Subject: [scim] Common error in patch

From: Phil Idm Hunt <[email-masked]>
Date: Thu, 11 Jul 2019 07:52:31 -0700

Hi all,

There is a common mistake done by many SCIM client implementers for SCIM PATCH to remove specific instance of a CMVA.  Instead of giving the correct patch operation like this
 
{
"op": "remove",
"path": "members[value eq \"504e89bd43a24181b607ad672ec9378d\"]"
}
 
The following  is used:
 
{
"op": "remove",
"path": "members”,
“value”: "504e89bd43a24181b607ad672ec9378d”
}
 
The later form removes all the members of the group.  Many implementations won’t expect “value” and ignores it causing the whole attribute(all values) to be removed. 

As a caution service providers should check for the erroneous value parameter. 

Phil