prep different oauth mode

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

Author: BeryJu

authentik/enterprise/providers/scim/api.py

@@ -8,7 +8,10 @@
 class SCIMProviderSerializerMixin:
 
     def validate_auth_mode(self, auth_mode: SCIMAuthenticationMode) -> SCIMAuthenticationMode:
-        if auth_mode == SCIMAuthenticationMode.OAUTH:
+        if auth_mode in [
+            SCIMAuthenticationMode.OAUTH_SILENT,
+            SCIMAuthenticationMode.OAUTH_INTERACTIVE,
+        ]:
             if not LicenseKey.cached_summary().status.is_valid:
                 raise ValidationError(_("Enterprise is required to use the OAuth mode."))
         return auth_mode

authentik/enterprise/providers/scim/signals.py

@@ -14,7 +14,10 @@ def scim_provider_post_save(sender: type[Model], instance: SCIMProvider, created
     """Create service account before provider is saved"""
     identifier = f"ak-providers-scim-{instance.pk}"
     with audit_ignore():
-        if instance.auth_mode == SCIMAuthenticationMode.OAUTH:
+        if instance.auth_mode in [
+            SCIMAuthenticationMode.OAUTH_SILENT,
+            SCIMAuthenticationMode.OAUTH_INTERACTIVE,
+        ]:
             user, user_created = User.objects.update_or_create(
                 username=identifier,
                 defaults={

authentik/enterprise/providers/scim/tests.py

@@ -42,7 +42,7 @@ def setUp(self) -> None:
         self.provider = SCIMProvider.objects.create(
             name=generate_id(),
             url="https://localhost",
-            auth_mode=SCIMAuthenticationMode.OAUTH,
+            auth_mode=SCIMAuthenticationMode.OAUTH_SILENT,
             auth_oauth=self.source,
             auth_oauth_params={
                 "foo": "bar",

authentik/providers/scim/migrations/0020_alter_scimprovider_auth_mode.py

@@ -0,0 +1,34 @@
+# Generated by Django 5.2.14 on 2026-05-05 22:11
+
+from django.db import migrations, models
+from django.apps.registry import Apps
+
+from django.db.backends.base.schema import BaseDatabaseSchemaEditor
+
+def update_oauth(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
+    db_alias = schema_editor.connection.alias
+
+    SCIMProvider = apps.get("authentik_providers_scim", "scimprovider")
+
+    SCIMProvider.objects.using(db_alias).filter(auth_mode="oauth").update(auth_mode="oauth_silent")
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_providers_scim", "0019_scimprovider_group_filters_and_more"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="scimprovider",
+            name="auth_mode",
+            field=models.TextField(
+                choices=[
+                    ("token", "Token"),
+                    ("oauth_silent", "OAuth (Silent)"),
+                    ("oauth_interactive", "OAuth (interactive)"),
+                ],
+                default="token",
+            ),
+        ),
+    ]

authentik/providers/scim/models.py

@@ -72,7 +72,8 @@ class SCIMAuthenticationMode(models.TextChoices):
     """SCIM authentication modes"""
 
     TOKEN = "token", _("Token")
-    OAUTH = "oauth", _("OAuth")
+    OAUTH_SILENT = "oauth_silent", _("OAuth (Silent)")
+    OAUTH_INTERACTIVE = "oauth_interactive", _("OAuth (interactive)")
 
 
 class SCIMCompatibilityMode(models.TextChoices):
@@ -144,7 +145,10 @@ class SCIMProvider(OutgoingSyncProvider, BackchannelProvider):
     )
 
     def scim_auth(self) -> AuthBase:
-        if self.auth_mode == SCIMAuthenticationMode.OAUTH:
+        if self.auth_mode in [
+            SCIMAuthenticationMode.OAUTH_SILENT,
+            SCIMAuthenticationMode.OAUTH_INTERACTIVE,
+        ]:
             try:
                 from authentik.enterprise.providers.scim.auth_oauth2 import SCIMOAuthAuth
 

blueprints/schema.json

@@ -11203,7 +11203,8 @@
                     "type": "string",
                     "enum": [
                         "token",
-                        "oauth"
+                        "oauth_silent",
+                        "oauth_interactive"
                     ],
                     "title": "Auth mode"
                 },

packages/client-ts/src/models/SCIMAuthenticationModeEnum.ts

@@ -54864,7 +54864,8 @@ components:
     SCIMAuthenticationModeEnum:
       enum:
       - token
-      - oauth
+      - oauth_silent
+      - oauth_interactive
       type: string
     SCIMMapping:
       type: object

schema.yml

@@ -92,7 +92,8 @@ export function renderAuth(provider?: Partial<SCIMProvider>, errors: ValidationE
         default:
         case SCIMAuthenticationModeEnum.Token:
             return renderAuthToken(provider, errors);
-        case SCIMAuthenticationModeEnum.Oauth:
+        case SCIMAuthenticationModeEnum.OauthSilent:
+        case SCIMAuthenticationModeEnum.OauthInteractive:
             return renderAuthOAuth(provider, errors);
     }
 }
@@ -160,12 +161,18 @@ export function renderForm({ provider, errors, update }: SCIMProviderFormProps)
                                 )}`,
                             },
                             {
-                                label: msg("OAuth"),
-                                value: SCIMAuthenticationModeEnum.Oauth,
-                                default: true,
+                                label: msg("OAuth (Silent)"),
+                                value: SCIMAuthenticationModeEnum.OauthSilent,
                                 description: html`${msg("Authenticate SCIM requests using OAuth.")}
                                     <ak-license-notice></ak-license-notice>`,
                             },
+                            {
+                                label: msg("OAuth (Interactive)"),
+                                value: SCIMAuthenticationModeEnum.OauthInteractive,
+                                description: html`${msg(
+                                        "Authenticate SCIM requests using OAuth, interactively authorized.",
+                                    )} <ak-license-notice></ak-license-notice>`,
+                            },
                         ]}
                     ></ak-radio>
                 </ak-form-element-horizontal>