Add feature flag and small refactor

ee/changelogs/unreleased/5014-automatically-deprovision-users-when-removed-from-a-configured-identity-provider.yml

 ---
-title: Resolve Automatically deprovision users when removed from a configured identity
-  provider
+title: Automatically deprovision and update users from a configured identity via SCIM
 merge_request: 9388
 author:
 type: added

ee/lib/api/scim.rb

@@ -37,6 +37,7 @@ module API
 
       resource :Users do
         before do
+          check_group_scim_enabled(find_group(params[:group]))
           check_group_saml_configured
         end
 

ee/lib/ee/api/helpers.rb

@@ -135,6 +135,10 @@ module EE
         unauthorized! unless can?(current_user, :admin_group_saml, group)
       end
 
+      def check_group_scim_enabled(group)
+        forbidden!('Group SCIM not enabled.') unless Feature.enabled?(:group_scim, group)
+      end
+
       def check_group_saml_configured
         forbidden!('Group SAML not enabled.') unless ::Gitlab::Auth::GroupSaml::Config.enabled?
       end

ee/spec/lib/gitlab/scim/params_parser_spec.rb

@@ -36,7 +36,7 @@ describe EE::Gitlab::Scim::ParamsParser do
       expect(described_class.new(operations: operations).deprovision_user?).to be true
     end
 
-    it 'returns an empty hash for the wrong operations' do
+    it 'returns false when not deprovisioning' do
       operations = [{ "op": "Replace", "path": "active", "value": "True" }]
 
       expect(described_class.new(operations: operations).deprovision_user?).to be false