{"record":{"id":"c272818acdebb7f8","repo":"passbolt/passbolt_api","slug":"the-filter-for-operator-s-is-not-supported-yet","errorCode":null,"errorMessage":"The filter for operator `%s` is not supported yet","messagePattern":"The filter for operator `(.+?)` is not supported yet","errorType":"exception","errorClass":"Passbolt\\Scim\\Exception\\ScimException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Scim/src/Utility/Object/ListResponse.php","lineNumber":128,"sourceCode":"            $formattedFilter = str_replace('\"', '', $formattedFilter);\n            $filterParts = explode(' ', $formattedFilter);\n            $attribute = $filterParts[0] ?? null;\n            $operator = $filterParts[1] ?? null;\n            $value = $filterParts[2] ?? null;\n            switch (strtolower($operator)) {\n                case 'eq':\n                    switch ($attribute) {\n                        case 'userName':\n                            $conditions[$scimEntriesTable->aliasField('scim_name')] = $value;\n                            break;\n                        default:\n                            throw new ScimException(\n                                sprintf('The filter for attribute `%s` is not supported yet', $attribute)\n                            );\n                    }\n                    break;\n                default:\n                    throw new ScimException(sprintf('The filter for operator `%s` is not supported yet', $operator));\n            }\n        }\n\n        $countQuery = $scimEntriesTable->find();\n        $this->resources = [];\n        $result = $countQuery\n            ->select(['count' => $countQuery->func()->count('id')])\n            ->where($conditions)\n            ->whereNull($scimEntriesTable->aliasField('deleted'))\n            ->first();\n        $this->totalResults = $result['count'] ?? 0;\n        if ($this->totalResults === 0) {\n            return $this;\n        }\n\n        /** @var array<\\Passbolt\\Scim\\Model\\Entity\\ScimEntry> $scimResources */\n        $scimResources = $scimEntriesTable\n            ->find()","sourceCodeStart":110,"sourceCodeEnd":146,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Scim/src/Utility/Object/ListResponse.php#L110-L146","documentation":"A SCIM list request contained a filter expression using an operator the SCIM plugin cannot translate into a database query. The filter parser supports a limited set of operators (e.g. eq, co, sw); any other operator (or an unsupported attribute/operator combination) hits the default case and throws this ScimException. It exists to fail fast instead of silently ignoring the filter and returning wrong results.","triggerScenarios":"Calling GET /scim/v2/Users?filter=... or GET /scim/v2/Groups?filter=... via ScimFilterParser/SCIM list fetchResources with an operator like pr, ne, gt, lt, or a compound expression that the parser maps to an unsupported operator branch.","commonSituations":"An identity provider (Okta, Azure AD, JumpCloud) sends filters beyond passbolt's supported subset during user sync; a custom SCIM client hand-writes a filter string; a new IdP provisioning rule uses 'ne' or 'pr' on userName or externalId.","solutions":["Inspect the filter attribute in the request URL and rewrite it using a supported operator (eq, co, sw as supported by the plugin).","If the filter comes from an IdP, change the IdP provisioning/matching rule to use a supported filter (e.g. userName eq \"...\").","Check ListResponse.php and ScimFilterParser to see which operators are implemented, and extend the match branches if you own the plugin code to add the needed operator.","As a workaround, list without a filter and filter client-side."],"exampleFix":"// before\nGET /scim/v2/Users?filter=userName ne \"jdoe\"\n// after\nGET /scim/v2/Users?filter=userName eq \"jdoe\"","handlingStrategy":"validation","validationCode":"// Before sending a SCIM list request\n$allowed = ['eq', 'co', 'sw']; // operators supported by passbolt SCIM\n$parsed = parseScimFilter($filter); // your client-side parser\nif (!in_array($parsed->operator, $allowed, true)) {\n    throw new InvalidArgumentException(\"Unsupported SCIM filter operator: {$parsed->operator}\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    $resources = $scimClient->listUsers(['filter' => $filter]);\n} catch (ScimException $e) {\n    if (str_contains($e->getMessage(), 'is not supported yet')) {\n        // fall back to unfiltered listing + client-side filtering\n    }\n}","preventionTips":["Only use eq/co/sw filters against passbolt SCIM endpoints.","Configure IdP matching rules to supported operators.","Keep the filter parser source handy to confirm supported operators before extending filters.","Test filter expressions in staging before enabling provisioning rules."],"tags":["scim","filter","unsupported-operator"],"backgroundTag":"unsupported-operation","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}