{"record":{"id":"7efe2a11e036cb8e","repo":"passbolt/passbolt_api","slug":"invalid-schema-for-scim-user-resource","errorCode":null,"errorMessage":"Invalid schema for SCIM User Resource","messagePattern":"Invalid schema for SCIM User Resource","errorType":"exception","errorClass":"Cake\\Http\\Exception\\BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Scim/src/Utility/Resource/UserScimResource.php","lineNumber":214,"sourceCode":"        $this->middleName = $data['name']['middleName'] ?? null;\n        if (isset($data['active'])) {\n            $this->active = (bool)$data['active'];\n        }\n        $emails = Hash::extract($data, 'emails.{n}[type=work].value');\n        $this->email = $emails[0] ?? null;\n\n        return $this;\n    }\n\n    /**\n     * @param array $data\n     * @return void\n     */\n    protected function validateScimUserData(array $data): void\n    {\n        $schemas = $data['schemas'] ?? [];\n        if (!in_array(SchemaIdentifier::CORE_USER, $schemas)) {\n            throw new BadRequestException('Invalid schema for SCIM User Resource');\n        }\n    }\n\n    /**\n     * @inheritDoc\n     */\n    public function setFromDatabase(string $internalId): self\n    {\n        if (!Validation::uuid($internalId)) {\n            throw new BadRequestException(__('The user identifier should be a valid UUID.'));\n        }\n        /** @var \\App\\Model\\Entity\\User|null $userEntity */\n        $userEntity = $this->Users\n            ->findForScim([$this->Users->aliasField('id') => $internalId], findDeleted: true)\n            ->contain(['Profiles', 'ScimEntries'])\n            ->first();\n        $this->userEntity = $userEntity;\n        if (!$this->userEntity) {","sourceCodeStart":196,"sourceCodeEnd":232,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Scim/src/Utility/Resource/UserScimResource.php#L196-L232","documentation":"A SCIM User resource payload must declare the core user schema identifier (SchemaIdentifier::CORE_USER, urn:ietf:params:scim:schemas:core:2.0:User) in its 'schemas' array. validateScimUserData throws this BadRequestException when creating or updating a user (setFromScim/put) with a payload missing that identifier, ensuring passbolt only processes conformant User resources.","triggerScenarios":"POST /scim/v2/Users (create) or PUT /scim/v2/Users/{id} (replace) with a body whose 'schemas' lacks the core User URN or has no 'schemas' key.","commonSituations":"Client sends a Group schema or Enterprise user extension URN only; schemas key omitted in custom scripts; IdP misconfigured resource type mapping; SCIM 1.1 URN used instead of 2.0.","solutions":["Include \"schemas\": [\"urn:ietf:params:scim:schemas:core:2.0:User\"] in the user payload.","Check SchemaIdentifier::CORE_USER in the plugin for the exact expected URN.","Fix the IdP/resource-type mapping so User provisioning payloads declare the core user schema.","Capture the raw request body and diff it against a known-good SCIM User example."],"exampleFix":"// before\n{\"userName\": \"jdoe@example.com\", \"name\": {...}}\n// after\n{\"schemas\": [\"urn:ietf:params:scim:schemas:core:2.0:User\"], \"userName\": \"jdoe@example.com\", \"name\": {...}}","handlingStrategy":"validation","validationCode":"const USER_SCHEMA = 'urn:ietf:params:scim:schemas:core:2.0:User';\nif (!in_array(USER_SCHEMA, $body['schemas'] ?? [], true)) {\n    throw new InvalidArgumentException('User payload must declare the core User schema URN');\n}","typeGuard":"function hasCoreUserSchema(mixed $body): bool {\n    return is_array($body)\n        && in_array('urn:ietf:params:scim:schemas:core:2.0:User', $body['schemas'] ?? [], true);\n}","tryCatchPattern":"try {\n    $resource = UserScimResource::setFromScim($data);\n} catch (BadRequestException $e) {\n    // inject/repair the schemas array before retry\n}","preventionTips":["Include urn:ietf:params:scim:schemas:core:2.0:User in all user create/replace payloads.","Don't send only enterprise-extension URNs without the core URN.","Verify IdP resource-type schema mappings.","Keep a golden example payload in your integration tests."],"tags":["scim","user","schema"],"backgroundTag":"schema-validation-failed","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}