OIDC and SCIM bridges
Connect external identity systems while supplying required production identity hooks.
OIDC and SCIM bridge implementations live under openagent-sdk/bridges, with separate Rust and TypeScript packages. They connect enterprise identity/provisioning concepts to OpenAgent identity APIs; they do not automatically establish a trusted issuer or production signing authority.
OIDC integration
Start with the provider's issuer, audience, key-discovery, nonce/state, and token-validation contract. Map validated external claims into the intended OAS entity/tenant policy. The TypeScript mapping.ts source explicitly defers production identity key creation; supply the real identity/signing hook before using it for authority-bearing identities.
SCIM integration
Map provisioning and deprovisioning to the application's tenant/account lifecycle. The TypeScript provisioner contains an identity-generation boundary that must be connected to production keys. Do not treat a created local record or deterministic placeholder as cryptographic proof of identity.
Integration sequence
- Pin the bridge and external-provider configuration.
- Implement the required identity/key callbacks with the correct tenant boundary.
- Validate inbound assertions before mapping identity fields.
- Exercise disabled users, revoked access, missing claims, duplicate external IDs, and key rotation.
- Verify resulting OAS/authority state through the actual configured verifier.
See the library catalog for source paths, manifests, and public entry points. Bridge scaffolding and protocol model coverage are not claims of a hosted enterprise provider.