Adding EntraID SCIM Function

[julialawrence]

Tracking stories:

• 🛂 POC integration with Identity Center and EntraID in the AP UI analytical-platform#4271
• 🪪 Complete Identity Center Integration With EntraID to Reach Transitional State analytical-platform#4838

Description:

This PR merges the feature/add-entra-id-scim-function branch into the main branch. The branch introduces a Python script that automates the synchronsation of EntraID groups and their members with AWS Identity Center. This functionality ensures consistency between EntraID and AWS Identity Center, streamlining user and group management across these platforms.

What it does:

• Fetch EntraID Groups: Retrieves EntraID groups prefixed with a specific string (azure-aws-sso- by default).
• Fetch EntraID Group Members: Obtains the members and admins of each EntraID group.
• Sync with AWS Identity Center:
  • Adds or updates AWS Identity Center groups and their memberships to match EntraID.
  • Deletes AWS Identity Center groups that no longer exist in EntraID.
  • Removes users from AWS Identity Center groups if they no longer exist in the corresponding EntraID groups.
  • Deletes orphaned AWS users who are not members of any relevant groups.
• Logging and Dry-Run Mode: Includes comprehensive logging for monitoring and debugging, with an option to perform a "dry run" to simulate actions without making actual changes.

Tests Included:

1. Unit Tests:

   • Located in function/tests/unit/
   • Test files include:
     • test_aws_functions.py: Tests AWS-specific operations.
     • test_azure_functions.py: Tests EntraID-specific operations.
     • test_member_syncing.py: Tests the member sync logic.
   • Ensure that core functionalities, such as token retrieval, group fetching, and user management, work as expected.

2. Integration Tests:

   • Located in function/tests/integration/
   • Test files include:
     • test_sync_function_integration_test.py: Verifies end-to-end sync between EntraID and AWS Identity Center.
   • Test scenarios involving creation, deletion, and modification of groups and users to ensure group memberships and users are consistent between Azure and AWS.

Instructions for Running Tests:

1. Install Prerequisites:

Ensure you have Python installed (version 3.6 or later is recommended).

To run the tests using the unittest framework, which is included with Python, you need to install the required dependencies listed in requirements-dev.txt. Run the following command to install them:

pip install -r requirements-dev.txt

This command will install all necessary libraries, including:

• boto3: AWS SDK for Python to interact with AWS services.
• requests: To make HTTP requests to EntraID.
• Other dependencies specified in the requirements-dev.txt file.

2. Set Up Environment Variables:

Before running the script or tests, set up the required environment variables:

• AZURE_TENANT_ID: EntraID Tenant ID
• AZURE_CLIENT_ID: EntraID Application (client) ID
• AZURE_CLIENT_SECRET: EntraID Application Secret
• LOG_LEVEL: (Optional) Logging level (default: INFO)

You can export these variables in your terminal:

export AZURE_TENANT_ID="your-tenant-id"
export AZURE_CLIENT_ID="your-client-id"
export AZURE_CLIENT_SECRET="your-client-secret"
export LOG_LEVEL="INFO"

3. Run Unit Tests:

Execute unit tests using Python's built-in unittest framework:

python -m unittest discover function/tests/unit

This command will discover and run all unit tests located in the tests/unit/ directory.

4. Run Integration Tests:

Execute integration tests using unittest:

python -m unittest discover function/tests/integration

This command will discover and run all integration tests located in the tests/integration/ directory.

5. Run All Tests:

To run both unit and integration tests, use the following commands:

python -m unittest discover function/tests/unit
python -m unittest discover function/tests/integration

This command will discover and run all integration tests located in the tests/integration/ directory.

Alternatively, to run all tests at once:

python -m unittest discover function/tests

Additional Notes:

• Logging: The script uses customisable logging because the out-of-the-box setup didn't properly flush the output on the developer's machine.
• Dry Run Mode: If you have required permissions to run the script directly, dry_run is set to True by default and if looking to apply changes, it needs to be set to False explicitly.

[Gary-H9]

LGTM