Laravel Scim Server Laravel Package

Product Decisions This Supports

• Enterprise SSO/identity roadmap: limosa-io/laravel-scim-server gives a Laravel app a SCIM 2.0 endpoint surface (Users, Groups, PATCH, filter) so IdPs like Okta, Entra ID, OneLogin, or Google Workspace can push provisioning changes automatically. This unblocks the "directory sync" line item that enterprise buyers routinely gate contracts on.
• Automated onboarding/offboarding: enables just-in-time account creation on hire and, more importantly, deterministic deprovisioning on termination — a recurring audit finding and a SOC 2 / ISO 27001 access-review control.
• Group-to-role mapping: SCIM Groups lets you drive RBAC from IdP groups instead of hand-maintained role tables, reducing admin tooling and support load.
• Build vs. buy: a legitimate third option between (a) building SCIM from scratch (SCIM's filter grammar, PATCH semantics, and pagination are deceptively fiddly) and (b) paying a per-MAU identity vendor (WorkOS, Auth0/Okta, FusionAuth, Descope). Self-hosting inside the existing Laravel stack avoids a second source of truth for users and sidesteps per-seat pricing.
• Security posture of the dependency: v1.5.3 groups OR filter terms so they cannot escape base query constraints. In practice this closes a class of bug where a crafted filter in a SCIM list request could widen results beyond the intended tenant/scope. For a PM this is a security-relevant patch — treat it as a forced upgrade, not an optional one, and confirm the upstream project treats filter injection as a security boundary before you rely on it for tenant isolation.

When to Consider This Package

Consider adopting when:

• You have a Laravel application and want SCIM without introducing a separate identity service or a second user store.
• You are losing or blocked on enterprise/upper-mid-market deals whose security questionnaires ask for "SCIM 2.0 provisioning" or "automated deprovisioning."
• Your team can own a self-hosted dependency: read the source, pin versions, track advisories, and patch within your normal release cadence.
• You need provisioning specifically — not a full IdP. You already have SAML/OIDC auth and only lack the write-side sync.
• Your authorization model can be expressed as base query scopes (per-tenant, per-organization) that the SCIM layer must not let filters escape — the exact thing v1.5.3 hardens.
• You want to avoid per-MAU identity pricing at a scale where it becomes material.

Look elsewhere when:

• You are not on Laravel, or are on an old Laravel/PHP version the package doesn't track.
• You need a vendored, SLA-backed, SOC 2-attested identity product with support contracts — buy instead; a community package will not satisfy a procurement security review on its own.
• You need SCIM plus SAML/OIDC/MFA/Lifecycle in one supported bundle — a platform is a better fit than assembling packages.
• Nobody owns dependency security. A package that handles identity provisioning is high-blast-radius; unpatchable drift is a real risk.
• Your schema is far from SCIM's canonical User/Group model and would require heavy attribute mapping you'd have to maintain forever.
• You need outbound sync (you as the source of truth pushing to downstream apps) rather than inbound IdP-driven provisioning.

How to Pitch It (Stakeholders)

For executives: We can close the "automated user provisioning" gap that shows up in enterprise security reviews without buying a per-seat identity platform. This package adds SCIM 2.0 endpoints to our existing Laravel app, so Okta/Entra can create, update, and — critically — deactivate accounts automatically. That removes a manual offboarding step that is both a support cost and an audit exposure. The trade-off is that we self-host and self-patch it rather than paying for a supported vendor, so we need a named owner for dependency updates.

For engineering: It's a Laravel-native SCIM 2.0 server — routes, controllers, resource models, filter parsing — that slots into our existing auth and middleware rather than running beside it. v1.5.3 is a targeted security fix: OR filter terms are now grouped so a client-supplied SCIM filter can't escape the base query constraints. Wire it so every SCIM query is scoped through our tenant/organization constraint at the query-builder level, add regression tests that fire adversarial filter strings (nested ORs, and/or precedence tricks) at list endpoints, and pin the version with an advisory-watch process. Also budget for SCIM conformance testing against each target IdP — implementations differ on PATCH and filtering, and "works with Okta" does not imply "works with Entra."

Ask: approve a spike (1–2 sprints) to integrate against a single IdP, with upgrade to ≥ v1.5.3 as a hard requirement and a tenant-isolation test suite as the exit criterion.