessions; active: true reactivates the user. Honoring the active attribute requires the admin plugin to be enabled.

SCIM email change behavior

Changing a user's email through SCIM resets their verified status.

Give your agent this brain