Fetching users returns users groups with all the groups members in them about scimgateway HOT 3 CLOSED

Hi,

You may test using plugin-loki

/Users groups attribute should have following syntax (value is mandatory) and only include groups the actual user is member of

	"groups": [{
			"value": "Employees",
			"display": "Employees",
			"type": "direct"
		}
	],

If your plugin getUsers method do not return groups, scimgateway will automatically try /Groups?filter=members.value eq "userid"&attributes=members.value,id,displayName and include groups accordingly

I suspect your getUsers method includes groups and do not use correct format as shown above
(but you also mention https://github.com/jelhub/scimgateway/blob/master/lib/scimgateway.js#L791 having the auto-apply logic when groups not included...)

You may also exclude groups from the response by using: /Users?excludedAttributes=groups
or your getUsers could include empty groups "groups": []

Regards,
Jarle

from scimgateway.

Your issue might refer to /Groups?filter=members.value eq "userid"&attributes=members.value,id,displayName returning what you mention (includes all members for the group user is member of)

Your are correct, skipping members.value in attributes is better attributes=id,displayName and I might look into this change, but I don't think general plugins care much of query attributes used. They probably return all supported without any query check.

The reason for including members.value was to double check that actual user is included in case plugin do not return /Groups as expected.

But anyhow these other members will not be included in the groups returned by /Users

Jarle

from scimgateway.

v4.1.10 have been published addressing this problem

Jarle

from scimgateway.