README

SCIM 2.0 Server implementation for Laravel

Add SCIM 2.0 Server capabilities to your Laravel application with ease. This package requires minimal configuration to get started with the core SCIM flows and is powering The SCIM Playground, one of the most widely tested SCIM servers available.

Why Laravel SCIM Server?

• Battle-tested with real-world providers through the SCIM Playground
• Familiar Laravel tooling and middleware integration
• Fully extensible configuration for resources, attributes, and filtering
• Ships with dockerized demo and an expressive test suite

Table of contents

• Quick start
• Installation
• SCIM routes
• Configuration
• Security & app integration
• Test server
• Contributing & support

Quick start

Spin up a SCIM test server in seconds:

docker run -d -p 8000:8000 --name laravel-scim-server ghcr.io/limosa-io/laravel-scim-server:latest

Visit http://localhost:8000/scim/v2/Users (or /Groups, /Schemas, /ResourceTypes, etc.) to exercise the API.

Installation

Add the package to your Laravel app:

composer require arietimmerman/laravel-scim-server

Optionally publish the config for fine-grained control:

php artisan vendor:publish --tag=laravel-scim

If you need to add SCIM-specific columns (formatted, active, roles) to your users table, publish the migrations:

php artisan vendor:publish --tag=laravel-scim-migrations
php artisan migrate

Note: These migrations are optional. Only publish them if your SCIM implementation requires these specific fields in your users table.

SCIM routes

Optional "Me" routes can be enabled separately:

Configuration

The SCIM server can be customized using configuration options in config/scim.php:

return [
    // Base path for all SCIM routes
    'path' => env('SCIM_BASE_PATH', '/scim'),

    // Optional domain to restrict SCIM endpoints to
    'domain' => env('SCIM_DOMAIN', null),

    // Middleware for protected routes (resource operations)
    'middleware' => env('SCIM_MIDDLEWARE', []),

    // Middleware for public routes (ServiceProviderConfig, Schemas, ResourceTypes)
    'public_middleware' => env('SCIM_PUBLIC_MIDDLEWARE', []),

    // Omit the main schema namespace from resource responses
    'omit_main_schema_in_return' => env('SCIM_OMIT_MAIN_SCHEMA_IN_RETURN', false),
    
    // Omit attributes with null values from responses
    'omit_null_values' => env('SCIM_OMIT_NULL_VALUES', true),
];

You can override these in your .env file:

SCIM_BASE_PATH=/scim/api
SCIM_MIDDLEWARE=api,auth:sanctum
SCIM_PUBLIC_MIDDLEWARE=api
SCIM_OMIT_MAIN_SCHEMA_IN_RETURN=true
SCIM_OMIT_NULL_VALUES=false

Or pass as Docker environment variables:

docker run -e SCIM_BASE_PATH=/scim/api \
           -e SCIM_OMIT_MAIN_SCHEMA_IN_RETURN=true \
           -e SCIM_OMIT_NULL_VALUES=false \
           -p 8000:8000 \
           ghcr.io/limosa-io/laravel-scim-server:latest

If you need more control, you can disable route auto-publishing and register the routes manually:

// config/scim.php
return [
    'publish_routes' => false,
    // other config...
];

// In your RouteServiceProvider or a custom service provider:
ArieTimmerman\Laravel\SCIMServer\RouteProvider::routes([
    'path' => '/custom-scim',
    'domain' => 'api.example.com',
    'middleware' => ['api', 'auth:api', 'scoped-tokens'],
    'public_middleware' => ['api', 'rate-limit'],
]);

Resource Configuration

The package resolves configuration via SCIMConfig::class. Extend it to tweak resource definitions, attribute mappings, filters, or pagination defaults.

Register your custom config in app/Providers/AppServiceProvider.php:

$this->app->singleton(
    \ArieTimmerman\Laravel\SCIMServer\SCIMConfig::class,
    YourCustomSCIMConfig::class
);

Minimal override example:

<?php

class YourCustomSCIMConfig extends \ArieTimmerman\Laravel\SCIMServer\SCIMConfig
{
    public function getUserConfig()
    {
        $config = parent::getUserConfig();

        // Customize $config as needed.

        return $config;
    }
}

Pagination settings

Cursor-based pagination is enabled by default via the SCIM cursor pagination draft. Publish the config file and update config/scim.php to adjust defaults:

'pagination' => [
    'defaultPageSize' => 10,
    'maxPageSize' => 100,
    'cursorPaginationEnabled' => false,
]

Security & app integration

SCIM grants the ability to view, add, update, and delete users or groups. Make sure you secure the routes before shipping to production.

You have two approaches to securing your SCIM endpoints:

Option 1: Configure middleware via config

The simplest approach is to set middleware in your config:

// config/scim.php
return [
    'middleware' => ['api', 'auth:sanctum'], // For protected resource routes
    'public_middleware' => ['api'],          // For schema/discovery endpoints
];

Or via environment variables:

SCIM_MIDDLEWARE=api,auth:sanctum
SCIM_PUBLIC_MIDDLEWARE=api

Option 2: Manual route registration

For more control, disable automatic route publishing:

// config/scim.php
return [
    'publish_routes' => false,
];

Then re-register the routes with your preferred middleware and configuration:

use ArieTimmerman\Laravel\SCIMServer\RouteProvider as SCIMServerRouteProvider;

SCIMServerRouteProvider::publicRoutes([
    'path' => '/scim',
    'middleware' => ['api'],
]);

Route::middleware('auth:api')->group(function () {
    SCIMServerRouteProvider::routes([
        'path' => '/scim',
        'middleware' => ['custom-scim-check'],
        'public_routes' => false,
    ]);

    SCIMServerRouteProvider::meRoutes();
});

Test server

Bring up the full demo stack with Docker Compose:

docker-compose up

Browse to http://localhost:18123/scim/v2/Users to explore the API and run the test suite.

Contributing & support

• Issues and pull requests are welcome on GitHub
• Found this package helpful? Give it a star on GitHub so others can discover it faster
• If you would like to support this module, please buy a Pro subscription on SCIM Playground