Fix: SCIM error message for invalid request values in V1 and V2 Roles Remove-Add-Replace operations (fixes #20334)

components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMRoleManager.java

@@ -1,7 +1,7 @@
 /*
- * Copyright (c) 2020, WSO2 Inc. (http://www.wso2.org) All Rights Reserved.
+ * Copyright (c) 2020-2024, WSO2 LLC. (http://www.wso2.com).
  *
- * WSO2 Inc. licenses this file to you under the Apache License,
+ * WSO2 LLC. licenses this file to you under the Apache License,
  * Version 2.0 (the "License"); you may not use this file except
  * in compliance with the License.
  * You may obtain a copy of the License at
@@ -11,7 +11,7 @@
  * Unless required by applicable law or agreed to in writing,
  * software distributed under the License is distributed on an
  * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
+ * KIND, either express or implied.  See the License for the
  * specific language governing permissions and limitations
  * under the License.
  */
@@ -771,21 +771,30 @@ private void updatePermissions(String roleId, List<PatchOperation> permissionOpe
 
  private void prepareAddedRemovedGroupLists(Set<String> addedGroupsIds, Set<String> removedGroupsIds,
  Set<String> replacedGroupsIds, PatchOperation groupOperation,
- Map<String, String> groupObject, List<GroupBasicInfo> groupListOfRole) {
+ Map<String, String> groupObject, List<GroupBasicInfo> groupListOfRole)
+ throws BadRequestException {
+
+ String value = groupObject.get(SCIMConstants.CommonSchemaConstants.VALUE);
+
+ if (StringUtils.isBlank(value)) {
+ throw new BadRequestException(
+ "Updating groups of the role by display name is not supported. Update using group id instead.",
+ ResponseCodeConstants.INVALID_SYNTAX);
+ }
 
  switch (groupOperation.getOperation()) {
  case (SCIMConstants.OperationalConstants.ADD):
- removedGroupsIds.remove(groupObject.get(SCIMConstants.CommonSchemaConstants.VALUE));
- if (!isGroupExist(groupObject.get(SCIMConstants.CommonSchemaConstants.VALUE), groupListOfRole)) {
- addedGroupsIds.add(groupObject.get(SCIMConstants.CommonSchemaConstants.VALUE));
+ removedGroupsIds.remove(value);
+ if (!isGroupExist(value, groupListOfRole)) {
+ addedGroupsIds.add(value);
  }
  break;
  case (SCIMConstants.OperationalConstants.REMOVE):
- addedGroupsIds.remove(groupObject.get(SCIMConstants.CommonSchemaConstants.VALUE));
- removedGroupsIds.add(groupObject.get(SCIMConstants.CommonSchemaConstants.VALUE));
+ addedGroupsIds.remove(value);
+ removedGroupsIds.add(value);
  break;
  case (SCIMConstants.OperationalConstants.REPLACE):
- replacedGroupsIds.add(groupObject.get(SCIMConstants.CommonSchemaConstants.VALUE));
+ replacedGroupsIds.add(value);
  break;
  }
  }

components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMRoleManagerV2.java

@@ -1214,19 +1214,27 @@ private List<String> getUserIDList(List<String> userList, String tenantDomain) t
 
  private void prepareInitialGroupLists(Set<String> givenAddedGroupsIds, Set<String> givenRemovedGroupsIds,
  Set<String> givenReplacedGroupsIds, PatchOperation groupOperation,
- Map<String, String> groupObject) {
+ Map<String, String> groupObject) throws BadRequestException {
+
+ String value = groupObject.get(SCIMConstants.CommonSchemaConstants.VALUE);
+
+ if (StringUtils.isBlank(value)) {
+ throw new BadRequestException(
+ "Updating groups of the role by display name is not supported. Update using group id instead.",
+ ResponseCodeConstants.INVALID_SYNTAX);
+ }
 
  switch (groupOperation.getOperation()) {
  case (SCIMConstants.OperationalConstants.ADD):
- givenRemovedGroupsIds.remove(groupObject.get(SCIMConstants.CommonSchemaConstants.VALUE));
- givenAddedGroupsIds.add(groupObject.get(SCIMConstants.CommonSchemaConstants.VALUE));
+ givenRemovedGroupsIds.remove(value);
+ givenAddedGroupsIds.add(value);
  break;
  case (SCIMConstants.OperationalConstants.REMOVE):
- givenAddedGroupsIds.remove(groupObject.get(SCIMConstants.CommonSchemaConstants.VALUE));
- givenRemovedGroupsIds.add(groupObject.get(SCIMConstants.CommonSchemaConstants.VALUE));
+ givenAddedGroupsIds.remove(value);
+ givenRemovedGroupsIds.add(value);
  break;
  case (SCIMConstants.OperationalConstants.REPLACE):
- givenReplacedGroupsIds.add(groupObject.get(SCIMConstants.CommonSchemaConstants.VALUE));
+ givenReplacedGroupsIds.add(value);
  break;
  default:
  break;