SAP Knowledge Base Article - Public

3553974 - Datasphere SCIM API giving 400 error when modifying existing users

Symptom

Modifying existing users in Datasphere gives error

{ "schemas": [ "urn:ietf:params:scim:api:messages:2.0:Error" ], "status": "400", "scimType": "invalidValue", "detail": "Request is unparsable, syntactically incorrect, or violates schema."} 

Environment

SAP Datasphere

Reproducing the Issue

Modify an existing user in Datasphere using a payload like this 
{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:PatchOp"
  ],
  "Operations": [
    {
      "op": "replace",
      "path": "urn:sap:params:scim:schemas:extension:sac:2.0:user-custom-parameters.idpUserId",
      "value": "lisa.garcia+1@company.com"
    }
  ]
}

Cause

The idpUserId is configured as userid in the system SAML mapping under System->Administration->Security

Resolution

  • The idpUserId should match what is configured for SAML mapping. This is documented under Create Users and Assign Them to Roles via the SCIM 2.0 API in the Note section: If you are using SAML authentication, idpUserId should be set to the property you are using for your SAML mapping. For example, the user's USER ID, EMAIL, or CUSTOM SAML MAPPING. If your SAML mapping is set to EMAIL, the email address you add to idpUserId must match the email address you use for email.
  • If using IPS transformation to provision users then modify the json to use username. For additional help on this the correct component is BC-IAM-IPS
  • If userid is used as the SAML mapping then the PATCH or PUT call should have the idpUserId in uppercase for example 
    {
          "op": "replace",
          "path": "urn:sap:params:scim:schemas:extension:sac:2.0:user-custom-parameters.idpUserId",
          "value": "LGARCIA"
        }
  • Issues with SCIM API can be checked directly with POSTMAN calls using the failing payload by following How to manage Users via SCIM 2.0 API

See Also

IPS SAP Datasphere as Target

Keywords

IPS, 400, SCIM, API, unparsable, violates schema , KBA , DS-API , SAP Datasphere APIs , BC-IAM-IPS , Identity Provisioning Service (IPS) , Problem

Product

SAP Datasphere 1.0