Symptom
Modifying existing users in Datasphere gives error
{ "schemas": [ "urn:ietf:params:scim:api:messages:2.0:Error" ], "status": "400", "scimType": "invalidValue", "detail": "Request is unparsable, syntactically incorrect, or violates schema."}
Environment
SAP Datasphere
Reproducing the Issue
Modify an existing user in Datasphere using a payload like this
{
"schemas": [
"urn:ietf:params:scim:api:messages:2.0:PatchOp"
],
"Operations": [
{
"op": "replace",
"path": "urn:sap:params:scim:schemas:extension:sac:2.0:user-custom-parameters.idpUserId",
"value": "lisa.garcia+1@company.com"
}
]
}
Cause
The idpUserId is configured as userid in the system SAML mapping under System->Administration->Security
Resolution
- The idpUserId should match what is configured for SAML mapping. This is documented under Create Users and Assign Them to Roles via the SCIM 2.0 API in the Note section: If you are using SAML authentication, idpUserId should be set to the property you are using for your SAML mapping. For example, the user's USER ID, EMAIL, or CUSTOM SAML MAPPING. If your SAML mapping is set to EMAIL, the email address you add to idpUserId must match the email address you use for email.
- If using IPS transformation to provision users then modify the json to use username. For additional help on this the correct component is BC-IAM-IPS
- If userid is used as the SAML mapping then the PATCH or PUT call should have the idpUserId in uppercase for example
{"op": "replace","path": "urn:sap:params:scim:schemas:extension:sac:2.0:user-custom-parameters.idpUserId","value": "LGARCIA"} - Issues with SCIM API can be checked directly with POSTMAN calls using the failing payload by following How to manage Users via SCIM 2.0 API
See Also
Keywords
IPS, 400, SCIM, API, unparsable, violates schema , KBA , DS-API , SAP Datasphere APIs , BC-IAM-IPS , Identity Provisioning Service (IPS) , Problem