scim - internal errors

By: Sakit Atakishiyev user 08 Jun 2018 at 5:38 a.m. CDT

5 Responses
Sakit Atakishiyev gravatar
Hi everyone. I have problem with `SCIM API`. Problems start when I change my user status `INACTIVE` with SCIM. When I do this operation with `oxTrust` admin everything is ok. I will exaplain how to reproduce this error. Creating a new user with `SCIM API` **REQUEST** ``` POST /identity/restv1/scim/v2/Users HTTP/1.1 Host: login.fimsa.az Content-Type: application/json Authorization: Bearer 2a21d95f-fd87-4d80-8320-85c610fdac00 Cache-Control: no-cache { "schemas":["urn:ietf:params:scim:schemas:core:2.0:User"], "userName":"sakit.a@hotmail.com", "active":true, "name":{ "formatted":"Sakit Atakişiyev Ramiz oğlu", "givenName":"Sakit", "familyName":"Atakişiyev", "middleName":"Ramiz oğlu" }, "emails":[{ "value":"sakit.a@hotmail.com" }], "password":"1234567", "displayName":"Sakit Ramiz Atakişiyev", "urn:ietf:params:scim:schemas:extension:gluu:2.0:User":{ "persistentId":"534NQB0" } } ``` **RESPONSE** ``` { "schemas": [ "urn:ietf:params:scim:schemas:core:2.0:User" ], "id": "@!8C91.0602.94C4.D120!0001!CF75.59AC!0000!C30D.D5AF.1DF4.71F9", "meta": { "resourceType": "User", "created": "2018-06-08T10:03:11.423Z", "lastModified": "2018-06-08T10:03:11.423Z", "location": "https://login.fimsa.az/identity/restv1/scim/v2/Users/@!8C91.0602.94C4.D120!0001!CF75.59AC!0000!C30D.D5AF.1DF4.71F9" }, "userName": "sakit.a@hotmail.com", "name": { "familyName": "Atakişiyev", "givenName": "Sakit", "middleName": "Ramiz oğlu", "formatted": "Sakit Atakişiyev Ramiz oğlu" }, "displayName": "Sakit Ramiz Atakişiyev", "active": true, "emails": [ { "value": "sakit.a@hotmail.com" } ], "urn:ietf:params:scim:schemas:extension:gluu:2.0:User": { "persistentId": "534NQB0" } } ``` Getting the new created user info with `SCIM API` **REQUEST** ``` GET /identity/restv1/scim/v2/Users/@!8C91.0602.94C4.D120!0001!CF75.59AC!0000!CDFB.AEA5.E6B8.1D78 HTTP/1.1 Host: login.fimsa.az Authorization: Bearer 2a21d95f-fd87-4d80-8320-85c610fdac00 Cache-Control: no-cache ``` **RESPONSE** ``` { "schemas": [ "urn:ietf:params:scim:schemas:extension:gluu:2.0:User", "urn:ietf:params:scim:schemas:core:2.0:User" ], "id": "@!8C91.0602.94C4.D120!0001!CF75.59AC!0000!CDFB.AEA5.E6B8.1D78", "meta": { "resourceType": "User", "created": "2018-06-08T10:27:59.305Z", "lastModified": "2018-06-08T10:27:59.305Z", "location": "https://login.fimsa.az/identity/restv1/scim/v2/Users/@!8C91.0602.94C4.D120!0001!CF75.59AC!0000!CDFB.AEA5.E6B8.1D78" }, "userName": "sakit.a@hotmail.com", "name": { "familyName": "Atakişiyev", "givenName": "Sakit", "middleName": "Ramiz oğlu", "formatted": "Sakit Atakişiyev Ramiz oğlu" }, "displayName": "Sakit Ramiz Atakişiyev", "active": true, "emails": [ { "value": "sakit.a@hotmail.com" } ], "urn:ietf:params:scim:schemas:extension:gluu:2.0:User": { "persistentId": "534NQB0", "uid": "sakit.a@hotmail.com", "mail": "sakit.a@hotmail.com", "displayName": "Sakit Ramiz Atakişiyev", "givenName": "Sakit", "gluuStatus": false, "middleName": "Ramiz oğlu", "sn": "Atakişiyev" } } ``` Updating user `status` with `SCIM API` **REQUEST** ``` PUT /identity/restv1/scim/v2/Users/@!8C91.0602.94C4.D120!0001!CF75.59AC!0000!CDFB.AEA5.E6B8.1D78 HTTP/1.1 Host: login.fimsa.az Content-Type: application/json Authorization: Bearer 2a21d95f-fd87-4d80-8320-85c610fdac00 Cache-Control: no-cache { "schemas":["urn:ietf:params:scim:schemas:core:2.0:User"], "userName":"sakit.a@hotmail.com", "active":false, "name":{ "formatted":"Sakit Atakişiyev Ramiz oğlu", "givenName":"Sakit", "familyName":"Atakişiyev", "middleName":"Ramiz oğlu" }, "emails":[{ "value":"sakit.a@hotmail.com" }], "password":"1234567", "displayName":"Sakit Ramiz Atakişiyev", "urn:ietf:params:scim:schemas:extension:gluu:2.0:User":{ "persistentId":"534NQB0" } } ``` **RESPONSE** ``` { "schemas": [ "urn:ietf:params:scim:schemas:core:2.0:User" ], "id": "@!8C91.0602.94C4.D120!0001!CF75.59AC!0000!CDFB.AEA5.E6B8.1D78", "meta": { "resourceType": "User", "created": "2018-06-08T10:27:59.305Z", "lastModified": "2018-06-08T10:31:10.377Z", "location": "https://login.fimsa.az/identity/restv1/scim/v2/Users/@!8C91.0602.94C4.D120!0001!CF75.59AC!0000!CDFB.AEA5.E6B8.1D78" }, "userName": "sakit.a@hotmail.com", "name": { "familyName": "Atakişiyev", "givenName": "Sakit", "middleName": "Ramiz oğlu", "formatted": "Sakit Atakişiyev Ramiz oğlu" }, "displayName": "Sakit Ramiz Atakişiyev", "active": false, "emails": [ { "value": "sakit.a@hotmail.com" } ], "urn:ietf:params:scim:schemas:extension:gluu:2.0:User": { "persistentId": "534NQB0", "uid": "sakit.a@hotmail.com", "mail": "sakit.a@hotmail.com", "displayName": "Sakit Ramiz Atakişiyev", "givenName": "Sakit", "gluuStatus": false, "middleName": "Ramiz oğlu", "sn": "Atakişiyev" } } ``` After this operation my user is disabled on server and can not login. Problem start from here. After inactivate my user I get error when to try update my user or getting user info endpoint. Here is the request and response I will also attach both case error files from server. Getting user info after disabling. **REQUEST** ``` GET /identity/restv1/scim/v2/Users/@!8C91.0602.94C4.D120!0001!CF75.59AC!0000!CDFB.AEA5.E6B8.1D78 HTTP/1.1 Host: login.fimsa.az Authorization: Bearer 2a21d95f-fd87-4d80-8320-85c610fdac00 Cache-Control: no-cache ``` **RESPONSE**([server_log](https://drive.google.com/open?id=172OUJA23wT68s1TdnEaJclZNHMIpx57W)) ``` { "schemas": [ "urn:ietf:params:scim:api:messages:2.0:Error" ], "status": "500", "scimType": "", "detail": "Unexpected error: null" } ``` And this when I try to activate my user again **REQUEST** ``` PUT /identity/restv1/scim/v2/Users/@!8C91.0602.94C4.D120!0001!CF75.59AC!0000!CDFB.AEA5.E6B8.1D78 HTTP/1.1 Host: login.fimsa.az Content-Type: application/json Authorization: Bearer 2a21d95f-fd87-4d80-8320-85c610fdac00 Cache-Control: no-cache { "schemas":["urn:ietf:params:scim:schemas:core:2.0:User"], "userName":"sakit.a@hotmail.com", "active":true, "name":{ "formatted":"Sakit Atakişiyev Ramiz oğlu", "givenName":"Sakit", "familyName":"Atakişiyev", "middleName":"Ramiz oğlu" }, "emails":[{ "value":"sakit.a@hotmail.com" }], "password":"1234567", "displayName":"Sakit Ramiz Atakişiyev", "urn:ietf:params:scim:schemas:extension:gluu:2.0:User":{ "persistentId":"534NQB0" } } ``` **RESPONSE**([server_log](https://drive.google.com/open?id=1dRLkEcZmfF8xZOPXeikQRSsWkHqOWqO3)) ``` { "schemas": [ "urn:ietf:params:scim:api:messages:2.0:Error" ], "status": "500", "scimType": "", "detail": "Unexpected error: null" } ``` **UPDATE** I found the problem. When deactive user with scim api. system set status as null. So that system gives `NullPointerException` for the update and search service. When we do this operation with oxTrust system set correctly user status `INACTIVE` so everything works normal. Currently I solve this problem with enabling `scim_event_handler` dynamic script and change user status on update operation
Ubuntu 16.04
closed

Answers

By Sahil Arora user 08 Jun 2018 at 6:23 p.m. CDT

Copy
Sahil Arora gravatar
I will try to reproduce and let you know.

By Sahil Arora user 29 Jun 2018 at 9:16 p.m. CDT

Copy
Sahil Arora gravatar
Saket, I am not able to reproduce it. I have used SCIM test mode to create user, and set active to "false" ``` { "active":false } {"schemas":["urn:ietf:params:scim:schemas:core:2.0:User"],"id":"@!C4DB.73B8.21CC.677C!0001!7D64.268E!0000!4A46.51DB.6572.2FF6","meta":{"resourceType":"User","created":"2018-06-30T02:03:11.310Z","lastModified":"2018-06-30T02:12:19.059Z","location":"https://ubuntu.gluu.info/identity/restv1/scim/v2/Users/@!C4DB.73B8.21CC.677C!0001!7D64.268E!0000!4A46.51DB.6572.2FF6"},"userName":"sakit.a@hotmail.com","name":{"familyName":"Atakişiyev","givenName":"Sakit","middleName":"Ramiz oğlu","formatted":"Sakit Atakişiyev Ramiz oğlu"},"displayName":"Sakit Ramiz Atakişiyev","active":false,"emails":[{"value":"sakit.a@hotmail.com"}]} ``` And I was able to get the user, and re-activate successfully with SCIM API ``` GET /identity/restv1/scim/v2/Users/@!C4DB.73B8.21CC.677C!0001!7D64.268E!0000!4A46.51DB.6572.2FF6 {"schemas":["urn:ietf:params:scim:schemas:core:2.0:User"],"id":"@!C4DB.73B8.21CC.677C!0001!7D64.268E!0000!4A46.51DB.6572.2FF6","meta":{"resourceType":"User","created":"2018-06-30T02:03:11.310Z","lastModified":"2018-06-30T02:12:19.124Z","location":"https://ubuntu.gluu.info/identity/restv1/scim/v2/Users/@!C4DB.73B8.21CC.677C!0001!7D64.268E!0000!4A46.51DB.6572.2FF6"},"userName":"sakit.a@hotmail.com","name":{"familyName":"Atakişiyev","givenName":"Sakit","middleName":"Ramiz oğlu","formatted":"Sakit Atakişiyev Ramiz oğlu"},"displayName":"Sakit Ramiz Atakişiyev","active":false,"emails":[{"value":"sakit.a@hotmail.com"}]} ``` Set status to active again - ``` PUT /identity/restv1/scim/v2/Users/@!C4DB.73B8.21CC.677C!0001!7D64.268E!0000!4A46.51DB.6572.2FF6 { "active":true } {"schemas":["urn:ietf:params:scim:schemas:core:2.0:User"],"id":"@!C4DB.73B8.21CC.677C!0001!7D64.268E!0000!4A46.51DB.6572.2FF6","meta":{"resourceType":"User","created":"2018-06-30T02:03:11.310Z","lastModified":"2018-06-30T02:18:51.235Z","location":"https://ubuntu.gluu.info/identity/restv1/scim/v2/Users/@!C4DB.73B8.21CC.677C!0001!7D64.268E!0000!4A46.51DB.6572.2FF6"},"userName":"sakit.a@hotmail.com","name":{"familyName":"Atakişiyev","givenName":"Sakit","middleName":"Ramiz oğlu","formatted":"Sakit Atakişiyev Ramiz oğlu"},"displayName":"Sakit Ramiz Atakişiyev","active":true,"emails":[{"value":"sakit.a@hotmail.com"}]} ``` I followed the same steps provided by you. Please try again and let me know.

By Sakit Atakishiyev user 30 Jun 2018 at 12:52 a.m. CDT

Copy
Sakit Atakishiyev gravatar
Hi Sahil. I saw from your response you only update `active` attribute and did not get any errors. In this case may be the problem related `gluuStatus` attribute not `active`. Can you check the same proses with only `gluuStatus`?

By Sahil Arora user 04 Jul 2018 at 7:55 p.m. CDT

Copy
Sahil Arora gravatar
Hi Sakit gluuStatus is not part of core attributes of SCIM spec, but active is. As the service sets internally gluuStatus in LDAP with the value passed for active, that is the reason for this issue. You have also included gluuStatus as a custom attribute in the extension and it’s a bad idea because gluuStatus can be set twice in that case. So please remove it from there. Same goes for uid, mail, displayName, givenName, middleName, sn. They should not be part of extension.

By Sakit Atakishiyev user 04 Jul 2018 at 7:59 p.m. CDT

Copy
Sakit Atakishiyev gravatar
Understood. Thank you very much. But if you check my response you see that when `active` status change the `gluuStatus` does not change. But you mentioned that > As the service sets internally gluuStatus in LDAP with the value passed for active Just create a new user with SCIM API then get the new user info and check the response. `gluuStatus` return false even `active` is true. So that I enabled dynamic scim scripts and change this status manually

Post an answer