fix(scim): sync provider display names and document Okta setup

[waleedlatif1]

Summary

• Sync explicit SCIM display names to Sim accounts, repair stale account names on retries, and preserve name-part updates for existing records.
• Keep optional display names out of responses when omitted and use formatted names as the group-member fallback.
• Add a nested Okta provisioning guide with redacted setup screenshots and expand real HTTP/PostgreSQL regression coverage.

Type of Change

• Bug fix

Testing

• 259 SCIM unit tests and 12 PostgreSQL regressions passed.
• 17 real HTTP scenarios passed across 114 requests, including name drift, access projection, membership guards, lifecycle, and credentials.
• Live Okta: credential testing, user provisioning/update/deactivation/reactivation, group push and rename, workspace grant/removal/restoration, reconciliation, rotation, and downstream group deletion.
• Lint, application/docs type checks, 46 audits, generated artifacts, and migration safety passed. No physical database migration; no live Entra or SSO-login validation claimed.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 8, 2026 4:42am UTC

[greptile-apps]

Greptile Summary

This PR updates SCIM name handling so explicit provider display names are projected to Sim accounts while preserving structured-name fallbacks and repairing account-name drift.

• Tracks whether a display name was explicitly supplied by the SCIM provider.
• Keeps omitted display names out of SCIM responses and improves group-member name fallback.
• Adds regression coverage for provisioning, updates, retries, and account drift.
• Adds a nested Okta provisioning guide and corresponding generated documentation entry.

Confidence Score: 5/5

The PR appears safe to merge; no actionable correctness, security, or repository-rule violations were identified.

The new display-name provenance logic preserves legacy formatted-name projection, explicit provider names are synchronized consistently across provisioning and updates, retries converge without repeated writes, and the nested documentation paths follow the repository’s manifest-folding convention.

Important Files Changed

Filename	Overview
apps/sim/ee/scim/lib/protocol/canonical.ts	Distinguishes explicit provider display names from formatted-name fallbacks and centralizes account-name selection.
apps/sim/ee/scim/lib/protocol/user-patch.ts	Maintains display-name provenance during PATCH operations and avoids synthesizing optional display names.
apps/sim/ee/scim/lib/application/users/update-user.ts	Synchronizes the preferred SCIM name against the live account name and repairs drift on otherwise identical retries.
apps/sim/ee/scim/lib/application/users/provision-user.ts	Uses the canonical account-name selection when creating or relinking provisioned identities.
apps/sim/ee/scim/lib/protocol/resources.ts	Omits absent optional display names from SCIM user responses.
apps/sim/ee/scim/lib/repository/groups.ts	Falls back from member display names to formatted names and then usernames.
packages/db/schema.ts	Extends stored SCIM attributes with optional display-name provenance without requiring a physical schema migration.
apps/docs/content/docs/platform/enterprise/scim/okta.mdx	Adds a detailed Okta provisioning, lifecycle, group-push, rotation, and troubleshooting guide.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[SCIM user payload] --> B[Canonicalize attributes]
    B --> C{Explicit displayName supplied?}
    C -->|Yes| D[Store displayName with provider source]
    C -->|No| E[Keep displayName absent]
    D --> F[accountName uses displayName]
    E --> G[accountName uses name.formatted]
    F --> H[Compare with live Sim account name]
    G --> H
    H -->|Different| I[Synchronize account identity]
    H -->|Same| J[Skip identity write]
    B --> K[Render SCIM resource]
    K --> L[Return displayName only when stored]

Loading

_{Reviews (1): Last reviewed commit: "fix(scim): sync provider display names a..." | Re-trigger Greptile}