Wrong parsing of Users PATCH body

[ermescs]

Hello,
I'm currently implementing a custom scimgateway plugin, that must work with SCIM 2.0.

I have run some tests, using Azure AD Provisioning Service as IdP. During tests excution, I identified an issue in parsing body of Users PATCH requests.

Consider the following PATCH body:

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
  "Operations": [
    {
      "op": "Add",
      "path": "name.givenName",
      "value": "Barbara"
    },
    {
      "op": "Add",
      "path": "name.familyName",
      "value": "Jensen"
    },
    {
      "op": "Add",
      "path": "name.formatted",
      "value": "Barbara Jensen"
    }
  ]
}

After parsing the body, scimgateway invokes my plugin by passing the following object:

{
  name: {
    givenName: undefined,
    familyName: undefined,
    formatted: undefined
  }
}

i.e. all values in the internal object are undefined.

This seems to be caused by the following line:

scimgateway/lib/scimgateway.js

Line 1560 in 27fe37a

} else dot.str(element.path, element.value[0].value, scimdata) // handle e.g name.familyName

If i replace element.value[0].value with element.value, i.e.:

} else dot.str(element.path, element.value, scimdata) // handle e.g name.familyName

then it seems to work as expected. Indeed, after applying this change, my plugin code receives the following data:

{
  name: {
    givenName: 'Barbara',
    familyName: 'Jensen',
    formatted: 'Barbara Jensen'
  }
}

I am willing to open a PR for this issue. However, I'm not sure if this change would be correct in any scenario or if it is just a workaround for this case.

[jelhub]

Hi,

My Azure (SCIM 2.0) testing gives following PATCH having value as array, which is handled correctly by scimgateway:

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
  "Operations": [{
      "op": "Add",
      "path": "name.givenName",
      "value": [{
          "$ref": null,
          "value": "Barbara"
        }
      ]
    }, {
      "op": "Add",
      "path": "name.familyName",
      "value": [{
          "$ref": null,
          "value": "Jensen"
        }
      ]
    }, {
      "op": "Add",
      "path": "name.formatted",
      "value": [{
          "$ref": null,
          "value": "Barbara Jensen"
        }
      ]
    }
  ]
}

Anyhow, v2.1.1 have now been published covering both scenarios

Thanks,
Jarle

[ermescs]

Well, this is weird. I repeated my tests with Azure and I keep receiving the non-array values 😅

Anyway, I can confirm that in version 2.1.1 this is correctly managed.

Thank you!