SCIM PUT Does not work as expected

[guduru510 (Sravan Kumar guduru)]

I have question on update our scim xml file with to make use
of our PUT /Users instead of PUT /Groups.

1. Add entitlement: When i tried adding entitlement for an user, PUT /users is getting called but the required group is not been send as part of the PUT request.

ex: I am trying to add group_1 for an account abc, and abc is already part of group_2 and group_3. Below is how the put request looks like
“members”:[
{
“value”:“group_2”,
},
{
“value”:“group_3”,
}
],

I don’t see group_1 is coming as part of the request.

Can some one help why is it happening like this ? what would be wrong

2. Remove Entitlement: When i tried removing entitlement for an user, instead of PUT /Users getting called it is calling PUT /Groups. I already updated to use GroupsViaUsers as true, not sure why is it calling PUT /Groups instead of PUT /Users. Any thoughts or suggestions on this ?

[Jarin_James]

Hi @guduru510

Ad per the RFC 7644: System for Cross-domain Identity Management: Protocol (rfc-editor.org) , group membership management is handled by group endpoint rather than user endpoint.

The following example shows how to add a member to a group.  Some
   text was removed for readability (indicated by "..."):

   PATCH /Groups/acbf3ae7-8463-...-9b4da3f908ce
   Host: example.com
   Accept: application/scim+json
   Content-Type: application/scim+json
   Authorization: Bearer h480djs93hd8
   If-Match: W/"a330bc54f0671c9"

   { "schemas":
      ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
     "Operations":[
       {
        "op":"add",
        "path":"members",
        "value":[
         {
           "display": "Babs Jensen",
           "$ref":
   "https://example.com/v2/Users/2819c223...413861904646",
           "value": "2819c223-7f76-453a-919d-413861904646"
         }
        ]
       }
     ]
   }