Does not retrieve all the users from the IdP #25

New issue

Open

opened 2024-11-22 17:46:33 +00:00 by fflorent · 0 comments

fflorent commented

2024-11-22 17:46:33 +00:00

When enabling "Periodic full sync", the client fetches the Service Provider users. It uses /Users for that purpose.

SCIMMY uses a pagination by default when requesting that endpoint.

I think SCIMMY is right, regarding section 3.4.2.4 of RFC7644, table 6 :

   | count      | Non-negative integer.      | None.  When specified,  |
   |            | Specifies the desired      | the service provider    |
   |            | maximum number of query    | MUST NOT return more    |
   |            | results per page, e.g.,    | results than specified, |
   |            | 10.  A negative value      | although it MAY return  |
   |            | SHALL be interpreted as    | fewer results.  If      |
   |            | "0".  A value of "0"       | unspecified, the        |
   |            | indicates that no resource | maximum number of       |
   |            | results are to be returned | results is set by the   |
   |            | except for "totalResults". | service provider.       |
   +------------+----------------------------+-------------------------+

Especially:

When specified, the service provider MUST NOT return more results than specified, although it MAY return fewer results. If unspecified, the maximum number of results is set by the service provider.

So I guess the client must use the pagination or otherwise it will not get all the results.

You may use count=BIG_NUMBER to circumvent some cases, with no warranty it will work in all cases.

When enabling "Periodic full sync", the client fetches the Service Provider users. It uses `/Users` for that purpose. SCIMMY uses a pagination by default when requesting that endpoint. I think SCIMMY is right, regarding [section 3.4.2.4 of RFC7644](https://www.rfc-editor.org/rfc/rfc7644#section-3.4.2.4), table 6 : ``` | count | Non-negative integer. | None. When specified, | | | Specifies the desired | the service provider | | | maximum number of query | MUST NOT return more | | | results per page, e.g., | results than specified, | | | 10. A negative value | although it MAY return | | | SHALL be interpreted as | fewer results. If | | | "0". A value of "0" | unspecified, the | | | indicates that no resource | maximum number of | | | results are to be returned | results is set by the | | | except for "totalResults". | service provider. | +------------+----------------------------+-------------------------+ ``` Especially: > When specified, the service provider MUST NOT return more results than specified, **although it MAY return fewer results**. If unspecified, the maximum number of results is set by the service provider. So I guess the client must use the pagination or otherwise it will not get all the results. You may use `count=BIG_NUMBER` to circumvent some cases, with no warranty it will work in all cases.

fflorent changed title from ~~Does not retrieve all the users in the IdP~~ to Does not retrieve all the users from the IdP

2024-11-22 17:46:49 +00:00

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: libre.sh/keycloak-scim#25

No description provided.