From 2d3f8251c5e58deda8f2ff9c2ff71c1805a9a736 Mon Sep 17 00:00:00 2001 From: John Coffey Date: Sat, 19 Sep 2026 09:04:25 -0700 Subject: [PATCH] SCIM decision: a groups value equal to the current membership in a POST or PUT body is accepted and ignored, since Okta sends groups: [] on create (SCIM-28) --- docs/spec/features/scim.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/spec/features/scim.md b/docs/spec/features/scim.md index ffa4b7b..90ca55e 100644 --- a/docs/spec/features/scim.md +++ b/docs/spec/features/scim.md @@ -343,6 +343,10 @@ Each requirement has an ID, and tests name the IDs they check. - **SCIM-28.** `groups` on a user is read-only. Each entry has `value` (the group's id), `display` (the group's display name) and `$ref`. A write to it is `400 mutability`. Membership is changed through the Group. + **Decision** (2026-09-19): in a `POST` or `PUT` body, a `groups` value that + equals the current membership (so `[]` on create, as Okta sends) isn't a + write: it's accepted and ignored. A value that would change membership is + `400 mutability`, and `PATCH` on `groups` always is. - **SCIM-29.** `externalId` is stored exactly as sent and never interpreted. It's matched case-exactly. An empty string is `400 invalidValue`, as the schema already requires. **Decision:** within one tenant (or the