Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SCIM filter operators (AND, OR, NOT) are case-sensitive #20511

Closed
JayaShakthi97 opened this issue Jun 7, 2024 · 1 comment
Closed

SCIM filter operators (AND, OR, NOT) are case-sensitive #20511

JayaShakthi97 opened this issue Jun 7, 2024 · 1 comment

Comments

@JayaShakthi97
Copy link
Contributor

JayaShakthi97 commented Jun 7, 2024

Describe the issue:
The logical gate operators are case-sensitive. This leads to unexpected behavior when filtering users, where only the left part of the expression is taken into consideration if we use AND in all-caps, for example.

As per the SCIM API specification [1]:

"Attribute names and attribute operators used in filters are case insensitive."

How to reproduce:
Here is a quick summary of how to reproduce:

  1. Setup an Identity Server instance and add the configuration below to the <IS_HOME>/repository/conf/deployment.toml file:
[scim2_multi_attribute_filtering]
use_pagination = "true"
  1. Go to the Claim Configuration page (Claims > List > http://wso2.org/claims), uncheck the 'Read only' checkbox for the 'Department' claim and enable 'Supported by Default' for the 'Account Locked' claim.
  2. In the PRIMARY user store, create:
  • 2 users with 'Account Locked' set to 'true' and 'Department' set to '123'
  • 1 user with 'Account Locked' set to 'true' and 'Department' set to '456'
  1. Run the cURL command below:
curl --location --request GET 'https://localhost:9443/scim2/Users?filter=urn%3Aietf%3Aparams%3Ascim%3Aschemas%3Aextension%3Aenterprise%3A2.0%3AUser%3AaccountLocked%20eq%20%22true%22%20AND%20urn%3Aietf%3Aparams%3Ascim%3Aschemas%3Aextension%3Aenterprise%3A2.0%3AUser%3Adepartment%20eq%20%22123%22' \
--header 'Authorization: Basic ******'
  1. Notice how there are 3 results rather than 2.

[1] https://datatracker.ietf.org/doc/html/draft-ietf-scim-api-13#section-3.2.2.2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant