{"record":{"id":"fb194e134bcbf5f9","repo":"passbolt/passbolt_api","slug":"the-filter-for-attribute-s-is-not-supported-yet","errorCode":null,"errorMessage":"The filter for attribute `%s` is not supported yet","messagePattern":"The filter for attribute `(.+?)` is not supported yet","errorType":"exception","errorClass":"Passbolt\\Scim\\Exception\\ScimException","httpStatus":400,"severity":"warning","filePath":"plugins/PassboltEe/Scim/src/Utility/Object/ListResponse.php","lineNumber":122,"sourceCode":"        $conditions = [\n            $scimEntriesTable->aliasField('foreign_model') => ScimEntry::MODEL_MAP[$resourceType],\n        ];\n        if ($filter !== null) {\n            //@todo: tmilos/scim-filter-parser should be used if more filters are needed\n            $formattedFilter = str_replace('+eq+', ' eq ', $filter);\n            $formattedFilter = str_replace('\"', '', $formattedFilter);\n            $filterParts = explode(' ', $formattedFilter);\n            $attribute = $filterParts[0] ?? null;\n            $operator = $filterParts[1] ?? null;\n            $value = $filterParts[2] ?? null;\n            switch (strtolower($operator)) {\n                case 'eq':\n                    switch ($attribute) {\n                        case 'userName':\n                            $conditions[$scimEntriesTable->aliasField('scim_name')] = $value;\n                            break;\n                        default:\n                            throw new ScimException(\n                                sprintf('The filter for attribute `%s` is not supported yet', $attribute)\n                            );\n                    }\n                    break;\n                default:\n                    throw new ScimException(sprintf('The filter for operator `%s` is not supported yet', $operator));\n            }\n        }\n\n        $countQuery = $scimEntriesTable->find();\n        $this->resources = [];\n        $result = $countQuery\n            ->select(['count' => $countQuery->func()->count('id')])\n            ->where($conditions)\n            ->whereNull($scimEntriesTable->aliasField('deleted'))\n            ->first();\n        $this->totalResults = $result['count'] ?? 0;\n        if ($this->totalResults === 0) {","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Scim/src/Utility/Object/ListResponse.php#L104-L140","documentation":"fetchResources() implements only a tiny subset of SCIM filtering: the `eq` operator on the `userName` attribute (mapped to the scim_name column). Any other filter attribute throws ScimException with this message; any non-eq operator throws the sibling operator error. The plugin deliberately avoids a full filter parser (@todo mentions tmilos/scim-filter-parser).","triggerScenarios":"GET /scim/v2/Users?filter=emails eq \"a@b.c\" or filter=displayName eq \"x\" — i.e. eq on an attribute other than userName; also filter=userName pr, co/sw/ne operators (those hit the operator branch), and filters whose space-encoding (`+eq+`) splits into unexpected attribute tokens.","commonSituations":"IdP connectors that filter on displayName or externalId during lookups; Okta/Entra probes using advanced filters; filter strings where spaces were encoded as `+` but attribute names contain URL artifacts (quotes are stripped, but extra tokens shift the explode indices).","solutions":["Restrict the IdP SCIM connector to filter only on userName with eq, e.g. filter=userName eq \"ada@example.com\".","Disable or simplify features in the IdP that require other filters (e.g. turn off display-name matching in provisioning settings).","As a code change, extend the attribute switch in ListResponse::fetchResources() to support the needed attribute, or adopt tmilos/scim-filter-parser as noted in the @todo."],"exampleFix":"// before\nGET /scim/v2/Users?filter=displayName eq \"Ada\"\n// after\nGET /scim/v2/Users?filter=userName eq \"ada@example.com\"","handlingStrategy":"validation","validationCode":"const m = /^userName\\+eq\\+[^\\s]+$/i.test(encodedFilter);\nif (!m) throw new Error('Only `userName eq \"value\"` filters are supported');","typeGuard":null,"tryCatchPattern":"try {\n  const res = await fetch(`${base}/scim/v2/Users?filter=${encodeURIComponent('userName eq \"ada\"')}`);\n} catch (e) {\n  if (/not supported yet/.test(e.message)) {\n    // drop the filter and page through results, filtering client-side\n  }\n}","preventionTips":["Restrict IdP SCIM connectors to userName eq filters only.","Turn off displayName/externalId lookups in provisioning settings.","Encode spaces in filters consistently (the server translates `+eq+` to ` eq `).","For richer filtering, extend ListResponse or adopt tmilos/scim-filter-parser."],"tags":["scim","php","filtering","unsupported-operation"],"backgroundTag":"unsupported-operation","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}