feat(scim): Add configurable core attribute inclusion for SCIM user responses - #4954
Open
ravindu439 wants to merge 4 commits into
Open
feat(scim): Add configurable core attribute inclusion for SCIM user responses#4954ravindu439 wants to merge 4 commits into
ravindu439 wants to merge 4 commits into
Conversation
…rtise pagination support Allow POST /Users to omit the ThunderID extension schema URN when the request carries only core SCIM attributes. CreateUser then defaults to the sole configured user type via resolveDefaultEntityTypeName, erroring if zero or more than one type is configured. ReplaceUser (and Me PUT) still require the extension URN explicitly; no fallback on update. Also advertise the RFC 9865 pagination attribute on GET /ServiceProviderConfig: index-based pagination supported, cursor based pagination not implemented.
…ch,Me and Discovery endpoints
Split the generic handler.go/service.go into discovery_handler.go and discovery_service.go, and rename group_*.go to groups_*.go to match the existing users_*.go convention. Extract shared response/error handling into response.go and filter parsing into scim_filter.go so all three resource handlers use the same code paths instead of duplicating them. Normalize license headers across the SCIM package and its integration tests from the WSO2 Apache boilerplate to the ThunderID SPDX header. Fix bugs found while doing the split: - getCredentialKeys silently swallowed entity-type lookup failures and returned an empty credential set instead of surfacing an error - filter parse errors on GET /Users and POST /Users/.search bypassed the SCIM error/i18n pipeline with a hardcoded, untranslated response - unsupported SCIM route stubs were registered without CORS middleware - /Me GET and PUT ignored the attributes/excludedAttributes query parameters and always returned the full resource Rename scimService/scimHandler to scimDiscoveryService/scimDiscoveryHandler to match the discovery_*.go file names, and drop the unused userService dependency from the discovery service, since only scimUsersService needs it. Regenerate api/scim.yaml to reflect the above.
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. 🗂️ Base branches to auto review (1)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
ravindu439
force-pushed
the
SCIM-response-improvements
branch
from
August 14, 2026 05:44
cb71659 to
d7421f2
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
SCIM user responses always included mapped core schema fields (userName, emails, name, etc.), even for requests that only used a custom extension schema. This mixed core attribute noise into responses that had no core attributes in the request payload.
Approach
buildSCIMUserResourcenow takes anincludeCoreAttrsflag; core attrs are only mapped onto the response when true.CreateUser,ReplaceUser) derive the flag from whether the request payload itself carried core attributes (len(payload.CoreAttrs) > 0), so the response mirrors what was sent.ListUsers,GetUser) derive the flag from a newscimconfig.ReturnMappedCoreAttrsOnGetvar, since there's no request payload to inspect. Currently defaults tofalse; intended to become request/deployment-configurable once a frontend toggle exists.Related Issues
Related PRs
Checklist
breaking changelabel added.Security checks