From ac7a411c539432036954ee14477ab967e6bdbc65 Mon Sep 17 00:00:00 2001
From: colin-stuart <colindonstuart@gmail.com>
Date: Thu, 10 Jul 2025 09:18:30 -0500
Subject: [PATCH] SCIM: Update allow non-provisioned users dynamic config field
 (#107912)

SCIM: add dynamic non-provisioned users allowed setting
---
 pkg/services/scimutil/scim_util.go      | 14 +++++---------
 pkg/services/scimutil/scim_util_test.go |  9 ++++-----
 2 files changed, 9 insertions(+), 14 deletions(-)

diff --git a/pkg/services/scimutil/scim_util.go b/pkg/services/scimutil/scim_util.go
index 022277ba994..92d0ac74270 100644
--- a/pkg/services/scimutil/scim_util.go
+++ b/pkg/services/scimutil/scim_util.go
@@ -83,11 +83,7 @@ func (s *SCIMUtil) fetchDynamicSCIMSetting(ctx context.Context, orgID int64, set
 	case "group":
 		enabled = scimConfig.EnableGroupSync
 	case "allowNonProvisionedUsers":
-		if scimConfig.AllowNonProvisionedUsers != nil {
-			enabled = *scimConfig.AllowNonProvisionedUsers
-		} else {
-			enabled = false
-		}
+		enabled = scimConfig.AllowNonProvisionedUsers
 	default:
 		s.logger.Error("Invalid setting type provided to fetchDynamicSCIMSetting", "settingType", settingType)
 		return false, false
@@ -112,9 +108,9 @@ func (s *SCIMUtil) getOrgSCIMConfig(ctx context.Context, orgID int64) (*SCIMConf
 
 // SCIMConfigSpec represents the spec part of a SCIMConfig resource
 type SCIMConfigSpec struct {
-	EnableUserSync           bool  `json:"enableUserSync"`
-	EnableGroupSync          bool  `json:"enableGroupSync"`
-	AllowNonProvisionedUsers *bool `json:"allowNonProvisionedUsers,omitempty"`
+	EnableUserSync           bool `json:"enableUserSync"`
+	EnableGroupSync          bool `json:"enableGroupSync"`
+	AllowNonProvisionedUsers bool `json:"allowNonProvisionedUsers"`
 }
 
 // unstructuredToSCIMConfig converts an unstructured object to a SCIMConfigSpec
@@ -139,6 +135,6 @@ func (s *SCIMUtil) unstructuredToSCIMConfig(obj *unstructured.Unstructured) (*SC
 	return &SCIMConfigSpec{
 		EnableUserSync:           enableUserSync,
 		EnableGroupSync:          enableGroupSync,
-		AllowNonProvisionedUsers: &allowNonProvisionedUsers,
+		AllowNonProvisionedUsers: allowNonProvisionedUsers,
 	}, nil
 }
diff --git a/pkg/services/scimutil/scim_util_test.go b/pkg/services/scimutil/scim_util_test.go
index 2e371d32fd8..0e9d3b39ee5 100644
--- a/pkg/services/scimutil/scim_util_test.go
+++ b/pkg/services/scimutil/scim_util_test.go
@@ -13,7 +13,6 @@ import (
 	"github.com/grafana/grafana/pkg/services/apiserver/client"
 	"github.com/grafana/grafana/pkg/services/user"
 	"github.com/grafana/grafana/pkg/storage/unified/resourcepb"
-	"github.com/grafana/grafana/pkg/util"
 )
 
 // MockK8sHandler is a mock implementation of client.K8sHandler for testing
@@ -573,7 +572,7 @@ func TestSCIMUtil_unstructuredToSCIMConfig(t *testing.T) {
 			expectedSpec: SCIMConfigSpec{
 				EnableUserSync:           true,
 				EnableGroupSync:          true,
-				AllowNonProvisionedUsers: util.Pointer(false),
+				AllowNonProvisionedUsers: false,
 			},
 		},
 		{
@@ -582,7 +581,7 @@ func TestSCIMUtil_unstructuredToSCIMConfig(t *testing.T) {
 			expectedSpec: SCIMConfigSpec{
 				EnableUserSync:           false,
 				EnableGroupSync:          false,
-				AllowNonProvisionedUsers: util.Pointer(false),
+				AllowNonProvisionedUsers: false,
 			},
 		},
 		{
@@ -591,7 +590,7 @@ func TestSCIMUtil_unstructuredToSCIMConfig(t *testing.T) {
 			expectedSpec: SCIMConfigSpec{
 				EnableUserSync:           true,
 				EnableGroupSync:          false,
-				AllowNonProvisionedUsers: util.Pointer(false),
+				AllowNonProvisionedUsers: false,
 			},
 		},
 		{
@@ -600,7 +599,7 @@ func TestSCIMUtil_unstructuredToSCIMConfig(t *testing.T) {
 			expectedSpec: SCIMConfigSpec{
 				EnableUserSync:           false,
 				EnableGroupSync:          false,
-				AllowNonProvisionedUsers: util.Pointer(true),
+				AllowNonProvisionedUsers: true,
 			},
 		},
 		{