inbuxa/inbuxa-server
1
0
Fork 0
Code Issues Pull Requests 1 Actions 1 Packages Projects Releases Wiki Activity

SCIM decision: a groups value equal to the current membership in a POST or PUT body is accepted and ignored, since Okta sends groups: [] on create (SCIM-28)

Browse Source
This commit is contained in:
jcoffey-dev
2026-09-19 09:04:25 -07:00
parent 4b389b6b4e
commit 2d3f8251c5
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/spec/features/scim.md
+4
View File
@@ -343,6 +343,10 @@ Each requirement has an ID, and tests name the IDs they check.
- **SCIM-28.** `groups` on a user is read-only. Each entry has `value` (the - **SCIM-28.** `groups` on a user is read-only. Each entry has `value` (the
group's id), `display` (the group's display name) and `$ref`. A write to it group's id), `display` (the group's display name) and `$ref`. A write to it
is `400 mutability`. Membership is changed through the Group. is `400 mutability`. Membership is changed through the Group.
**Decision** (2026-09-19): in a `POST` or `PUT` body, a `groups` value that
equals the current membership (so `[]` on create, as Okta sends) isn't a
write: it's accepted and ignored. A value that would change membership is
`400 mutability`, and `PATCH` on `groups` always is.
- **SCIM-29.** `externalId` is stored exactly as sent and never interpreted. - **SCIM-29.** `externalId` is stored exactly as sent and never interpreted.
It's matched case-exactly. An empty string is `400 invalidValue`, as the It's matched case-exactly. An empty string is `400 invalidValue`, as the
schema already requires. **Decision:** within one tenant (or the schema already requires. **Decision:** within one tenant (or the