scim-outline-adapter: SCIM provisioning for self-hosted Outline

[acul021]

I needed SCIM provisioning for our self-hosted Outline (SCIM is planned for Outline itself, but not for the community edition), so I wrote a small adapter:

https://github.com/acul021/scim-outline-adapter

It's a single Go binary that exposes a SCIM 2.0 API and translates the requests to Outline's REST API. You point your IdP's SCIM provider at it and users, groups and memberships end up in Outline.

Some notes on how it behaves:

• users are created through users.invite, without sending invite mails by default (people claim the account on first SSO login via email match). Deprovisioning suspends instead of deleting.
• groups map 1:1 to Outline groups, so you can use them for collection permissions
• team roles (admin/member/viewer) are derived from group membership, configurable via env (ROLE_MAP_ADMIN=Admins etc.)
• no database, no state. SCIM ids are the Outline UUIDs, and existing users/groups get adopted by email/name, so you can point it at an instance that already has users.

Container image is on ghcr (ghcr.io/acul021/scim-outline-adapter), config is three env vars plus the role mapping. I run it as a sidecar in the same compose stack as Outline, routed at /scim/v2 through the reverse proxy so it doesn't need its own domain.

We use it with authentik, but there's nothing authentik-specific in it. If your IdP speaks SCIM 2.0 it should work - if not, open an issue.

One thing I ran into: Outline's rate limiter kicks in when you bulk-create groups. The adapter retries with Retry-After but gives up eventually, so either sync slowly or set RATE_LIMITER_ENABLED=false.

MIT licensed.