SCIM, GROUP.members VS USER.groups properties in default mappings

Hello all,

it is OIM v9.0.

Mappings in a SCIM project can be automatically created/generated based on default templates and the schemas provided, one of them is the default "SCIM synchronization" template.

In our case, both User as well as Group schemas include properties to read memberships (we have User.groups and Group.members).

Group.members is defined as ReadWrite property, so the one to use for provisioning.

User.groups is defined as ReadOnly, i.e. no provisioning would be possible.

The problem is, the automatically generated mapping chooses User schema to provision memberships, that obviously does not work.

Is there any easy solution to fix it in advance (at the time one creates a SCIM project), is it the only option to load schema files manually, i.e. to remove User.groups attribute in the schema? Or any other ideas how to say to the system to use Group.members instead of the other one?

Thanks in advance and best regards,

Alexey

Parents
  • Just to have it noted here. To overcome the problem one can exclude the readOnly property out of the schemas and create default mappings based on it, system correctly identifies the GROUP.members attribute then and creates correct mapping.

    Hopefully it can be corrected in future version (so that system automatically distinguishes between readOnly and readWrite attributes for provisioning).

Reply
  • Just to have it noted here. To overcome the problem one can exclude the readOnly property out of the schemas and create default mappings based on it, system correctly identifies the GROUP.members attribute then and creates correct mapping.

    Hopefully it can be corrected in future version (so that system automatically distinguishes between readOnly and readWrite attributes for provisioning).

Children
No Data