SCIM Responses Contain Unadvertised Schema Extensions

[J-Bu]

Summary

The Wire SCIM server returns resource responses containing schema extensions that are not advertised in the ResourceType metadata. This violates the SCIM schema model defined in RFC 7643.

We use python-scim for communication with the SCIM server, which by default is very strict and validates all data against the schemas.

Expected behavior

Per RFC 7643 Section 3 (SCIM Resources), the schemas attribute of a resource response:

"MUST only contain values defined as 'schema' and 'schemaExtensions' for the resource's defined 'resourceType'. Duplicate values MUST NOT be included."

The ResourceType discovery endpoint (e.g., /ResourceTypes) declares which schema extensions are supported for each resource type via the schemaExtensions attribute. For the Wire SCIM server, the User ResourceType response shows:

ResourceType(..., name='User', ..., schema_extensions=None)

This means the User resource type advertises no schema extensions.

Actual behavior

The Wire SCIM server returns User resources containing two schema extensions that are not listed in the ResourceType's schemaExtensions:

{
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:User",
    "urn:wire:scim:schemas:profile:1.0",
    "urn:ietf:params:scim:schemas:extension:wire:1.0:User"
  ],
  "urn:ietf:params:scim:schemas:extension:wire:1.0:User": {},
  "urn:wire:scim:schemas:profile:1.0": {
    "richInfo": {
      "fields": [],
      "version": 0
    }
  },
  ...
}

The extensions urn:wire:scim:schemas:profile:1.0 and urn:ietf:params:scim:schemas:extension:wire:1.0:User are present in the response but not declared in the ResourceType's schemaExtensions array (which is null/None).

Screenshots

N/A

Additional context

• SCIM client library: python-scim, which enforces RFC-compliant schema validation by default, rejecting responses that contain undeclared schemas
• Validation errors manifest as pydantic deserialization failures when clients attempt to parse responses into models based on advertised schemas
• RFC 7643 Section 3: SCIM Resources
• RFC 7643 Section 3.3: Attribute Extensions to Resources
• RFC 7643 Section 6: ResourceType Schema
• RFC 7643 Section 8.6: ResourceType Representation

[fisx]

thanks for reporting, we'll look into it!