SCIM group mapping for Bitwarden

[Fly7113]

Describe your question
I am trying to include a members attribute in a custom SCIM group mapping.
While having a look at Bitwarden's documentation about SCIM I noticed that the group mapping requires a members attribute in the form of an array of user objects.
So, if I interpreted correctly the documentation, I need to retrieve several user information (email, username, display name, active status) for each member of the Authentik group to include in each one of the objects of the members array.

Has anyone had any luck in setting up this SCIM integration with Bitwarden, or has some clue on how I could make it work? Thanks.

Version and Deployment:

• authentik version: 2025.10.0
• Deployment: docker-compose

[dewi-tik]

The custom SCIM group property mapping can include an expression similar to this:

return {
    "members": [user.username for user in group.users.all()]
}

The Bitwarden documentation isn't very clear on exactly what it expects the members array to include. You could try the above and modify it based on the logs from Bitwarden. Or contact their support team to confirm exactly what the members array should contain.

[Fly7113]

In the end I made it work with the following custom mapping for groups:

return {
    "displayName": group.name,
    "members": [
      {
        "userName": user.email,
        "displayName": user.name,
        "active": user.is_active,
        "emails": [{
          "value": user.email,
          "primary": True,
        }],
      } for user in group.users.all()],
  "externalId": group.name,
}

I ended up creating an object similar to the object from the user mapping, but probably the object must contain only the fields marked as mandatory in the Bitwarden documentation (I have not tested this theory).

If anyone is wondering, my mapping for the users looks like this:

return {
    "userName": request.user.email,
    "displayName": request.user.name,
    "active": request.user.is_active,
    "emails": [{
        "value": request.user.email,
        "primary": True,
    }],
    "externalId": request.user.email,
}

[dewi-tik]

Thanks for sharing those @Fly7113!

I'll look to create an integration document for Bitwarden SCIM. If possible, could you please provide details on any setup that was required in Bitwarden? Screenshots of your configuration or any details of anything non-standard would be useful.

[Fly7113]

The configuration on the Bitwarden side is pretty standard: I had to set to true the enable_scim key in the bwdata/config.yml file of the self-hosted installation, and then in the organisation settings I had to enable the SCIM provisioning to receive the SCIM URL and the SCIM API key (a nice screenshot is available on the Bitwarden's official documentation page).

On the Authentik side I had to create a new SCIM provider and set the URL and the Token with the values provided by Bitwarden's admin console (Authentication mode: Token; Compatibility Mode: Default), and set the two new attribute mapping I posted. Finally I set the provider as a backchannel provider for my main Bitwarden application (OIDC in my case).

I want to stress the fact that my mappings are very biased, and that probably most of the users will map user.username to the userName field for example, or will not explicitly set an externalId mapping.
Another few thing that I consider worth noting:

• on the Bitwarden's documentation about the user attributes they mention an email field, but that field must in fact be plural (emails) (about 1/2 weeks of my time wasted to notice this detail)
• As I already mentioned, I am not completely sure about the structure of the members array, but the sure thing is that with an identical object as the standard user the mapping works.

LMK if you need any more informations @dewi-tik!

[dewi-tik]

Thanks for the details! I've created a draft PR: #17933

Will try to work on it/test it out over the next week or so.