Nested fields not patched correctly when path field omitted

[finrod2002]

Describe the bug

When using the following code

final PatchRequest patchToBeApplied = new ObjectMapper()
            .readValue(patchRequest, PatchRequest.class);

final GenericScimResource resource = new ObjectMapper()
            .readValue(resourceJson, GenericScimResource.class);
            
 patchToBeApplied.apply(value);

in the result the nested fields are added instead of replaced.

patchRequest has the following body

{
    "Operations": [
        {
            "op": "replace",
            "value": {
                "name.familyName": "test",
                "name.formatted": "test test2"
            }
        }
    ],
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:PatchOp"
    ]
}

something like the following is produced

{
  "schemas" : [ "urn:ietf:params:scim:schemas:core:2.0:User", "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User" ],
  ...
  ...
  ...
  "name" : {
    "familyName" : "Young",
    "givenName" : "Joy"
  },
  ...
  ...
  ...
  "name.familyName" : "test",
  "name.formatted" : "test test2"
}

To Reproduce

1. Given following java code

final PatchRequest patchToBeApplied = new ObjectMapper()
            .readValue(patchRequest, PatchRequest.class);

final GenericScimResource resource = new ObjectMapper()
            .readValue(resourceJson, GenericScimResource.class);
            
 patchToBeApplied.apply(value);

2. With resourceJson set to the following JSON

{
  "schemas" : [ "urn:ietf:params:scim:schemas:core:2.0:User", "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User" ],
  "externalId" : "externalId-1",
  "meta" : {
    "resourceType" : "User"
  },
  "userName" : "user1",
  "name" : {
    "familyName" : "Young",
    "givenName" : "Joy"
  },
  "displayName" : "Joy Young",
  "active" : true,
  "emails" : [ {
    "value" : "user@org.com",
    "type" : "work",
    "primary" : true
  }, {
    "value" : "user@org-proxy.com",
    "type" : "work",
    "primary" : false
  } ],
  "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User" : {
    "department" : null,
    "manager" : null
  }
}

3. With patchToBeApplied set to

{
    "Operations": [
        {
            "op": "replace",
            "value": {
                "name.familyName": "test",
                "name.formatted": "test test2"
            }
        }
    ],
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:PatchOp"
    ]
}

4. Result is

{
  "schemas" : [ "urn:ietf:params:scim:schemas:core:2.0:User", "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User" ],
  "externalId" : "externalId-1",
  "meta" : {
    "resourceType" : "User"
  },
  "userName" : "user1",
  "name" : {
    "familyName" : "Young",
    "givenName" : "Joy"
  },
  "displayName" : "Joy Young",
  "active" : true,
  "emails" : [ {
    "value" : "user@org.com",
    "type" : "work",
    "primary" : true
  }, {
    "value" : "user@org-proxy.com",
    "type" : "work",
    "primary" : false
  } ],
  "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User" : {
    "department" : null,
    "manager" : null
  },
  "name.familyName" : "test",
  "name.formatted" : "test test2"
}

Expected behavior
The following pached JSON would be excpected.

{
  "schemas" : [ "urn:ietf:params:scim:schemas:core:2.0:User", "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User" ],
  "externalId" : "externalId-1",
  "meta" : {
    "resourceType" : "User"
  },
  "userName" : "user1",
  "name" : {
    "familyName" : "test",
    "givenName" : "Joy",
    "formatted" : "test test2"
  },
  "displayName" : "Joy Young",
  "active" : true,
  "emails" : [ {
    "value" : "user@org.com",
    "type" : "work",
    "primary" : true
  }, {
    "value" : "user@org-proxy.com",
    "type" : "work",
    "primary" : false
  } ],
  "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User" : {
    "department" : null,
    "manager" : null
  }
}

Additional context
Add any other context about the problem here. For example:

• JDK version 21
• SCIM 2 SDK version 3.0.0

Edit1: Improve JSON code formatting
Edit2: Add Java sample code

[kqarryzada]

@finrod2002, which SCIM service provider were you using that generated PATCH requests of this form?

[finrod2002]

@kqarryzada

This was Microsoft/Entra/Azure Scim provider. I use the validator here, this has to pass before an app can be published in the Microsoft Enterprise gallery.

https://scimvalidator.microsoft.com/

[willemvermeer]

Hi @finrod2002 did you ever find a solution for this problem? I am also testing my SCIM implementation from MS-Azure SCIM validator and facing the same issue.
Thanks,
Willem

[finrod2002]

@willemvermeer

Yes, I've solved it. At least lets say it works good enough for me. Here is the pull request:

#225

[willemvermeer]

Nice work - so it's up to the maintainer @kqarryzada to review & merge your PR - that would be great, thanks

[finrod2002]

@willemvermeer

Not sure it will ever be merged. They clearly state, they aren’t accepting any third party contributions.

https://github.com/pingidentity/scim2/blob/master/CONTRIBUTING.md#contributing-code-changes

So your best bet is to clone the fork and build your own JAR, I guess.

[ZeJ0hn]

One year after, this issue is still open so this library cannot patch and be validated by Entra SCIM validator.

[finrod2002]

Almost two years actually 🙂.

By the way, I don’t know if it’s the same for you, but publishing apps to the Microsoft Enterprise Gallery has been blocked for us for nearly two years as well. According to Microsoft, this was due to internal security reasons. They explained that they wanted to reshape their internal processes, and as part of that effort, SCIM (user provisioning) app publishing was paused.

Over the past couple of years, this has been the explanation we consistently received. From what we understand, they’ve now started the process of gradually reopening it, although the rollout appears to be quite slow.

If you’re interested in the background behind this decision, Microsoft shared more details here:

https://www.microsoft.com/en-us/security/blog/2024/05/03/security-above-all-else-expanding-microsofts-secure-future-initiative/