Repository navigation
Correcting SCIM filter - #55059
Open
hypery2k wants to merge 2 commits into
Open
Correcting SCIM filter#55059hypery2k wants to merge 2 commits into
hypery2k wants to merge 2 commits into
Conversation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The scalar comparison can select a value inconsistent with serialization and ignores longValue storage, causing filters to incorrectly exclude users with multiple stored values or attributes longer than 255 characters.
2 open issues
What changed in this PR
This PR addresses #53260 by aligning missing-value behavior for single-valued SCIM user attributes with direct entity fields.
Changes:
- Uses correlated scalar subqueries for single-valued collection-backed attributes while retaining
EXISTSfor multivalued attributes. - Adds regression tests for comparison, negation, and presence filters.
- Documents single-valued and multivalued negation semantics.
| File | Description |
|---|---|
scim/tests/base/src/test/java/org/keycloak/tests/scim/tck/FilterTest.java |
Tests missing-value semantics for standard and custom single-valued attributes. |
scim/model/src/main/java/org/keycloak/scim/model/filter/ScimJPAPredicateProvider.java |
Adds scalar subqueries for single-valued attribute filtering. |
docs/documentation/server_admin/topics/scim/filtering-resources.adoc |
Explains missing-value behavior under negated comparisons. |
Review effort: Balanced
hypery2k
force-pushed
the
bugfix/scim-filter
branch
from
November 11, 2026 18:19
999ffca to
e054090
Compare
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Long-value comparisons remain inconsistent: attr ne "Engineer" excludes a user that not (attr eq "Engineer") includes because comparisons do not account for LONG_VALUE.
1 open issue
2 resolved since last review
Review effort: Balanced
hypery2k
force-pushed
the
bugfix/scim-filter
branch
from
November 12, 2026 09:58
e054090 to
e654d5f
Compare
Comment on lines
+85
to
+88
| For a single-valued attribute, the negated comparison `not (attribute eq "value")` behaves like `attribute ne "value"` | ||
| and also does not match resources where the attribute has no value. For a multi-valued attribute, | ||
| `not (attribute eq "value")` matches resources that do not have the given value, including resources where the | ||
| attribute has no value. |
resolves keycloak#53260 Signed-off-by: Martin Reinhardt <martin@m13t.de>
hypery2k
force-pushed
the
bugfix/scim-filter
branch
from
November 12, 2026 10:08
e654d5f to
cd7f1fa
Compare
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Martin Reinhardt <martin@m13t.de>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
resolves #53260