3808081 - IPS update fails with HTTP 400 when non-Datasphere/custom scoped roles are being provisioned to SAP Datasphere from IAS

IPS updates may fail with "HTTP 400 scimType=invalidValue, detail: "Request is unparsable, syntactically incorrect, or violates schema." when non-Datasphere roles are included in the sent SCIM payload. Example error log:

user:<ID>,
system=<datasphere_target_system>,
time=<time>,
error=HTTP operation failed invoking <URL> with statusCode: 400, Response: {"schemas":["urn:ietf:params:scim:api:messages:2.0:Error"],"status":"400","scimType":"invalidValue","detail":"Request is unparsable, syntactically incorrect, or violates schema."},
content={"Operations":[{"op":"replace","path":"active","value":true},{"op":"replace","path":"displayName","value":"<displayname>"},{"op":"replace","path":"emails","value":[{"primary":true,"value":"<email>"}]},{"op":"replace","path":"name","value":{"familyName":"<family_name>","givenName":"<given_name>"}},{"op":"replace","path":"roles","value":[{"value":"TEST_BC_GENERAL_ROLE"},{"value":"PROFILE:t.ZZZ:ZTEST_SCOPED_ROLE"}]},{"op":"replace","path":"urn:sap:params:scim:schemas:extension:sac:2.0:user-custom-parameters:idpUserId","value":"<idpUserId>"},{"op":"replace","path":"userName","value":"<user_name>"},{"op":"remove","path":"preferredLanguage"},{"op":"remove","path":"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:manager.value"},{"op":"remove","path":"externalId"},{"op":"remove","path":"photos"}],"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"]}

As per the above example, there is a need to provision the following roles:

• PROFILE:t.ZZZ:ZTEST_SCOPED_ROLE
• TEST_BC_GENERAL_ROLE

After checking the SAP Datasphere target system, there are no existing scoped roles present in the Datasphere, with the display name of "TEST_BC_GENERAL_ROLE", which could be updated.

• SAP Datasphere (DS)
• SAP Cloud Identity Services (CIS)
• SAP Identity Authentication Service (IAS)
• SAP Identity Provisioning Service (IPS)

datasphere role assignment, scoped role not assigned, viewer role assigned, IAS to datasphere, IPS transformation, group to role mapping, PROFILE prefix, SCIM 400 invalidValue, scim2 users, regex condition, role provisioning, saml role mapping, idpUserId, patch user roles, identity provisioning, IAS, IPS, DS , KBA , BC-IAM-IPS , Identity Provisioning Service (IPS) , DS-API , SAP Datasphere APIs , LOD-ANA-LS , Licensing and Full User Equivalent , Problem