'eq' and 'co' operators are not working properly in secondary user store with 'filter' in SCIM2 (multi attributes)

[IshikaGodage]

When trying to retrieve users using SCIM2 API, 'eq' and 'co' operators are not working properly in secondary user store with 'filter'(multi attributes case). Following[1],[2],[3],[4] curl requests are sample requests.

Expected result : Retrieve the user from TEST user store whose user name equals to 'userT1' and who belong to a group which group name equals to 'engineering' Current result :Nothing [1] curl -v -k --user admin:admin https://localhost:9443/scim2/Users?domain=TEST&filter=userName+eq+userT1+and+groups+eq+engineering

Expected result : Retrive all users from TEST user store whose user name contains letter 'T' and who belong to a group which group name contains letters 'neer' Current result :Nothing [2] curl -v -k --user admin:admin https://localhost:9443/scim2/Users?domain=TEST&filter=userName+co+T+and+groups+co+neer

Expected result : Retrieve the user from TEST user store whose user name equals to 'userT1' and who belong to a group which group name equals to 'engineering' Current result :Nothing [3] curl -v -k --user admin:admin https://localhost:9443/scim2/Users?startIndex=1&count=1&domain=TEST&filter=userName+eq+userT1+and+groups+eq+engineering

Expected result : Retrieve 2 users from TEST user store from index 1 whose user name contains letter 'T' and who belong to a group which group name contains letters 'neer' Current result : Nothing [4] curl -v -k --user admin:admin https://localhost:9443/scim2/Users?startIndex=1&count=2&domain=TEST&filter=userName+co+T+and+groups+co+neer

[hauntingEcho]

• 3973 may also be relevant to eq/co for userName

• I'm not seeing the domain argument referenced in either WSO2's documentation or the SCIM spec for searching - can you link me to documentation about it? SCIM is relatively central to the way I'm using WSO2 right now.
• As WSO2's SCIM2 implementation returns namespaced names for users in userstores not named "primary" (regardless of whether they are the primary userstore or not), have you tried ?filter=userName+eq+TEST/userT1 for example 1? Alternatively, what is the result of just https://localhost:9443/scim2/Users?
• do any of the filters work in isolation (just filtering username, or just filtering group, without the and)?

[DMHP]

@hauntingEcho domain parameter is something specific to wso2 and it is not there in the SCIM2 spec. At the moment we don't have documented it but we are working on the documentation.

When filtering the users , if we use the filter like

• filter=userName+eq+TEST/userT1 in the response the user name will be displayed with the appended domain name as user resides in TEST domain.
  • filter=userName+eq+userT2 in the response the user name will be displayed without the domain name as the user resides in the primary domain.

what is the result of just https://localhost:9443/scim2/Users

• It will return the user details across all the userstores in the server.

do any of the filters work in isolation (just filtering username, or just filtering group, without the and)? Yes. Wso2 IS server supports for both single attribute filtering and multi attribute filtering. In that case we can use filters with out 'AND' operation.

If you expect something different please raise.