GithubHelp home page GithubHelp logo

scim-client's Introduction

scim-client's People

Contributors

jgomer2001 avatar yurem avatar uboznikov avatar rahatjaan avatar yuriyz avatar diedertimmers avatar worm333 avatar musman2012 avatar willow9886 avatar shekhar16 avatar

Stargazers

Stefan Norberg avatar Anand Prajapati avatar Luis Bustamante avatar Owen Hael avatar Jessi Moths avatar Isaac Whitfield avatar Kun Chong avatar Edgar Roman avatar Sal D'Agostino avatar Christopher Farnham avatar Vineet Bhatia avatar Bo Vargas avatar Igor Zboran avatar

Watchers

Jack Shaw avatar James Cloos avatar Sal D'Agostino avatar Meghna Joshi avatar Javier Rojas avatar Michael Schwartz avatar  avatar  avatar gasmyr avatar  avatar  avatar  avatar  avatar  avatar Michael Edward avatar  avatar  avatar

scim-client's Issues

cases 11.1/11.2, Searching with POST /.search

From SCIM Test Cases.xlsx

11.1 Searching with POST /.search returns multiple resource types
11.2 Searching with POST /.search with a filter that contains an attribute only defined on users excludes groups from the results

Current implementation does not have a general /.search endpoint but specific endpoints for every resource

Add support for PATCH verb to service

Currently SCIM service does not officially support PATCH operation. According to spec, patching is one of the mechanisms that allows a SCIM client to remove (nullify) an already non-empty attribute.

PUT operation MAY cope for attribute removal (see RFC 7644 section 3.5.1). In current implementation an unassigned/nulled attribute passed to the service simply leaves the stored attribute value intact. IMO this is right: clearing attributes not being passed can lead to unintentional info erasure, and thus, complaints.

Current scim server code in oxTrust for patching is not complete yet and deviates from spec. Needs work.

Add a logging framework

Currently the Java client project uses no logging but System.out for printing messages or debuging info. It's also using printStackTrace.

SBT dependancy issues on 3.1.1.Final

Heya,

I've been trying to download 3.1.1.Final from the http://ox.gluu.org/maven repo to compile into an sbt based project and I'm having some issues with dependencies I can't seem to get around. Using 3.0.2 works fine but my version of Gluu is 3.1.1 😞

Here's my build.sbt which if you guys are unfamiliar is the same as a maven pom.xml file

// Adding the Gluu Maven Repository
resolvers += "Gluu Repository" at "http://ox.gluu.org/maven"

libraryDependencies ++= Seq(
    "org.jboss.resteasy" % "resteasy-jaxb-provider" % "3.0.21.Final",
    "org.xdi" % "oxauth-client" % "3.1.1.Final",
    "gluu.scim.client" % "SCIM-Client" % "3.1.1.Final"
)

It seems I had to add the jboss and xdi dependencies manually or else I got errors asking for those dependencies.

At the moment I get these errors when I try and compile

[info] Resolving jline#jline;2.14.4 ...
[warn]  ::::::::::::::::::::::::::::::::::::::::::::::
[warn]  ::          UNRESOLVED DEPENDENCIES         ::
[warn]  ::::::::::::::::::::::::::::::::::::::::::::::
[warn]  :: junit#junit;working@Miguels-MBP-2: not found
[warn]  :: com.sun.xml.bind#jaxb-impl;working@Miguels-MBP-2: not found
[warn]  :: org.jboss.spec.javax.servlet#jboss-servlet-api_3.1_spec;working@Miguels-MBP-2: not found
[warn]  :: org.jboss.logging#jboss-logging;working@Miguels-MBP-2: not found
[warn]  :: org.jboss.logging#jboss-logging-annotations;working@Miguels-MBP-2: not found
[warn]  :: org.jboss.logging#jboss-logging-processor;working@Miguels-MBP-2: not found
[warn]  :: org.jboss.spec.javax.ws.rs#jboss-jaxrs-api_2.0_spec;working@Miguels-MBP-2: not found
[warn]  :: org.jboss.spec.javax.annotation#jboss-annotations-api_1.2_spec;working@Miguels-MBP-2: not found
[warn]  :: javax.activation#activation;working@Miguels-MBP-2: not found
[warn]  :: net.jcip#jcip-annotations;working@Miguels-MBP-2: not found
[warn]  :: org.codehaus.jackson#jackson-jaxrs;working@Miguels-MBP-2: not found
[warn]  :: org.codehaus.jackson#jackson-xc;working@Miguels-MBP-2: not found
[warn]  ::::::::::::::::::::::::::::::::::::::::::::::
sbt.ResolveException: unresolved dependency: junit#junit;working@Miguels-MBP-2: not found
unresolved dependency: com.sun.xml.bind#jaxb-impl;working@Miguels-MBP-2: not found
unresolved dependency: org.jboss.spec.javax.servlet#jboss-servlet-api_3.1_spec;working@Miguels-MBP-2: not found
unresolved dependency: org.jboss.logging#jboss-logging;working@Miguels-MBP-2: not found
unresolved dependency: org.jboss.logging#jboss-logging-annotations;working@Miguels-MBP-2: not found
unresolved dependency: org.jboss.logging#jboss-logging-processor;working@Miguels-MBP-2: not found
unresolved dependency: org.jboss.spec.javax.ws.rs#jboss-jaxrs-api_2.0_spec;working@Miguels-MBP-2: not found
unresolved dependency: org.jboss.spec.javax.annotation#jboss-annotations-api_1.2_spec;working@Miguels-MBP-2: not found
unresolved dependency: javax.activation#activation;working@Miguels-MBP-2: not found
unresolved dependency: net.jcip#jcip-annotations;working@Miguels-MBP-2: not found
unresolved dependency: org.codehaus.jackson#jackson-jaxrs;working@Miguels-MBP-2: not found
unresolved dependency: org.codehaus.jackson#jackson-xc;working@Miguels-MBP-2: not found
[error] (*:update) sbt.ResolveException: unresolved dependency: junit#junit;working@Miguels-MBP-2: not found


[error] unresolved dependency: com.sun.xml.bind#jaxb-impl;working@Miguels-MBP-2: not found
[error] unresolved dependency: org.jboss.spec.javax.servlet#jboss-servlet-api_3.1_spec;working@Miguels-MBP-2: not found
[error] unresolved dependency: org.jboss.logging#jboss-logging;working@Miguels-MBP-2: not found
[error] unresolved dependency: org.jboss.logging#jboss-logging-annotations;working@Miguels-MBP-2: not found
[error] unresolved dependency: org.jboss.logging#jboss-logging-processor;working@Miguels-MBP-2: not found
[error] unresolved dependency: org.jboss.spec.javax.ws.rs#jboss-jaxrs-api_2.0_spec;working@Miguels-MBP-2: not found
[error] unresolved dependency: org.jboss.spec.javax.annotation#jboss-annotations-api_1.2_spec;working@Miguels-MBP-2: not found
[error] unresolved dependency: javax.activation#activation;working@Miguels-MBP-2: not found
[error] unresolved dependency: net.jcip#jcip-annotations;working@Miguels-MBP-2: not found
[error] unresolved dependency: org.codehaus.jackson#jackson-jaxrs;working@Miguels-MBP-2: not found
[error] unresolved dependency: org.codehaus.jackson#jackson-xc;working@Miguels-MBP-2: not found

From what I can tell, it keeps trying to append Miguel-MBP-2 to every dependency but can't figure out why and nowhere on the net does it come up, does it have something to do with the way the pom.xml is being setup for the SCIM-Client?

Enhance ResourceTypes endpoint

Current impl of /resourceType endpoint is receiving an Authorization header as parameter. Authorization is not needed in this case.

Additionally from section 4 of RFC 7644:

If a "filter" is provided, the service provider SHOULD respond with HTTP status code 403 (Forbidden) to ensure that clients cannot incorrectly assume that any matching conditions specified in a filter are true.

We should add this check. Also, removing redundant code there would be good.

cases 5.8/5.9, Update a user with attributes query param

From SCIM Test Cases.xlsx

5.8 Update a user with attributes query param (both core and extended attributes) - verify only requested attributes are returned
5.9 Update a user with excludedAttributes query param (both core and extended attributes) - verify only requested attributes are returned

User tests for Country fail due to "Azerbaijan" not being an ISO 3166-1 alpha-2 country code

There are many places that the SCIM client tests set the country to names of countries:
https://github.com/GluuFederation/SCIM-Client/search?utf8=%E2%9C%93&q=setCountry

But according to the SCIM 2.0 spec here: https://tools.ietf.org/html/rfc7643 , the country attribute on a user:

When specified, the value MUST be in ISO 3166-1 "alpha-2" code format [ISO3166]; e.g., the United States and Sweden are "US" and "SE", respectively.

When testing with compliant servers, this causes the scim client tests to fail.

cases 7.4/7.5, Retrieve a user with attributes query param

From SCIM Test Cases.xlsx

7.4 Retrieve a user with attributes query param (both core and extended attributes) - verify only requested attributes are returned
7.5 Retrieve a user with excludedAttributes query param (both core and extended attributes) - verify only requested attributes are returned

Adjust /Schemas endpoint impl to pick attributes characteristics automatically

Schemas endpoint (sect. 8.7.1 RFC 7643) should be able to generate its responses based on the intrinsic properties of scim resources.

Current implementation contains this meta information hard coded, thus, if the standard evolves, or an error in schema is found, besides the proper logic adjustments, the schema endpoints need to be fixed as well.

SCIM testing should support configuration profiles

Currently all SCIM 2 tests are oriented to work with specific server. As result we can just of out the box run them again ce-dev.gluu.org server. We need to allow to change configuration properties on the fly in sumular to method which we uses in oxTrust/oxAuth.

UMA SCIM Client should use one HTTP client library

Currently in SCIM Client we uses 2 network frameworks:

  1. commons-httpclient
  2. resteasy-jaxrs

For one we uses for SCIM API calls. And second one we uses for oxAUth UMA calls.
This introduce some libraries duplicity and can led to network connections overload because both frameworks may create pools.
I offer to switch to resteasy-jaxrs only. It's oriented to simplify REST API client development. We uses it in oxAuth client library. Also in this case both SCIM and UMA client should use one executor. Hence it will simplify SCIM client library.

SCIM Client should allow to use external UMA executor

According to customer report:
After going through this sequence about 40 times, the RPT status validation starts to fail.

Hence we should allow to adjust the client connection parameters.

In this case UmaScimClientImpl and UmaScim2ClientImpl should have method to get/set executor.
We need similar to oxAuth client functionality:
https://github.com/GluuFederation/oxAuth/blob/master/Client/src/main/java/org/xdi/oxauth/client/BaseClient.java#L74

Validate timezone attribute

When creating/updating a user, validate timezone per spec rfc7643#4.1.1 (should adhere to RFC6557)
Currently any string can be provided

Groups endpoint allows writing non-existing members

When creating a group one might supply any string in the members.value attribute, and the implementation does not validate data coming are REAL user LDAP inums, thus degenerating in LDAP groups whose members attribute contain wrong information.

Example:

If supplying

{
  "schemas": [ "urn:ietf:params:scim:schemas:core:2.0:Group" ],
  "displayName": "scim_test_worldowners"
  "members":[
  	{value: "GIBBERISH"}
  ]
}

The result in ldap is:

dn: inum=...,ou=groups,o=...,o=gluu
objectClass: top
objectClass: gluuGroup
inum: ...
gluuStatus: active
displayName: scim_test_worldowners
member: inum=GIBBERISH,ou=people,o=...,o=gluu

See https://github.com/GluuFederation/oxTrust/blob/version_3.1.1/server/src/main/java/org/gluu/oxtrust/util/CopyUtils2.java#L1236-L1236

SCIM oxAuth authentication method

We need to improve oxAuth SCIM authentication method security.

Currently oxTrust just check if the access_token is valid and user info endpoint returns user_name claim.
As result any client has access to SCIM.
We need to increase security in this place. Probably oxTrust should request client info to check if the client has specific claim, etc...

cases 4.4/5.4/5.5/5.6, Handling of immutable attribute

From SCIM Test Cases.xlsx

4.4 Create a user with an immutable attribute
5.4 Update an immutable attribute that was previously null - value should be set
5.5 Update an immutable attribute that has a value, setting it to the same value - should succeed
5.6 Update an immutable attribute that has a value, setting it to a different value - should fail

SCIM 2 tests review

I've few notes about SCIM 2.0 tests:

  1. I think tests should not mask exceptions: https://github.com/GluuFederation/SCIM-Client/blob/master/src/test/java/gluu/scim2/client/ScimClientPersonWriteOperationsBaseTest.java#L46
  2. Tests where we retrieve data from SCIM 2.0 endpoints should check all data which server returns. Currently in most cases we just check server response code. It's not cover cases when server have bugs which led to skipping attributes persist/update in LDAP. This is sample test: https://github.com/GluuFederation/SCIM-Client/blob/master/src/test/java/gluu/scim2/client/ScimClientPersonWriteOperationsBaseTest.java#L46

Group assignment for users should be done at /Group not through /Users endpoint

Citing section 4.1.2 of RFC 7643 (description of user's groups attribute):

Since this attribute has a mutability of "readOnly", group membership changes MUST be applied via the "Group" Resource (Section 4.2)

Current implementation of Users endpoint allows the modification of the groups attribute in creation (POST), and modification (PUT) operations.

Correct behavior will be ignoring the groups passed as in this case data is read-only.

Refactor Bulk Operation service code

Current impl repeats lots of code from other services implementations (create/update/delete user and group) instead of reusing.

Additionally it is missing the processing of fido devices operations.

Remove redundant code in authorization check for SCIM service

In oxTrust classes UserWebService, GroupService, and FidoService the following code is written at the beginning of every method... let's refactor

        Response authorizationResponse;
        if (jsonConfigurationService.getOxTrustappConfiguration().isScimTestMode()) {
            log.info(" ##### SCIM Test Mode is ACTIVE");
            authorizationResponse = processTestModeAuthorization(authorization);
        } else {
            authorizationResponse = processAuthorization(authorization);
        }

        if (authorizationResponse != null) {
            return authorizationResponse;
        }

With a single point of authorization check, we can switch or even turn off the authorization mechanism easily for development purposes

SCIM 2.0 should support custom attributes per RFC 7643

There are 2 places in next class with message:
NOTE : WRITE CODE FOR THIS

  1. https://github.com/GluuFederation/oxTrust/blob/master/server/src/main/java/org/gluu/oxtrust/util/CopyUtils2.java#L369
  2. https://github.com/GluuFederation/oxTrust/blob/master/server/src/main/java/org/gluu/oxtrust/util/CopyUtils2.java#L609

This sample user we can use as example:
https://tools.ietf.org/html/rfc7643#page-35

There is no attributes in meta section. I believe it's better to add customAttributes to main user section

Creating and retrieval operations return unexpected attributes

When creating a user, the server side outputs JSON with certain attributes (beside core attrs) which are not part of SCIM schema:

The following list summarizes those extra "unknown" attributes:

Inside multi-valued attributes

  • emails: operation, reference
  • address: operation
  • phones: operation
  • ims: operation
  • groups: operation
  • roles: operation
  • entitlements: operation
  • x509Certificates: operation

Regarding to single-valued:

  • pairwiseIdentitifers (should be returned only if requested - not part of schema)
  • password (returns a dummy value but should not be part of response)

Review SCIM 1 tests

We also need to review SCIM tests. There are 3 approaches:

  1. Review existing tests. We only need to add few testing entries to LDAP to enable them
  2. Make copy of SCIM 2 tests and update them to use API 1 endpints
  3. Remove SCIM 1.0 tests if we are not planning to deprecate it and remove this functionality soon.

Deserialization of custom attributes not taking place in client-side

SCIM Service implementation is correctly serializing custom attributes within its schema "placeholder" in Json response. So, server behavior is OK

However, when reading instances of the User class in the Java SCIM-Client, the extension information is not getting deserialized.

When calling user.getExtensions(), an empty map is obtained.

The challenge is to be able to build & attach an instance of the Extension class in the User object as ExtensionDeserializer does, but without help of any server side classes, since this is only a client-side problem.

NB: The jsonanysetter annotation here is wrong.

cases 10.2/10.3, Delete a user with If-Match etag

From SCIM Test Cases.xlsx

10.2 Delete a user with If-Match etag that matches - should delete user
10.3 Delete a user with If-Match etag that does not match - should return a 412 status code and not delete the user

Simplify UMA client constructor

Currently in order to init SCIM UMA client we uses method:

public static ScimClient umaInstance(String domain, String umaMetaDataUrl, String umaAatClientId, String umaAatClientJwks, String umaAatClientKeyId)

We can replace it by

public static ScimClient umaInstance(String issuer, String umaAatClientId, String umaAatClientJwks, String umaAatClientKeyId)

Issuer will be URL of the server. And UMA client will use scim-configuration endpoint to gets information about SCIM endpoints.

Can not access scim api via UMA

I'm trying to call scim api via uma. When I following the document https://gluu.org/docs/ce/3.1.1/user-management/scim2/ , some exception raised.

The backtrace said,

2017-11-01 13:33:04,782 ERROR [qtp1837543557-14] [org.xdi.oxauth.client.TokenRequest] (TokenRequest.java:343) - null
java.lang.NullPointerException: null
        at org.xdi.oxauth.model.crypto.OxAuthCryptoProvider.sign(OxAuthCryptoProvider.java:161) ~[oxauth-model-3.1.1.Final.jar:?]
        at org.xdi.oxauth.client.TokenRequest.getClientAssertion(TokenRequest.java:338) [oxauth-client-3.1.1.Final.jar:?]
        at org.xdi.oxauth.client.TokenClient.exec(TokenClient.java:265) [oxauth-client-3.1.1.Final.jar:?]
        at org.xdi.oxauth.client.uma.wrapper.UmaClient.request(UmaClient.java:178) [oxauth-client-3.1.1.Final.jar:?]
        at org.xdi.oxauth.client.uma.wrapper.UmaClient.request(UmaClient.java:225) [oxauth-client-3.1.1.Final.jar:?]
        at org.xdi.oxauth.client.uma.wrapper.UmaClient.requestPat(UmaClient.java:37) [oxauth-client-3.1.1.Final.jar:?]
        at org.gluu.oxtrust.service.uma.BaseUmaProtectionService.retrievePatToken(BaseUmaProtectionService.java:96) [classes/:?]
        at org.gluu.oxtrust.service.uma.BaseUmaProtectionService.getPatToken(BaseUmaProtectionService.java:51) [classes/:?]
        at org.gluu.oxtrust.service.uma.ScimUmaProtectionService$Proxy$_$$_WeldSubclass.getPatToken(Unknown Source) [classes/:?]
        at org.gluu.oxtrust.service.uma.BaseUmaProtectionService.isExistPatToken(BaseUmaProtectionService.java:66) [classes/:?]
        at org.gluu.oxtrust.service.uma.ScimUmaProtectionService$Proxy$_$$_WeldSubclass.isExistPatToken(Unknown Source) [classes/:?]
        at org.gluu.oxtrust.service.uma.BaseUmaProtectionService.isEnabledUmaAuthentication(BaseUmaProtectionService.java:61) [classes/:?]
        at org.gluu.oxtrust.service.uma.ScimUmaProtectionService$Proxy$_$$_WeldSubclass.isEnabledUmaAuthentication(Unknown Source) [classes/:?]
        at org.gluu.oxtrust.service.uma.ScimUmaProtectionService.isEnabled(ScimUmaProtectionService.java:62) [classes/:?]
        at org.gluu.oxtrust.service.uma.ScimUmaProtectionService$Proxy$_$$_WeldSubclass.isEnabled$$super(Unknown Source) [classes/:?]
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_144]
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_144]
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_144]
        at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_144]
        at org.jboss.weld.interceptor.proxy.TerminalAroundInvokeInvocationContext.proceedInternal(TerminalAroundInvokeInvocationContext.java:51) [weld-core-impl-3.0.0.Final.jar:3.0.0.Final]
        at org.jboss.weld.interceptor.proxy.AroundInvokeInvocationContext.proceed(AroundInvokeInvocationContext.java:78) [weld-core-impl-3.0.0.Final.jar:3.0.0.Final]
        at org.jboss.weld.probe.InvocationMonitor.monitor(InvocationMonitor.java:125) [weld-probe-core-3.0.0.Final.jar:3.0.0.Final]
        at sun.reflect.GeneratedMethodAccessor57.invoke(Unknown Source) ~[?:?]
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_144]
        at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_144]
        at org.jboss.weld.interceptor.reader.SimpleInterceptorInvocation$SimpleMethodInvocation.invoke(SimpleInterceptorInvocation.java:73) [weld-core-impl-3.0.0.Final.jar:3.0.0.Final]
        at org.jboss.weld.interceptor.proxy.InterceptorMethodHandler.executeAroundInvoke(InterceptorMethodHandler.java:85) [weld-core-impl-3.0.0.Final.jar:3.0.0.Final]
        at org.jboss.weld.interceptor.proxy.InterceptorMethodHandler.executeInterception(InterceptorMethodHandler.java:73) [weld-core-impl-3.0.0.Final.jar:3.0.0.Final]
        at org.jboss.weld.interceptor.proxy.InterceptorMethodHandler.invoke(InterceptorMethodHandler.java:57) [weld-core-impl-3.0.0.Final.jar:3.0.0.Final]
        at org.jboss.weld.bean.proxy.CombinedInterceptorAndDecoratorStackMethodHandler.invoke(CombinedInterceptorAndDecoratorStackMethodHandler.java:79) [weld-core-impl-3.0.0.Final.jar:3.0.0.Final]
        at org.jboss.weld.bean.proxy.CombinedInterceptorAndDecoratorStackMethodHandler.invoke(CombinedInterceptorAndDecoratorStackMethodHandler.java:68) [weld-core-impl-3.0.0.Final.jar:3.0.0.Final]
        at org.gluu.oxtrust.service.uma.ScimUmaProtectionService$Proxy$_$$_WeldSubclass.isEnabled(Unknown Source) [classes/:?]
        at org.gluu.oxtrust.service.uma.ScimUmaProtectionService$Proxy$_$$_WeldClientProxy.isEnabled(Unknown Source) [classes/:?]
        at org.gluu.oxtrust.ws.rs.scim2.BaseScimWebService.processAuthorization(BaseScimWebService.java:124) [classes/:?]
        at org.gluu.oxtrust.ws.rs.scim2.UserWebService$Proxy$_$$_WeldSubclass.processAuthorization(Unknown Source) [classes/:?]
        at org.gluu.oxtrust.ws.rs.scim2.UserWebService.searchUsers(UserWebService.java:107) [classes/:?]
        at org.gluu.oxtrust.ws.rs.scim2.UserWebService$Proxy$_$$_WeldSubclass.searchUsers$$super(Unknown Source) [classes/:?]
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_144]
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_144]
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_144]

Here's my code,
App.java.txt

I'm using version_3.1.1, but my manage console has a bit different

![1509543697 1](https://user-images.githubusercontent.com/1139025/32277740-5d534612-bf4e-11e7-
91a7-ba421482754b.png)

My client is following the guide,

Client Name: SCIM-Client. You may enter a different name
Client secret: Think of it as a password. Choose something safe but comfortable for your testing exercise
Application type: Native
Persist Client Authorizations: true
Subject type: pairwise
Authentication method for the Token Endpoint: client_secret_basic
Require Auth Time: false
Logout Session Required: false
Include Claims In ID Token: false
Client Secret Expires: Choose a future date (one week ahead is fine)

I don't know what's wrong with my configuration.

Validate locale attribute

When creating/updating a user, validate locale attribute per spec rfc7643#4.1.1 (should adhere to RFC5646)

Currently any string is accepted

UMA 2 : Update RPT Policy Script and obtain correct token_claims for back-channel call

I already adapted code to UMA 2 here.
2d9cb6f
and here bb2c338

But it needs further work to have correct claims token for correct behavior.
oxauth 3.1.0 supports only UMA 2 (no UMA 1.0.1 anymore),
Spec: https://docs.kantarainitiative.org/uma/ed/oauth-uma-grant-2.0-04.html#rfc.section.3.3.1
Since it is back-channel call (no user interaction) claimToken must contain all claims that are used in RPT Authorization Policy Script. In our case cliamsToken is idToken. Please obtain id_token with all claims that are required by RPT script.

Fix must be in those classes

cases 8.3/8.4, Retrieve a list of users with attributes query param

From SCIM Test Cases.xlsx

8.3 Retrieve a list of users with attributes query param (both core and extended attributes) - verify only requested attributes are returned
8.4 Retrieve a list of users with excludedAttributes query param (both core and extended attributes) - verify only requested attributes are returned

Fix retrieval so that extended attributes can be passed, for instance: urn:ietf:params:scim:schemas:extension:gluu:2.0:User:scimCustomFirst

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.