# SCIM skip GetObject after disable **URL:** \ **Category:** SHF Discussion and Questions\ **Tags:** identity-security-cloud, scim-connector\ **Created:** [November 27, 2024, 3:32pm UTC](https://developer.sailpoint.com/discuss/t/scim-skip-getobject-after-disable/91030 "2024-11-27T15:32:17Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![KL111](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/kl111/32/18964_2.png) [@KL111](https://developer.sailpoint.com/discuss/u/KL111)\ **Post date:** [November 27, 2024, 3:32pm UTC](https://developer.sailpoint.com/discuss/t/scim-skip-getobject-after-disable/91030/1 "2024-11-27T15:32:17Z")
We have 2 (non-compliant) SCIM sources that do not return inactive users either through full aggregations or single user aggregations. This works fine because we do not care about the disabled users on these sources, however, it does present a problem when we try to disable an account on termination. The disable operation works as expected and disables the user on the source, but SailPoint immediately tries to the GET the user record again and that fails, which makes it appear that the disable failed when it did not. Is there any method to disable the GET operation after the disable OR to consider certain response codes (404 in both of these cases) as a success so that the disable operation can function normally and not look like a failure to our auditors? We have considered using a Web Services connector for each of these sources so that we have more control over these functions and responses, however, we would prefer to use the SCIM connector and bend it slightly to our will. Any help or insight is appreciated. ---
**Author:** ![David\_Norris](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@David\_Norris](https://developer.sailpoint.com/discuss/u/David_Norris)\ **Post date:** [November 27, 2024, 4:06pm UTC](https://developer.sailpoint.com/discuss/t/scim-skip-getobject-after-disable/91030/2 "2024-11-27T16:06:46Z")
> [@KL111](#): > > not look like a failure to our auditors Do the auditors care about truthful, validated account data representation? Or augmented representation is good enough? (e.g. Where’s the bar? A consumer cosmetic mirror or a NASA space telescope-grade mirror for capturing every bit of detail?) ---
**Author:** ![sk8er23](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/sk8er23/32/19357_2.png) [@sk8er23](https://developer.sailpoint.com/discuss/u/sk8er23)\ **Post date:** [November 27, 2024, 4:32pm UTC](https://developer.sailpoint.com/discuss/t/scim-skip-getobject-after-disable/91030/3 "2024-11-27T16:32:47Z")
Hi Kyle, Welcome to the Sailpoint Developer Community, I would have to say a custom connector is probably the way to go to resolve this - however I will have a look and see what may be possible with the connector itself. ---
**Author:** ![sk8er23](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/sk8er23/32/19357_2.png) [@sk8er23](https://developer.sailpoint.com/discuss/u/sk8er23)\ **Post date:** [November 27, 2024, 4:48pm UTC](https://developer.sailpoint.com/discuss/t/scim-skip-getobject-after-disable/91030/4 "2024-11-27T16:48:04Z")
Hi @KL111 Have a look at this > **[Non-Compliant Settings](https://documentation.sailpoint.com/connectors/scim_2_0/help/integrating_scim2/noncompliant_settings.html)** > > SailPoint Connectors Documentation I haven’t tried it but it does state the following - “The SCIM 2.0 source supports the configuration of a non-compliant SCIM server. In the SCIM 2.0 source UI, on the **Relax Configuration** sub-panel, enable the **Non Compliant Server?** option to skip SCIM 2.0 validation for each response from this server. Use this if your SCIM 2.0 Server is not fully compliant with SCIM 2.0 specifications.” This may be what you are looking for 🙂 ---
**Author:** ![KL111](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/kl111/32/18964_2.png) [@KL111](https://developer.sailpoint.com/discuss/u/KL111)\ **Post date:** [November 27, 2024, 5:04pm UTC](https://developer.sailpoint.com/discuss/t/scim-skip-getobject-after-disable/91030/5 "2024-11-27T17:04:06Z")
Thank you, @sk8er23. We have both connectors configured as non-compliant because they lack any usable SCIM endpoints other than Users and Groups, however, this does not change the behavior of the disable. ---
**Author:** ![sk8er23](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/sk8er23/32/19357_2.png) [@sk8er23](https://developer.sailpoint.com/discuss/u/sk8er23)\ **Post date:** [November 27, 2024, 5:06pm UTC](https://developer.sailpoint.com/discuss/t/scim-skip-getobject-after-disable/91030/6 "2024-11-27T17:06:15Z")
Thanks @KL111 for confirming, its good to know its limitations. ---
**Author:** ![KL111](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/kl111/32/18964_2.png) [@KL111](https://developer.sailpoint.com/discuss/u/KL111)\ **Post date:** [November 27, 2024, 5:06pm UTC](https://developer.sailpoint.com/discuss/t/scim-skip-getobject-after-disable/91030/7 "2024-11-27T17:06:40Z")
@David_Norris In this case, it’s truly cosmetic that we are striving for. The applications themselves are audited separately (redundantly) but if the account disable shows as failed in SailPoint, we have to provide extensive documentation and it requires multiple additional meetings. If the process merely looked like it was working (and really it is) then that would be sufficient. ---
**Author:** ![David\_Norris](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@David\_Norris](https://developer.sailpoint.com/discuss/u/David_Norris)\ **Post date:** [November 27, 2024, 5:14pm UTC](https://developer.sailpoint.com/discuss/t/scim-skip-getobject-after-disable/91030/8 "2024-11-27T17:14:27Z")
Do you have an API gateway in your landscape to intercept the GetObject call and craft up a custom response conditionally? ---
**Author:** ![sk8er23](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/sk8er23/32/19357_2.png) [@sk8er23](https://developer.sailpoint.com/discuss/u/sk8er23)\ **Post date:** [November 27, 2024, 5:30pm UTC](https://developer.sailpoint.com/discuss/t/scim-skip-getobject-after-disable/91030/9 "2024-11-27T17:30:19Z")
Out of interest if you query the connector config via API what features do you have listed? Should look something like this: “features”: [ “PROVISIONING”, “NO\_PERMISSIONS\_PROVISIONING”, “GROUPS\_HAVE\_MEMBERS” ], ---
**Author:** ![KL111](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/kl111/32/18964_2.png) [@KL111](https://developer.sailpoint.com/discuss/u/KL111)\ **Post date:** [November 27, 2024, 5:46pm UTC](https://developer.sailpoint.com/discuss/t/scim-skip-getobject-after-disable/91030/10 "2024-11-27T17:46:06Z")
No, unfortunately we do not. ---
**Author:** ![KL111](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/kl111/32/18964_2.png) [@KL111](https://developer.sailpoint.com/discuss/u/KL111)\ **Post date:** [November 27, 2024, 5:47pm UTC](https://developer.sailpoint.com/discuss/t/scim-skip-getobject-after-disable/91030/11 "2024-11-27T17:47:58Z")
For these two sources it is only Enable/Disable and Provisioning: ```auto "features": [ "ENABLE", "PROVISIONING" ], ``` ---
**Author:** ![patrickboston](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/patrickboston/32/5876_2.png) [@patrickboston](https://developer.sailpoint.com/discuss/u/patrickboston)\ **Post date:** [November 27, 2024, 6:01pm UTC](https://developer.sailpoint.com/discuss/t/scim-skip-getobject-after-disable/91030/12 "2024-11-27T18:01:32Z")
You could potentially try adding the ‘NO\_RANDOM\_ACCESS’ feature string to the existing list of features. This indicates the connector cannot support single reads via the getObject method. I’ve never tried this but in theory it may work. This would however mean the connector would not perform the single get object call after other provisioning operations as well so validation would not happen until a full aggregation occurs. ---
**Author:** ![KL111](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/kl111/32/18964_2.png) [@KL111](https://developer.sailpoint.com/discuss/u/KL111)\ **Post date:** [November 27, 2024, 6:23pm UTC](https://developer.sailpoint.com/discuss/t/scim-skip-getobject-after-disable/91030/13 "2024-11-27T18:23:57Z")
@patrickboston That actually does work! Very cool! It’s unfortunate that this also removes the ability to do a Get Object on a single user, but that’s really not a problem for our use case. Thank you! ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [January 26, 2025, 6:24pm UTC](https://developer.sailpoint.com/discuss/t/scim-skip-getobject-after-disable/91030/15 "2025-01-26T18:24:53Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.