I have a .NET service with a SCIM project. This is for App Provisioning (Azure/Entra ID), SCIM 2.0, provisioning users from the customer's Azure Active Directory, into my MySQL database.
However, a user can also be created manually in on my platform, and will therefore not have an ObjectId, only an Email. The Provisioning Service will (before creating a new user), check if one already exists with the same ObjectId, and then insert additional data coming from the attributes in the scope for provisioning if that is the case.
//ExternalId filter
else if (andFilter.AttributePath.Equals(AttributeNames.ExternalIdentifier
, StringComparison.OrdinalIgnoreCase))
{
if (andFilter.FilterOperator != ComparisonOperator.Equals)
{
throw new NotSupportedException(
string.Format(
SystemForCrossDomainIdentityManagementServiceResources
.ExceptionFilterOperatorNotSupportedTemplate, andFilter.FilterOperator));
}
var externalIdentifier = andFilter.ComparisonValue;
if (!Guid.TryParse(externalIdentifier, out var uniqueIdentifier))
{
return Enumerable.Empty<Resource>().ToArray();
}
predicate = predicate.And(a =>
a.ObjectId == uniqueIdentifier || a.Uuid == uniqueIdentifier);
}
Now, I want to do the same with Email. However, when adding presedence for the source mapping in the Provisioning overview:
I get a really strange value from for the email attribute name, when i do the same thing for Email:
// Email filter
else if (andFilter.AttributePath.Equals(AttributeNames.EmailAddress, StringComparison.OrdinalIgnoreCase))
{
if (andFilter.FilterOperator != ComparisonOperator.Equals)
{
throw new NotSupportedException(
string.Format(
SystemForCrossDomainIdentityManagementServiceResources
.ExceptionFilterOperatorNotSupportedTemplate, andFilter.FilterOperator));
}
string? email = andFilter.ComparisonValue.Substring(17);
predicate = predicate.And(a => a.Email.Equals(email));
}
In order for the above to work, I had to add a really awkward Attribute name the the AttributeNames class:
public const string EmailAddress = "emails[type";
This is the value that comes out of andFilter.AttributePath
It gets even more weird when looking at the andFilter.ComparisonValue
which is work"].value eq "[email protected]
Which is not what i want to compare with when looking for the user. This is why i have the string? email = andFilter.ComparisonValue.Substring(17);
to remove the first 17 characters to only look up the email.
However, is there not a better way? It must be possible to easily recieve a multivalued attribute for email and look it up? What am I doing wrong?