Re: [scim] How to patch multi-valued nested attributes?

[Phil Hunt <[e-mail]>]

Aleksey

Unfortunately there is no mass-update style function in SCIM. PATCH only impacts one specific resource at a time. By design each transaction impacts only a single resource at a time. Even inside of “bulk” the transaction semantics a per resource.

You really have to do this in two or more steps.  

1. Query for a set of resources that need updating
2. Apply the patch to each resource

For step 2, you can do as multiple calls for each resource, or be as a “bulk” request if supported by the provider.

Phil Hunt | Cloud Security and Identity Architect
Oracle Corporation, Oracle Cloud Infrastructure
@independentid
www.independentid.com
[e-mail]






> On Feb 25, 2019, at 10:37 AM, Aleksey Chernoraenko <[e-mail]> wrote:
> 
> Hello,
> 
> In our SCIM Resource Provider we have resources that have the nested multi-valued attributes. It looks like this:
> GET /GroupSets/98ae2a7c-40a5-4fff-b59a-5b922908239e
> {    ...
>     "name": "collection #1",
>     "groups": [ { 
>         "value": "a0115001-0fd7-4b50-b7b4-ac29d57cc623",
>         "$ref": ".../groups/a0115001-0fd7-4b50-b7b4-ac29d57cc623",
>         ...
>         }, ...
>     ], ...
> }
> 
> We use groups endpoint when we update group members, like 
> PATCH /Groups/a0115001-0fd7-4b50-b7b4-ac29d57cc623
> {   ...
>     "operations": [ { 
>         "op": "add", "path": "members", "value": "db81119f-5ee0-464e-b7e3-51573b62b56a" 
>         } ]
> }
> 
> I understand how the request should look like if I want to update one group members via parent (groupset) endpoint:
> PATCH /GroupSets/98ae2a7c-40a5-4fff-b59a-5b922908239e
> {   ...
>     "operations": [ { 
>         "op": "add", "path": "groups[value eq \"a0115001-0fd7-4b50-b7b4-ac29d57cc623\"].members", ...
>         } ]
> }
> 
> but wonder how I can specify "members" from all or a filtered set of "groups" without enumeration all of them on client side?
> 
> The path value might look like "groups[].members", or "groups[*].members", or even "groups.members".
> 
> It seems that the spec leaves this question open. What should or can happen if more than one group would be found?
> 
> ---
> Thank you,
> Alexei
> 
> _______________________________________________
> scim mailing list
> [e-mail]
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_scim&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=J5uAPT1VUXS--3Zqx02iJFx-Kh1FYPojmNLiY1UIV9c&s=3pJVZK_E4QPr_rZxk8h7qoWTXDo2XRCEJTDhYKRAgD0&e=