SCIM for ASP.NET

In this release, we've focused on updating our component to conform to the standards that Microsoft require for Azure AD integration. This includes a breaking change to the `IScimStore`. In addition to this, we have also implemented the BULK endpoint.

Support for Azure AD Integration

The SCIM component now passes all of the tests to support Azure AD SCIM integration. We used the SCIM validator provided by Microsoft to run tests against our SCIM component.

You can enable Azure AD SCIM integration in the component by setting the

EnableAzureAdCompatibility flag to true in the ScimServiceProviderConfigOptions.

When you set this flag to true, you enable support for Azure AD's provisioning of users and groups.

To pass the integration tests

• PATCH requests need to return a `200 OK` with the resource that was being modified. The PartialUpdate method in the IScimStore now returns Task<TResource?>. If a resource is returned, then a 200 OK will be generated; otherwise, a 204 No Content is returned
• PATCH requests that include a 'dot notation' syntax produced by Azure AD are now accepted
• The InMemoryScimStore will check the `ExternalId` for uniqueness when adding or updating resources
•  Requests against resources that have extensions will no longer require the extension to be in the request (e.g. during a create request)

Known integration problems

There are a number of known integration problems when using the SCIM validation tool. These are issues that are now known by Microsoft, in their backlog and are working to be resolved.

Discover Schema

When using the 'Discover Schema' functionality, you must update the mappings generated by the validation tool. The `primary` sub-attribute of the `phoneNumbers` attribute has a bug where a string is generated for the 'primary' value sent in a PATCH request to the SCIM component. You can set the `value` text box of the rows that refer to the `primary` sub-attribute so that the correct value is sent over the wire.

When using the 'Default Mappings' functionality, there are three erroneous mappings. These are:

• roles[primary eq "True"].display
• roles[primary eq "True"].value
• roles[primary eq "True"].type

Add with filter

The SCIM Validation tool sends two requests, one POST to create and one PATCH to modify using an add operation. The body looks like this:

Create Request

{
"schemas": [
"urn:ietf:params:scim:schemas:core:2.0:User"
],
"userName": "[email protected]"
}

PATCH Request

{
"op": "add",
"path": "emails[type eq \"work\"].value",
"value": "email address removed for privacy reasons"
}

The initial request for this JSON doesn't include any items for the email property. When the filter evaluates, there are no items in the collection so adding a value to the 'value' property fails

Replace with filter

The SCIM Validation tool sends two requests, one POST to create and one PATCH to modify using an `replace` operation. The body looks like this:

Create Request

{
"schemas": [
"urn:ietf:params:scim:schemas:core:2.0:User"
],
"userName": "[email protected]"
}

PATCH Request

{
"op": "replace",
"path": "roles[primary eq true].type",
"value": "I6T3MZAC1HXV"
}
```

The initial request for this JSON doesn't include any items for the roles property. When the filter evaluates, there are no items in the collection so adding a value to the 'type' property fails

Replace with no value

The SCIM Validation tool sends two requests, one POST to create and one PATCH to modify using an `replace` operation:

Create Request

{
"schemas": [
"urn:ietf:params:scim:schemas:core:2.0:User"
],
"userName": "[email protected]"
}

Partial Update Request

 

{
"op": "replace",
"path": "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:manager",
"value": ""
}

Due to the interpretation of the SCIM specifications, the SCIM Component is currently not set up to handle empty values for `replace` operations. Microsoft are aware of the differing interpretations around this operation and are working on allowing a toggle between a `remove` and `replace` operation in this context.

Support for BULK operations

The SCIM component now supports the BULK endpoint. More documentation for this functionality can be found in the SCIM documentation

Bug Fixes

• When adding members to a group via a `PATCH` operation, the `type` property is no longer required