Skip to content

[SCIM] Username uniqueness incorrectly enforced across realms #910

@dimOk00

Description

@dimOk00

Description

I have two separate realms:

  • In the first realm, I created a user with the username: scim_user_1.
  • In the second realm, I tried to create a user with the same username (scim_user_1).

I expected this to work since these are different realms and usernames should be scoped to a realm. However, I received a conflict error instead.

Response

{
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:Error"
    ],
    "status": "409",
    "scimType": "uniqueness",
    "detail": "attribute userName must be unique"
}

Expected Behavior

Usernames should be unique per realm, not globally. The user creation in the second realm should not conflict with an existing user in another realm.

Question

Is it possible to configure the uniqueness scope of the userName attribute to be realm-specific rather than server?

Currently, this is how the userName attribute is defined on my server:

{
  "name": "userName",
  "type": "string",
  "multiValued": false,
  "required": true,
  "caseExact": false,
  "mutability": "readWrite",
  "returned": "default",
  "uniqueness": "server",
  "description": "Unique identifier for the User, typically used by the user to directly authenticate to the service provider. Each User MUST include a non-empty userName value. This identifier MUST be unique across the service provider's entire set of Users."
}

Looking forward to your feedback!

Metadata

Metadata

Labels

bugSomething isn't working

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions