Empty Operations array

[hermanbanken]

SCIMMY rejects PATCH with an empty Operations array. This is correct. The RFC doesn't allow this, but it is quite easy to gracefully allow that case (ignore the request after authentication).

The Microsoft SCIM validator performs this empty PATCH. I've also opened a ticket in a tangentially related repo to that validator (as I could not find a contact). AzureAD/SCIMReferenceCode#112

Expected Behavior

Request does nothing

Actual Behavior

Gives error about operations being empty.

Steps To Reproduce

• scimmy/src/lib/messages/patchop.js

  Line 102 in dcf288f

  throw new Types.Error(400, "invalidValue", "PatchOp request body must contain 'Operations' attribute with at least one operation");

• scimmy/test/lib/messages/patchop.js

  Line 56 in dcf288f

  message: "PatchOp request body must contain 'Operations' attribute with at least one operation"},

[sleelin]

Hi @hermanbanken,
Apologies for the delay in addressing this issue, I have been otherwise engaged.
Unfortunately this is a known issue, having previously been reported to SCIMMY in issue #59.

As mentioned by you in this issue, and detailed in my previous response here, the correct behaviour per the SCIM protocol specification is that the PatchOp request body must contain at least one operation, or be considered an invalid request.

As the issue is with Microsoft's SCIM validator tool not being compliant with the specification, it must be resolved on their end, however I have not had any luck finding contact details at Microsoft for the tool to report the issue! It also seems the issue you raised with the Azure AD SCIM reference code has had no movement, so I am at a loss as to how to get it fixed.

Notwithstanding, the Entra ID SCIM Validator tool does not comply with the spec in a number of other ways, so I'd suggest seeking an alternative means of validation.

Let me know if you have any further questions, but for now I am closing this issue as fixing it would mean making SCIMMY also not compliant with the SCIM specification.

Thanks,
Sam