Closed hauntingEcho closed 7 months ago
hauntingEcho
commented
6 years ago to clarify a bit, while section 2.4 recommends "service providers SHOULD canonicalize the value returned", they are not required to do so. I have raised an issue with wso2 to address this as well
kqarryzada
commented
7 months ago Hi @hauntingEcho,
You've likely solved your problems with this already, but I'm adding a comment to offer some perspective in case anyone else runs into similar issues.
It sounds like the WSO2 Identity Server treats certain fields like emails as single-valued primitives instead of a multi-valued array as established by the standard. I'm not sure if there's a clear way for us to handle this natively in the SDK. As you've noted, the SCIM SDK has the understanding that fields like emails are arrays, and this is deeply baked into the UserResource class, given that the emails member variable is a List. Virtually all of the serialization in the SCIM SDK's common component uses Jackson's default serializer overall, so this would be hard to change.
One way that you could potentially play better with this requirement in your own application is by creating a new class that models this alternate user type. This would be a new class that extends the UserResource class. This could still use an "emails" array, but the getter and setter methods could enforce a constraint of a single user in this list. Then, you could add a custom serializer and deserializer that converts the raw string email value into a single-valued Java List, and converts the POJO's list into a primitive single-valued string. This would give some flexibility with the SCIM service provider that expects this. Your application would understand this to be a single-valued list.
I think you could also define a custom serializer and deserializer for the parent UserResource class as well, and register them on your Object Mapper (in case you also need to interface with the parent class). I haven't tried this before, but it may work. It seems that the ticket opened for the WSO2 Identity Server wasn't actioned (as of today), so until this is corrected, custom serializers may have to be the answer for you.
per RFC 7643 section 2.4, a SCIM2 multi-valued attribute can contain either primitive or complex values (although "
service providers SHOULD canonicalize the value returned", it isn't required). However, receiving a primitive valued email address (as returned by WSO2 identity server 5.6.0) results in:the result returned by curl, which it's trying to parse, is:
{"totalResults":1,"startIndex":1,"itemsPerPage":1,"schemas":["urn:ietf:params:scim:api:messages:2.0:ListResponse"],"Resources":[{"emails":["admin@wso2.com"],"meta":{"created":"2018-07-13T14:11:57Z","lastModified":"2018-07-13T14:11:57Z"},"name":{"givenName":"admin","familyName":"admin"},"groups":[{"display":"Application/local-8443"}],"id":"fd650662-a0fc-4095-a88a-c4d9203b3e67","userName":"admin"}]}