{"record":{"id":"0d41e8bd39bcf7e1","repo":"passbolt/passbolt_api","slug":"invalid-schema","errorCode":null,"errorMessage":"Invalid Schema","messagePattern":"Invalid Schema","errorType":"http","errorClass":"ScimException","httpStatus":400,"severity":"warning","filePath":"plugins/PassboltEe/Scim/src/Utility/Schemas.php","lineNumber":77,"sourceCode":"            $schemas[] = self::build($identifier);\n        }\n\n        return $schemas;\n    }\n\n    /**\n     * Build a schema object given the id\n     *\n     * @param string $schemaId\n     * @return \\Passbolt\\Scim\\Utility\\ScimObjectInterface\n     * @throws \\Passbolt\\Scim\\Exception\\ScimException\n     * @throws \\Exception\n     */\n    public static function build(string $schemaId): ScimObjectInterface\n    {\n        $schemaClass = self::MAPPING[$schemaId] ?? null;\n        if (!$schemaClass) {\n            throw new ScimException(__('Invalid Schema'));\n        }\n\n        return new $schemaClass();\n    }\n}\n","sourceCodeStart":59,"sourceCodeEnd":83,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Scim/src/Utility/Schemas.php#L59-L83","documentation":"Schemas::build() looks up a SCIM schema id (a URN like urn:ietf:params:scim:schemas:core:2.0:User) in its MAPPING of known schemas. If the id is unknown, it throws ScimException 'Invalid Schema'. Passbolt only implements the core User and Group schemas.","triggerScenarios":"Requesting /scim/v2.0/Schemas/{id} with an unknown or misspelled schema URN; client code calling Schemas::build() with an id not in MAPPING (e.g. an Enterprise extension schema the client expects but passbolt does not provide).","commonSituations":"IdP probing for schemas passbolt doesn't implement (e.g. urn:...:enterprise:2.0:User); typo in a custom integration's schema URN; case-sensitivity issues in the URN.","solutions":["Use only the supported schema URNs: urn:ietf:params:scim:schemas:core:2.0:User and urn:ietf:params:scim:schemas:core:2.0:Group (see SchemaIdentifier / GET /Schemas).","Check GET /scim/v2.0/Schemas to list exactly which schemas passbolt advertises, and make the client consume that list instead of hardcoding extra ones.","If your IdP requires an unsupported schema (e.g. Enterprise User), disable that feature in the IdP mapping or contribute/extend the MAPPING in Schemas.php."],"exampleFix":"// before\nSchemas::build('urn:ietf:params:scim:schemas:extension:enterprise:2.0:User'); // throws\n// after\nif (Schemas::isValid($schemaId)) {\n    $schema = Schemas::build($schemaId);\n}","handlingStrategy":"validation","validationCode":"const SUPPORTED_SCHEMAS = [\n  'urn:ietf:params:scim:schemas:core:2.0:User',\n  'urn:ietf:params:scim:schemas:core:2.0:Group',\n];\nif (!SUPPORTED_SCHEMAS.includes(schemaUrn)) {\n  console.warn('Schema not supported by passbolt, skipping');\n}","typeGuard":"function isSupportedSchema(urn) {\n  return typeof urn === 'string' &&\n    /^urn:ietf:params:scim:schemas:core:2\\.0:(User|Group)$/.test(urn);\n}","tryCatchPattern":"try {\n  const schema = await fetchSchema(urn);\n} catch (e) {\n  if (e.response && e.response.status === 400) {\n    // unknown schema: fall back to GET /Schemas discovery\n  }\n}","preventionTips":["Discover schemas via GET /scim/v2.0/Schemas instead of hardcoding URNs.","Match URNs case-sensitively and exactly.","Don't require Enterprise/extension schemas passbolt does not advertise."],"tags":["scim","schema","unsupported-value"],"backgroundTag":"unsupported-enum-value","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}