passbolt/passbolt_api · warning · Passbolt\Scim\Exception\ScimException

The filter for attribute

Error message

The filter for attribute `%s` is not supported yet

What it means

fetchResources() implements only a tiny subset of SCIM filtering: the `eq` operator on the `userName` attribute (mapped to the scim_name column). Any other filter attribute throws ScimException with this message; any non-eq operator throws the sibling operator error. The plugin deliberately avoids a full filter parser (@todo mentions tmilos/scim-filter-parser).

Solutions

1. Restrict the IdP SCIM connector to filter only on userName with eq, e.g. filter=userName eq "ada@example.com".
2. Disable or simplify features in the IdP that require other filters (e.g. turn off display-name matching in provisioning settings).
3. As a code change, extend the attribute switch in ListResponse::fetchResources() to support the needed attribute, or adopt tmilos/scim-filter-parser as noted in the @todo.

Example fix

// before
GET /scim/v2/Users?filter=displayName eq "Ada"
// after
GET /scim/v2/Users?filter=userName eq "ada@example.com"

const m = /^userName\+eq\+[^\s]+$/i.test(encodedFilter);
if (!m) throw new Error('Only `userName eq "value"` filters are supported');

try {
  const res = await fetch(`${base}/scim/v2/Users?filter=${encodeURIComponent('userName eq "ada"')}`);
} catch (e) {
  if (/not supported yet/.test(e.message)) {
    // drop the filter and page through results, filtering client-side
  }
}

When it happens

Trigger: GET /scim/v2/Users?filter=emails eq "a@b.c" or filter=displayName eq "x" — i.e. eq on an attribute other than userName; also filter=userName pr, co/sw/ne operators (those hit the operator branch), and filters whose space-encoding (`+eq+`) splits into unexpected attribute tokens.

Common situations: IdP connectors that filter on displayName or externalId during lookups; Okta/Entra probes using advanced filters; filter strings where spaces were encoded as `+` but attribute names contain URL artifacts (quotes are stripped, but extra tokens shift the explode indices).

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• Could not validate the SCIM settings.
• Could not validate the SCIM settings found in database.
• Invalid Resource type
• Please delete previous settings before creating again.
• The operation type ` ` is not supported or invalid

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/fb194e134bcbf5f9. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Scim/src/Utility/Object/ListResponse.php:122

        $conditions = [
            $scimEntriesTable->aliasField('foreign_model') => ScimEntry::MODEL_MAP[$resourceType],
        ];
        if ($filter !== null) {
            //@todo: tmilos/scim-filter-parser should be used if more filters are needed
            $formattedFilter = str_replace('+eq+', ' eq ', $filter);
            $formattedFilter = str_replace('"', '', $formattedFilter);
            $filterParts = explode(' ', $formattedFilter);
            $attribute = $filterParts[0] ?? null;
            $operator = $filterParts[1] ?? null;
            $value = $filterParts[2] ?? null;
            switch (strtolower($operator)) {
                case 'eq':
                    switch ($attribute) {
                        case 'userName':
                            $conditions[$scimEntriesTable->aliasField('scim_name')] = $value;
                            break;
                        default:
                            throw new ScimException(
                                sprintf('The filter for attribute `%s` is not supported yet', $attribute)
                            );
                    }
                    break;
                default:
                    throw new ScimException(sprintf('The filter for operator `%s` is not supported yet', $operator));
            }
        }

        $countQuery = $scimEntriesTable->find();
        $this->resources = [];
        $result = $countQuery
            ->select(['count' => $countQuery->func()->count('id')])
            ->where($conditions)
            ->whereNull($scimEntriesTable->aliasField('deleted'))
            ->first();
        $this->totalResults = $result['count'] ?? 0;
        if ($this->totalResults === 0) {

View on GitHub (pinned to 31c1bbc10f)