SCIM Plugin#

The @better-auth/scim package is a Better Auth plugin that implements RFC 7644 (SCIM 2.0) provisioning. It exposes a /scim/v2/ API surface that identity providers (Okta, Azure AD, etc.) can use to create, read, update, and delete users directly against a Better Auth deployment.

Package entry point: packages/scim/src/index.ts
All routes: packages/scim/src/routes.ts

Endpoints#

Registered capabilities: patch ✓, filter ✓, bulk ✗, sort ✗, changePassword ✗ 1.

All SCIM routes are authenticated via a Bearer token tied to a scimProvider row. Tokens are minted by POST /scim/generate-token (requires an active session and the admin or owner org role by default) 2. The scimProvider schema adds providerId, scimToken, and optionally organizationId and userId fields 3.

GET /scim/v2/Users — Known Issues (open as of 2026-07-14)#

This endpoint has three confirmed RFC 7644 compliance violations, reported in issue #10398.

1. Silent result truncation at 100 rows#

listSCIMUsers calls adapter.findMany on both the account and user models without passing a limit 4. The adapter factory applies a default limit of options.advanced?.database?.defaultFindManyLimit ?? 100 whenever no explicit limit is provided 5. On deployments with more than 100 SCIM-provisioned users, only the first 100 rows are returned.

2. Incorrect totalResults#

The response sets totalResults to users.length — the count of the already-truncated result set — not the true total 6. RFC 7644 §3.4.2 (REQUIRED field) states: "The value may be larger than the number of resources returned, such as when returning a single page of results."

3. Missing startIndex and count query parameters#

The query schema only accepts filter 7. The startIndex and count pagination parameters defined in RFC 7644 §3.4.2.4 are absent — passing them has no effect.

Real-world consequence: A SCIM client observes totalResults == Resources.length == itemsPerPage and correctly concludes it has fetched all results, then treats users beyond position 100 as deleted in the provisioning system 8.

Workaround (until fixed)#

Raise defaultFindManyLimit to prevent truncation. This does not fix the wrong totalResults or add real pagination:

export const auth = betterAuth({
  advanced: {
    database: {
      defaultFindManyLimit: 10000,
    },
  },
});

Suggested fix#

1. Add startIndex (z.coerce.number().min(1).default(1)) and count (z.coerce.number().min(0).optional()) to listSCIMUsersQuerySchema.
2. Fetch all matching account IDs without a limit to obtain the true totalResults.
3. Apply count as limit and startIndex - 1 as offset to the paginated user query.
4. Return the real account count as totalResults and the actual page size as itemsPerPage 8.

Other Implementation Notes#

• Filtering: The filter query param on GET /scim/v2/Users is parsed by scim-filters.ts. Only the eq operator is implemented despite the regex matching eq, ne, co, sw, ew, pr. The SCIM attribute userName maps to the DB email field.

• Deactivation: active: false maps to the admin plugin's banned field. Setting active: false without the admin plugin throws a 400 9.

• Organization scope: When a token carries an organizationId, DELETE /scim/v2/Users/:id removes the org membership and SCIM account link only — it does not delete the global user 10.

• Linking existing users: Auto-linking a pre-existing user by email alone is blocked unless opts.linkExistingUsers is explicitly configured 11.

• Provider ownership: providerOwnership.enabled is false by default pending a schema migration in a future next-minor release 12.

Key Source Files#