[scim] Help needed on READ of single group GET /Groups/{id}

[Ashok Dhakar <[e-mail]>]

Hi Team,

The standard response defines the single group get result as
{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Group"],
  "id":"e9e30dba-f08f-4109-8486-d5c6a331660a",
  "displayName": "Tour Guides",
  "members":[
    {
      "value": "2819c223-7f76-453a-919d-413861904646",
      "$ref": "https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646",
      "display": "Babs Jensen"
    },
    {
      "value": "902c246b-6245-4190-8e05-00816be7344a",
      "$ref": "https://example.com/v2/Users/902c246b-6245-4190-8e05-00816be7344a",
      "display": "Mandy Pepperidge"
    }
  ],
  "meta": {
    "resourceType": "Group",
    "created": "2010-01-23T04:56:22Z",
    "lastModified": "2011-05-13T04:42:34Z",
    "version": "W\/\"3694e05e9dff592\"",
    "location": "https://example.com/v2/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a"
  }
}

In our case we have group with 50k members, so every time SCIM call is being made to GET the group details by its  /Groups/{Id}
We encounter performance problems as it ends up listing of all the members every time.
The problem becomes worse when we try to list of groups and each group contains 50k members. GET /Groups/{id}?count=20

As of now we are circumventing the problem by specifying the attributes as part of scim request /Groups/{id}?attributes=id,displayName.

Every time we do 3rd party integration with SCIM compliant adapters which is responsible for pushing the user information to our identity solutions this becomes as bottleneck,
as it requires code changes.

I was thinking to address this in the following way

  1.  Show only few members as part of /Groups/{id}
  2.  Provide another endpoint to fetch members with pagination support /Groups/{id}/members?count=100

I would like to know any better solutions to this problem or work in progress to address this so that I don’t implement the custom solution.

Regards,
Ashok