SCIMWeb Component
Properties Methods Events Config Settings Errors
The SCIMWeb component provides an easy way to add automatic user and group provisioning to your web application.
Syntax
nsoftware.CloudSSO.SCIMWeb
Remarks
The System for Cross-domain Identity Management (SCIM) protocol gives an Identity Provider (e.g., Okta or Microsoft Entra ID) a standardized way to automatically create, update, and deactivate accounts in your application. Instead of an administrator manually managing an account in every connected application, SCIM lets the Identity Provider push those changes out over a simple REST/JSON API whenever a user is hired, changes departments, or leaves the company.
The Identity Provider acts as the client, and your application is the SCIM service provider. This component implements the service provider role. It parses incoming HTTP requests, fires an event so your application can create, look up, update, or delete the corresponding record in its own data store, and then builds the SCIM JSON response.
Unlike the SCIMDesktop component, which hosts its own embedded HTTP server, this component is designed to be embedded within an existing web application or framework, using the ProcessRequest method to handle each incoming request. This makes it well suited to an application that is already running within an existing web server or framework.
Setup
The ProcessRequest method should be called from your web framework's request handler whenever a request arrives for the SCIM base URL. When using the component within an ASP.NET Core application, the current HttpContext should instead be passed to the constructor, allowing the component to read the request from, and write the response to, that context automatically, as shown below.
SCIMWeb scim = new SCIMWeb(HttpContext);
scim.ProcessRequest();
If no HttpContext is available, or when working within a framework that does not expose the raw request directly, the RequestMethod, RequestURI, RequestHeaders, and RequestBody properties may be set before calling ProcessRequest. The ResponseStatus, ResponseHeaders, and ResponseBody properties may then be read afterward to write the response.
scim.RequestMethod = request.Method;
scim.RequestURI = request.RawUrl;
scim.RequestHeaders = GetHeaderString(request);
scim.RequestBody = requestBodyString;
scim.ProcessRequest();
response.StatusCode = scim.ResponseStatus;
WriteHeaders(response, scim.ResponseHeaders);
response.Write(scim.ResponseBody);
The component may also be configured with information about which SCIM operations to support and how requests should be routed. The BaseURL property is the path prefix used to recognize SCIM resource paths, and the SupportedOperations property is a bitmask that controls which combinations of HTTP method and resource type are accepted. The MaxResults property dictates how many resources can be returned from a single list request.
scim.BaseURL = "/scim/v2";
scim.SupportedOperations = SupportedOperations.sopAll;
scim.MaxResults = 200;
Authentication
Every incoming request fires the AuthRequest event before any resource-specific event is raised, giving the application the chance to accept or reject the request, unless the AuthEnabled configuration setting has been disabled. The AuthMethod parameter identifies the scheme supplied by the client, detailed below.
| Bearer | The scheme used by most Identity Provider integrations. The Token parameter contains the raw bearer token. If the AuthToken property has been set, the component automatically compares it against the incoming token and pre-initializes the Accept parameter with the result, so a simple deployment does not need an AuthRequest handler at all. |
| Basic | The component decodes the credentials and provides the username and password through the User and Token parameters. No automatic comparison is performed. |
| Other/Unrecognized | The Accept parameter defaults to false and the application must explicitly accept the request from within an AuthRequest handler. |
| "" (empty string) | No Authorization header was present. User and Token are both empty and the Accept parameter defaults to false. |
A static bearer token may be supplied to the component as shown.
scim.AuthToken = "the-token-issued-to-your-identity-provider";
Alternatively, custom validation may be performed as shown.
scim.OnAuthRequest += (sender, e) => {
e.Accept = e.AuthMethod == "Bearer" && tokenStore.IsValid(e.Token);
};
User Management
The component fires an event for each standard SCIM user operation, giving the application full control over how users are stored.
Creating a User
A POST /Users request causes the CreateUser event to be fired with the submitted attributes, including any addresses and phone numbers through the UserEmails and UserPhones collections and enterprise attributes (department, employee number, manager, and so on) through the UserExtension property. The handler must assign and return a unique UserId and set the StatusCode parameter to 201.
Retrieving and Listing Users
A GET /Users/{id} request causes the GetUser event to be fired. The handler populates the user's current attributes and the AddUserEmail, AddUserPhone, and AddUserExtension methods may be called to include any related data.
A GET /Users request causes the ListUsers event to be fired instead, with pagination reflected in the StartIndex and Count parameters and, for simple single-term filters such as userName eq "jsmith", the parsed FilterAttribute, FilterOperator, and FilterValue parameters. The AddUser method should be called once per matching user, and the TotalResults parameter should be set to the total across all pages.
scim.OnListUsers += (sender, e) => {
var page = db.QueryUsers(e.FilterAttribute, e.FilterOperator, e.FilterValue, e.StartIndex - 1, e.Count);
foreach (var user in page.Results) {
scim.AddUser(user.Id, user.UserName, user.DisplayName, user.ExternalId, user.Active);
}
e.TotalResults = page.TotalCount;
e.StatusCode = 200;
};
Updating and Deleting Users
Both PUT /Users/{id} and PATCH /Users/{id} requests cause the UpdateUser event to be fired. For a PATCH request, the component first fires the GetUser event to load the current record, applies the patch operations from the request (including path-filtered operations such as emails[type eq "work"]) internally, and then fires the UpdateUser event with the fully merged result, so the handler always sees a complete, final representation of the user regardless of which method was used. The read-only RequestType property should be used if the handler needs to distinguish which method triggered the current event.
A DELETE /Users/{id} request causes the DeleteUser event to be fired. Deactivating a user without deleting their record is done the standard SCIM way, by setting the Active parameter to false through an update rather than issuing a delete.
Group Management
Groups follow the same pattern as users, and the CreateGroup, GetGroup, ListGroups, UpdateGroup, and DeleteGroup events all mirror their user counterparts. Group members are provided through the GroupMembers collection on create and update, and are added to an outgoing response with the AddGroupMember method. The AddGroup method is used to add each group to a ListGroups event response.
Discovery Endpoints
The component automatically answers the standard SCIM discovery endpoints so an Identity Provider can inspect your service provider's capabilities before provisioning begins.
A GET /ServiceProviderConfig request, which causes the GetServiceProviderConfig event to be fired, advertises the supported authentication scheme and which operations are enabled, based on the SupportedOperations property. GET /ResourceTypes requests, which cause the GetResourceTypes event to be fired, and GET /Schemas requests, which cause the GetSchemas event to be fired, describe the User and Group resource and schema definitions, including the enterprise user extension. All three events are informational, so the response body has already been generated by the time each one fires.
Property List
The following is the full list of the properties of the component with short descriptions. Click on the links for further details.
| AuthToken | The Bearer token used to authenticate incoming SCIM requests. |
| BaseURL | The base URL path for SCIM endpoints. |
| GroupMembers | A collection of members for the current group. |
| MaxResults | The maximum number of resources requested from the application in a single list request. |
| RequestBody | The body of the incoming SCIM request. |
| RequestHeaders | The HTTP headers of the incoming SCIM request. |
| RequestMethod | The HTTP method of the incoming SCIM request. |
| RequestType | The HTTP method of the request currently being processed. |
| RequestURI | The URI of the incoming SCIM request. |
| ResponseBody | The body of the SCIM response generated by the component. |
| ResponseHeaders | The HTTP headers of the SCIM response generated by the component. |
| ResponseStatus | The HTTP status code of the SCIM response generated by the component. |
| SupportedOperations | A bitmask that controls which SCIM operations the component accepts. |
| UserEmails | A collection of email addresses for the current inbound user. |
| UserExtension | The enterprise extension attributes for the current inbound user. |
| UserPhones | A collection of phone numbers for the current inbound user. |
Method List
The following is the full list of the methods of the component with short descriptions. Click on the links for further details.
| AddGroup | Adds a group entry to the outgoing list response. |
| AddGroupMember | Adds a member to the outgoing group response. |
| AddUser | Adds a user entry to the outgoing list response. |
| AddUserEmail | Adds an email address to the outgoing user response. |
| AddUserExtension | Adds enterprise extension attributes to the outgoing user response. |
| AddUserPhone | Adds a phone number to the outgoing user response. |
| Config | Sets or retrieves a configuration setting. |
| ProcessRequest | Processes an incoming SCIM request and generates a response. |
| Reset | This method will reset the component. |
Event List
The following is the full list of the events fired by the component with short descriptions. Click on the links for further details.
| AuthRequest | Fired for every incoming request to control access to specific endpoints. |
| CreateGroup | Fired when a request to create a new group is received. |
| CreateUser | Fired when a request to create a new user is received. |
| DeleteGroup | Fired when a request to delete a group is received. |
| DeleteUser | Fired when a request to delete a user is received. |
| Error | Fired when an error occurs while processing a SCIM request. |
| GetGroup | Fired when a request to retrieve a group is received, before a PATCH group update, or when ETags are enabled and a PUT or DELETE request includes an If-Match header. |
| GetResourceTypes | Fired when a request for the resource type definitions is received. |
| GetSchemas | Fired when a request for the schema definitions is received. |
| GetServiceProviderConfig | Fired when a request for the service provider configuration is received. |
| GetUser | Fired when a request to retrieve a user is received, before a PATCH user update, or when ETags are enabled and a PUT or DELETE request includes an If-Match header. |
| ListGroups | Fired when a request to list groups is received. |
| ListUsers | Fired when a request to list users is received. |
| Log | Fired once for each log message. |
| UpdateGroup | Fired after the current group has been loaded and a replace or update request has been applied. |
| UpdateUser | Fired after the current user has been loaded and a replace or update request has been applied. |
Config Settings
The following is a list of config settings for the component with short descriptions. Click on the links for further details.
| AuthEnabled | Whether incoming HTTP authentication credentials are validated. |
| ETagEnabled | Whether to include ETag headers in user and group responses. |
| IgnoreUnknownPatchAttributes | Whether to ignore PATCH operations that target unsupported attributes. |
| LogLevel | Controls the level of detail that is logged through the Log event. |
| RequestBody | The body of the most recently received SCIM request. |
| XChildCount | The number of child elements of the current JSON element. |
| XChildName[i] | The name of a child JSON element. |
| XChildXText[i] | The text of a child JSON element. |
| XElement | The name of the current JSON element. |
| XParent | The parent of the current JSON element. |
| XPath | Selects an element in the most recently received SCIM JSON request. |
| XSubTree | A snapshot of the current JSON element. |
| XText | The text of the current JSON element. |
| BuildInfo | Information about the product's build. |
| GUIAvailable | Whether or not a message loop is available for processing events. |
| LicenseInfo | Information about the current license. |
| MaskSensitiveData | Whether sensitive data is masked in log messages. |
| UseInternalSecurityAPI | Whether or not to use the system security libraries or an internal implementation. |
AuthToken Property (SCIMWeb Component)
The Bearer token used to authenticate incoming SCIM requests.
Syntax
Default Value
""
Remarks
When this property is set, the component compares the incoming authorization bearer token against its value and initializes the Accept parameter of the AuthRequest event accordingly before the event fires. If the token is missing or does not match, the Accept parameter will be set to false. Likewise, if a match is found, the Accept parameter will be set to true. This value may be overridden in the handler when the AuthRequest event fires (e.g., the handler can reject a matching token to enforce expiry or check a revocation list).
This property only takes effect for Bearer authentication and has no influence on other authentication schemes.
When this property is empty, no automatic comparison is performed and Accept defaults to false. Without an AuthRequest handler that explicitly accepts the request, all incoming requests receive a 401 Unauthorized response.
BaseURL Property (SCIMWeb Component)
The base URL path for SCIM endpoints.
Syntax
Default Value
"/scim/v2"
Remarks
This property defines the base path prefix the component uses when routing incoming requests to SCIM endpoints. All SCIM resource paths are resolved relative to this value (e.g., with the default value of /scim/v2, a request for /scim/v2/Users is recognized as a User list request).
This value must begin with a forward slash. Trailing slashes are removed automatically, so /scim/v2/ and /scim/v2 are equivalent.
GroupMembers Property (SCIMWeb Component)
A collection of members for the current group.
Syntax
public SCIMMemberList GroupMembers { get; }
Public ReadOnly Property GroupMembers As SCIMMemberList
Remarks
This collection holds a list of SCIMMember items.
When the CreateGroup event is fired, this collection is populated with the members provided in the request. When the UpdateGroup event is fired, it is populated with the complete final member list. For a PATCH request, this reflects the group loaded via the GetGroup event with the patch operations applied. For a PUT request, it reflects the member list from the request body directly.
This property is read-only and not available at design time.
Please refer to the SCIMMember type for a complete list of fields.MaxResults Property (SCIMWeb Component)
The maximum number of resources requested from the application in a single list request.
Syntax
Default Value
200
Remarks
This property limits the Count parameter of the ListUsers and ListGroups events. When the Identity Provider omits the count query parameter or requests more results than this value, Count is set to this value. The component does not remove resources from the response, so the event handler should add no more than Count resources.
This value is also reported in the ServiceProviderConfig discovery endpoint as the maximum allowed value for pagination.
RequestBody Property (SCIMWeb Component)
The body of the incoming SCIM request.
Syntax
Default Value
""
Remarks
This property is used before calling the ProcessRequest method to provide the request body directly. For SCIM operations that include a body (e.g., POST, PUT, PATCH), this must contain the raw JSON payload.
This property is populated automatically when the component reads the request from the current HttpContext.
When no HttpContext is available, the request may be passed to the component manually, as shown.
scim.RequestMethod = request.Method;
scim.RequestURI = request.RawUrl;
scim.RequestHeaders = GetHeaderString(request);
scim.RequestBody = new StreamReader(request.InputStream).ReadToEnd();
scim.ProcessRequest();
response.StatusCode = scim.ResponseStatus;
response.Write(scim.ResponseBody);
RequestHeaders Property (SCIMWeb Component)
The HTTP headers of the incoming SCIM request.
Syntax
Default Value
""
Remarks
This property is used before calling the ProcessRequest method to provide the request headers directly. Headers must be formatted as Name: Value pairs separated by CRLF or newline.
Authorization: Bearer secret-token
Content-Type: application/scim+json
This property is populated automatically when the component reads the request from the current HttpContext.
When no HttpContext is available, the request may be passed to the component manually, as shown.
scim.RequestMethod = request.Method;
scim.RequestURI = request.RawUrl;
scim.RequestHeaders = GetHeaderString(request);
scim.RequestBody = new StreamReader(request.InputStream).ReadToEnd();
scim.ProcessRequest();
response.StatusCode = scim.ResponseStatus;
response.Write(scim.ResponseBody);
RequestMethod Property (SCIMWeb Component)
The HTTP method of the incoming SCIM request.
Syntax
Default Value
""
Remarks
This property is used before calling the ProcessRequest method to provide the HTTP method directly, instead of reading it from the current HttpContext. Common values include GET, POST, PUT, PATCH, and DELETE.
This property is populated automatically when the component reads the request from the current HttpContext.
When no HttpContext is available, the request may be passed to the component manually, as shown.
scim.RequestMethod = request.Method;
scim.RequestURI = request.RawUrl;
scim.RequestHeaders = GetHeaderString(request);
scim.RequestBody = new StreamReader(request.InputStream).ReadToEnd();
scim.ProcessRequest();
response.StatusCode = scim.ResponseStatus;
response.Write(scim.ResponseBody);
RequestType Property (SCIMWeb Component)
The HTTP method of the request currently being processed.
Syntax
Default Value
""
Remarks
This read-only property is used to determine the HTTP method (GET, POST, PUT, PATCH, or DELETE) of the request being processed. It is eligible to be queried during any event fired by the component.
When the component processes a PATCH request, it fires the GetUser or GetGroup event to retrieve the current resource first. When the ETagEnabled configuration setting is true and the client includes an If-Match header on a PUT or DELETE request, the GetUser or GetGroup event also fires to validate the ETag before the update or delete event.
This property is read-only.
RequestURI Property (SCIMWeb Component)
The URI of the incoming SCIM request.
Syntax
Default Value
""
Remarks
This property is used before calling the ProcessRequest method to provide the request URI directly, instead of reading it from the current HttpContext. The value should include the path and query string (e.g., /scim/v2/Users?filter=userName+eq+"jsmith").
This property is populated automatically when the component reads the request from the current HttpContext.
When no HttpContext is available, the request may be passed to the component manually, as shown.
scim.RequestMethod = request.Method;
scim.RequestURI = request.RawUrl;
scim.RequestHeaders = GetHeaderString(request);
scim.RequestBody = new StreamReader(request.InputStream).ReadToEnd();
scim.ProcessRequest();
response.StatusCode = scim.ResponseStatus;
response.Write(scim.ResponseBody);
ResponseBody Property (SCIMWeb Component)
The body of the SCIM response generated by the component.
Syntax
Default Value
""
Remarks
After the ProcessRequest method returns, this property contains the JSON response body that must be written to the HTTP response. The value is a complete SCIM JSON document. For operations that produce no body (e.g., a successful DELETE, or a 304 Not Modified response when the ETagEnabled configuration setting is enabled), this property is empty.
When the component reads the request from the current HttpContext, it writes the body to that context directly and this property reflects what was written.
This property is read-only.
ResponseHeaders Property (SCIMWeb Component)
The HTTP headers of the SCIM response generated by the component.
Syntax
Default Value
""
Remarks
After the ProcessRequest method returns, this property contains the CRLF-delimited response headers that must be written to the HTTP response. For responses with a JSON body, this includes a Content-Type header of application/scim+json, the media type specified for SCIM by RFC 7644. For 204 No Content responses, such as successful deletes, and 304 Not Modified responses, no Content-Type header is included.
When the component reads the request from the current HttpContext, it writes the headers to that context directly and this property reflects what was written.
This property is read-only.
ResponseStatus Property (SCIMWeb Component)
The HTTP status code of the SCIM response generated by the component.
Syntax
Default Value
0
Remarks
After the ProcessRequest method returns, this property contains the HTTP status code that must be written to the HTTP response (e.g., 200, 201, 204, 400, 401, 404).
When the component reads the request from the current HttpContext, it writes the response to that context directly and this property reflects the status code that was written.
This property is read-only.
SupportedOperations Property (SCIMWeb Component)
A bitmask that controls which SCIM operations the component accepts.
Syntax
Default Value
65535
Remarks
This property determines which SCIM operations are enabled. Requests for disabled operations receive a 501 Not Implemented response. The following flags are defined (specified in hexadecimal notation) and may be combined:
| 0x0001 (sopUserCreate) | Accept POST /Users requests. Fires the CreateUser event. |
| 0x0002 (sopUserRead) | Accept GET /Users/{id} requests. Fires the GetUser event. |
| 0x0004 (sopUserUpdate) | Accept PUT /Users/{id} and PATCH /Users/{id} requests. Fires the GetUser and UpdateUser events. |
| 0x0008 (sopUserDelete) | Accept DELETE /Users/{id} requests. Fires the DeleteUser event. |
| 0x0010 (sopUserList) | Accept GET /Users requests. Fires the ListUsers event. |
| 0x0100 (sopGroupCreate) | Accept POST /Groups requests. Fires the CreateGroup event. |
| 0x0200 (sopGroupRead) | Accept GET /Groups/{id} requests. Fires the GetGroup event. |
| 0x0400 (sopGroupUpdate) | Accept PUT /Groups/{id} and PATCH /Groups/{id} requests. Fires the GetGroup and UpdateGroup events. |
| 0x0800 (sopGroupDelete) | Accept DELETE /Groups/{id} requests. Fires the DeleteGroup event. |
| 0x1000 (sopGroupList) | Accept GET /Groups requests. Fires the ListGroups event. |
| 0xFFFF (sopAll) | Enable all operations, which is the default. |
Bits not listed above are reserved for future use and are currently ignored. sopAll is defined as 0xFFFF to include any operations added in future versions.
Note that PUT and PATCH requests share the same flag (sopUserUpdate / sopGroupUpdate). Enabling the flag accepts both methods, and disabling it rejects both. For PATCH requests, the component retrieves the current resource via GetUser or GetGroup, applies the patch operations, then fires UpdateUser or UpdateGroup with the merged result.
When the ETagEnabled configuration setting is enabled and a PUT or DELETE request includes an If-Match header, the component also fires GetUser or GetGroup to validate the ETag before the update or delete event fires.
The discovery endpoints (/ServiceProviderConfig, /ResourceTypes, /Schemas) are always available regardless of this property's value.
The capabilities advertised in the ServiceProviderConfig discovery endpoint are derived from this property automatically.
UserEmails Property (SCIMWeb Component)
A collection of email addresses for the current inbound user.
Syntax
public SCIMEmailList UserEmails { get; }
Public ReadOnly Property UserEmails As SCIMEmailList
Remarks
This collection holds a list of SCIMEmail items.
When the CreateUser event is fired, this collection is populated with the email addresses provided in the request. When the UpdateUser event is fired, it is populated with the complete final email address list. For a PATCH request, this reflects the user loaded via the GetUser event with the patch operations applied. For a PUT request, it reflects the email address list from the request body directly. Each entry exposes an Address, EmailType, and Primary field.
To include email addresses in an outgoing response, the Address value should be passed to the Address parameter when calling the AddUserEmail method.
This property is read-only and not available at design time.
Please refer to the SCIMEmail type for a complete list of fields.UserExtension Property (SCIMWeb Component)
The enterprise extension attributes for the current inbound user.
Syntax
public SCIMExtension UserExtension { get; }
Public ReadOnly Property UserExtension As SCIMExtension
Remarks
When the CreateUser event is fired, this property contains the enterprise extension attributes provided in the request. When the UpdateUser event is fired, it contains the final values. For a PATCH request, this reflects the user loaded via the GetUser event with the patch operations applied. For a PUT request, it reflects the enterprise extension attributes from the request body directly.
This property exposes the following fields: Department, EmployeeNumber, CostCenter, Organization, Division, ManagerId, ManagerRef, and ManagerDisplayName. The component will set any fields not included in the request to "" (empty string).
To include enterprise extension data in an outgoing response, the AddUserExtension method should be called.
The component natively supports the SCIM enterprise user extension schema (urn:ietf:params:scim:schemas:extension:enterprise:2.0:User). The extension schema namespace is handled internally. The API exposes extension attributes directly without requiring the URN to be specified. Additional extension schemas may be supported in future releases.
This property is read-only and not available at design time.
Please refer to the SCIMExtension type for a complete list of fields.UserPhones Property (SCIMWeb Component)
A collection of phone numbers for the current inbound user.
Syntax
public SCIMPhoneList UserPhones { get; }
Public ReadOnly Property UserPhones As SCIMPhoneList
Remarks
This collection holds a list of SCIMPhone items.
When the CreateUser event is fired, this collection is populated with the phone numbers provided in the request. When the UpdateUser event is fired, it is populated with the complete final phone number list. For a PATCH request, this reflects the user loaded via the GetUser event with the patch operations applied. For a PUT request, it reflects the phone number list from the request body directly. Each entry exposes a Number, PhoneType, and Primary field.
To include phone numbers in an outgoing response, the Number value should be passed to the Number parameter when calling the AddUserPhone method.
This property is read-only and not available at design time.
Please refer to the SCIMPhone type for a complete list of fields.AddGroup Method (SCIMWeb Component)
Adds a group entry to the outgoing list response.
Syntax
public void AddGroup(string groupId, string displayName, string externalId); Async Version public async Task AddGroup(string groupId, string displayName, string externalId); public async Task AddGroup(string groupId, string displayName, string externalId, CancellationToken cancellationToken);
Public Sub AddGroup(ByVal GroupId As String, ByVal DisplayName As String, ByVal ExternalId As String) Async Version Public Sub AddGroup(ByVal GroupId As String, ByVal DisplayName As String, ByVal ExternalId As String) As Task Public Sub AddGroup(ByVal GroupId As String, ByVal DisplayName As String, ByVal ExternalId As String, cancellationToken As CancellationToken) As Task
Remarks
This method should be called within a ListGroups event handler once for each group in the current page of results. The component then assembles all added entries into the SCIM ListResponse envelope.
GroupId is the unique identifier for the group, and DisplayName may be empty if not available.
The stored ExternalId should be passed for the group (or "" (empty string) if not recorded).
After all entries have been added, the TotalResults event parameter should be set to the total number of matching groups across all pages, which may be greater than the number of entries added in the current method call.
scim.OnListGroups += (sender, e) => {
var page = db.QueryGroups(e.FilterAttribute, e.FilterOperator, e.FilterValue, e.StartIndex - 1, e.Count);
foreach (var group in page.Results) {
scim.AddGroup(group.Id, group.DisplayName, group.ExternalId);
}
e.TotalResults = page.TotalCount;
e.StatusCode = 200;
};
AddGroupMember Method (SCIMWeb Component)
Adds a member to the outgoing group response.
Syntax
public void AddGroupMember(string groupId, string memberId, string memberDisplay); Async Version public async Task AddGroupMember(string groupId, string memberId, string memberDisplay); public async Task AddGroupMember(string groupId, string memberId, string memberDisplay, CancellationToken cancellationToken);
Public Sub AddGroupMember(ByVal GroupId As String, ByVal MemberId As String, ByVal MemberDisplay As String) Async Version Public Sub AddGroupMember(ByVal GroupId As String, ByVal MemberId As String, ByVal MemberDisplay As String) As Task Public Sub AddGroupMember(ByVal GroupId As String, ByVal MemberId As String, ByVal MemberDisplay As String, cancellationToken As CancellationToken) As Task
Remarks
This method should be called within a GetGroup or ListGroups event handler once for each group member to be included in the SCIM response.
GroupId identifies the group to which the member belongs, and MemberId and MemberDisplay represent the SCIM resource ID and display name of the member user, respectively.
scim.OnGetGroup += (sender, e) => {
var group = db.FindGroup(e.GroupId);
e.DisplayName = group.DisplayName;
e.ExternalId = group.ExternalId;
foreach (var member in group.Members) {
scim.AddGroupMember(e.GroupId, member.UserId, member.DisplayName);
}
e.StatusCode = 200;
};
AddUser Method (SCIMWeb Component)
Adds a user entry to the outgoing list response.
Syntax
public void AddUser(string userId, string userName, string displayName, string externalId, bool active); Async Version public async Task AddUser(string userId, string userName, string displayName, string externalId, bool active); public async Task AddUser(string userId, string userName, string displayName, string externalId, bool active, CancellationToken cancellationToken);
Public Sub AddUser(ByVal UserId As String, ByVal UserName As String, ByVal DisplayName As String, ByVal ExternalId As String, ByVal Active As Boolean) Async Version Public Sub AddUser(ByVal UserId As String, ByVal UserName As String, ByVal DisplayName As String, ByVal ExternalId As String, ByVal Active As Boolean) As Task Public Sub AddUser(ByVal UserId As String, ByVal UserName As String, ByVal DisplayName As String, ByVal ExternalId As String, ByVal Active As Boolean, cancellationToken As CancellationToken) As Task
Remarks
This method should be called within a ListUsers event handler once for each user in the current page of results. The component then assembles all added entries into the SCIM ListResponse envelope.
UserId is the unique identifier for the user, UserName is the user's SCIM username, and DisplayName may be empty if not available.
The stored ExternalId should be passed for the user (or "" (empty string) if not recorded). Active indicates whether the user account is enabled.
After all entries have been added, the TotalResults event parameter should be set to the total number of matching users across all pages, which may be greater than the number of entries added in the current method call.
void scim_ListUsers(object sender, SCIMWebListUsersEventArgs e)
{
var results = db.QueryUsers(e.FilterAttribute, e.FilterOperator, e.FilterValue,
e.StartIndex - 1, e.Count);
foreach (var user in results.Page)
scim.AddUser(user.Id, user.UserName, user.DisplayName, user.ExternalId, user.Active);
e.TotalResults = results.TotalCount;
e.StatusCode = 0;
}
AddUserEmail Method (SCIMWeb Component)
Adds an email address to the outgoing user response.
Syntax
public void AddUserEmail(string userId, string address, string emailType, bool primary); Async Version public async Task AddUserEmail(string userId, string address, string emailType, bool primary); public async Task AddUserEmail(string userId, string address, string emailType, bool primary, CancellationToken cancellationToken);
Public Sub AddUserEmail(ByVal UserId As String, ByVal Address As String, ByVal EmailType As String, ByVal Primary As Boolean) Async Version Public Sub AddUserEmail(ByVal UserId As String, ByVal Address As String, ByVal EmailType As String, ByVal Primary As Boolean) As Task Public Sub AddUserEmail(ByVal UserId As String, ByVal Address As String, ByVal EmailType As String, ByVal Primary As Boolean, cancellationToken As CancellationToken) As Task
Remarks
This method should be called within a GetUser or ListUsers event handler once for each user's email address to be included in the response.
UserId identifies which user the address belongs to. Address is the email address string, and EmailType classifies the address (common values include work, home, and other). Primary should be set to true only for the user's primary address.
scim.OnGetUser += (sender, e) => {
var user = db.FindUser(e.UserId);
e.UserName = user.UserName;
e.DisplayName = user.DisplayName;
e.Active = user.Active;
foreach (var email in user.Emails) {
scim.AddUserEmail(e.UserId, email.Address, email.EmailType, email.Primary);
}
e.StatusCode = 200;
};
AddUserExtension Method (SCIMWeb Component)
Adds enterprise extension attributes to the outgoing user response.
Syntax
public void AddUserExtension(string userId, string department, string employeeNumber, string costCenter, string organization, string division, string managerId, string managerRef, string managerDisplayName); Async Version public async Task AddUserExtension(string userId, string department, string employeeNumber, string costCenter, string organization, string division, string managerId, string managerRef, string managerDisplayName); public async Task AddUserExtension(string userId, string department, string employeeNumber, string costCenter, string organization, string division, string managerId, string managerRef, string managerDisplayName, CancellationToken cancellationToken);
Public Sub AddUserExtension(ByVal UserId As String, ByVal Department As String, ByVal EmployeeNumber As String, ByVal CostCenter As String, ByVal Organization As String, ByVal Division As String, ByVal ManagerId As String, ByVal ManagerRef As String, ByVal ManagerDisplayName As String) Async Version Public Sub AddUserExtension(ByVal UserId As String, ByVal Department As String, ByVal EmployeeNumber As String, ByVal CostCenter As String, ByVal Organization As String, ByVal Division As String, ByVal ManagerId As String, ByVal ManagerRef As String, ByVal ManagerDisplayName As String) As Task Public Sub AddUserExtension(ByVal UserId As String, ByVal Department As String, ByVal EmployeeNumber As String, ByVal CostCenter As String, ByVal Organization As String, ByVal Division As String, ByVal ManagerId As String, ByVal ManagerRef As String, ByVal ManagerDisplayName As String, cancellationToken As CancellationToken) As Task
Remarks
This method should be called within a GetUser or ListUsers event handler once for each user's enterprise extension data to be included in the response.
UserId identifies which user the data belongs to. Department, EmployeeNumber, CostCenter, Organization, and Division are the enterprise user attributes.
ManagerId is the user identifier of the user's manager, ManagerRef is the full URI of the manager's user resource, and ManagerDisplayName is the manager's display name.
"" (empty string) should be passed for any attribute that is not applicable or not stored.
scim.OnGetUser += (sender, e) => {
var user = db.FindUser(e.UserId);
e.UserName = user.UserName;
e.DisplayName = user.DisplayName;
e.Active = user.Active;
if (user.HasManager) {
scim.AddUserExtension(e.UserId, user.Department, user.EmployeeNumber, user.CostCenter, user.Organization,
user.Division, user.ManagerId, "", user.ManagerDisplayName);
}
e.StatusCode = 200;
};
The component natively supports the SCIM enterprise user extension schema (urn:ietf:params:scim:schemas:extension:enterprise:2.0:User). The extension schema namespace is handled internally. The API exposes extension attributes directly without requiring the URN to be specified. Additional extension schemas may be supported in future releases.
AddUserPhone Method (SCIMWeb Component)
Adds a phone number to the outgoing user response.
Syntax
public void AddUserPhone(string userId, string number, string phoneType, bool primary); Async Version public async Task AddUserPhone(string userId, string number, string phoneType, bool primary); public async Task AddUserPhone(string userId, string number, string phoneType, bool primary, CancellationToken cancellationToken);
Public Sub AddUserPhone(ByVal UserId As String, ByVal Number As String, ByVal PhoneType As String, ByVal Primary As Boolean) Async Version Public Sub AddUserPhone(ByVal UserId As String, ByVal Number As String, ByVal PhoneType As String, ByVal Primary As Boolean) As Task Public Sub AddUserPhone(ByVal UserId As String, ByVal Number As String, ByVal PhoneType As String, ByVal Primary As Boolean, cancellationToken As CancellationToken) As Task
Remarks
This method should be called within a GetUser or ListUsers event handler once for each user's phone number to be included in the response.
UserId identifies which user the number belongs to. Number is the phone number string, and PhoneType classifies the number (common values include work, mobile, home, and other). Primary should be set to true only for the user's primary number.
scim.OnGetUser += (sender, e) => {
var user = db.FindUser(e.UserId);
e.UserName = user.UserName;
e.DisplayName = user.DisplayName;
e.Active = user.Active;
foreach (var phone in user.Phones) {
scim.AddUserPhone(e.UserId, phone.Number, phone.PhoneType, phone.Primary);
}
e.StatusCode = 200;
};
Config Method (SCIMWeb Component)
Sets or retrieves a configuration setting.
Syntax
Remarks
Config is a generic method available in every component. It is used to set and retrieve configuration settings for the component.
These settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the component, access to these internal properties is provided through the Config method.
To set a configuration setting named PROPERTY, you must call Config("PROPERTY=VALUE"), where VALUE is the value of the setting expressed as a string. For boolean values, use the strings "True", "False", "0", "1", "Yes", or "No" (case does not matter).
To read (query) the value of a configuration setting, you must call Config("PROPERTY"). The value will be returned as a string.
ProcessRequest Method (SCIMWeb Component)
Processes an incoming SCIM request and generates a response.
Syntax
public void ProcessRequest(); Async Version public async Task ProcessRequest(); public async Task ProcessRequest(CancellationToken cancellationToken);
Public Sub ProcessRequest() Async Version Public Sub ProcessRequest() As Task Public Sub ProcessRequest(cancellationToken As CancellationToken) As Task
Remarks
This method is used as the primary entry point for the SCIMWeb component and should be called from your web framework's request handler whenever a request is received for the SCIM base URL. Construct the component with the current HttpContext.
The component first uses request data supplied through RequestMethod, RequestURI, RequestHeaders, and RequestBody, if they have been set explicitly. Otherwise, the component reads the HTTP request from the current HttpContext, or from the context provided when constructing the component. These properties are not cleared automatically after ProcessRequest returns, so when they are set explicitly, a new value should be assigned to each of them before every subsequent call.
Internally, the component authenticates the request (i.e., fires the AuthRequest event), routes it to the appropriate resource handler, fires the corresponding event (such as CreateUser or ListGroups), and assembles the response. When the request is read from an HttpContext, the component writes the status, headers, and body to that context. The ResponseStatus, ResponseHeaders, and ResponseBody properties are populated with the response.
ASP.NET Core Middleware Example
app.Map("/scim", scimApp =>
{
scimApp.Run(async context =>
{
var scim = new SCIMWeb(context);
scim.ProcessRequest();
// response already written to context
});
});
Manual Request Passing Example
scim.RequestMethod = request.Method;
scim.RequestURI = request.RawUrl;
scim.RequestHeaders = GetHeaderString(request);
scim.RequestBody = new StreamReader(request.InputStream).ReadToEnd();
scim.ProcessRequest();
response.StatusCode = scim.ResponseStatus;
response.Write(scim.ResponseBody);
Reset Method (SCIMWeb Component)
This method will reset the component.
Syntax
public void Reset(); Async Version public async Task Reset(); public async Task Reset(CancellationToken cancellationToken);
Public Sub Reset() Async Version Public Sub Reset() As Task Public Sub Reset(cancellationToken As CancellationToken) As Task
Remarks
This method will reset the component's properties to their default values.
AuthRequest Event (SCIMWeb Component)
Fired for every incoming request to control access to specific endpoints.
Syntax
public event OnAuthRequestHandler OnAuthRequest; public delegate void OnAuthRequestHandler(object sender, SCIMWebAuthRequestEventArgs e); public class SCIMWebAuthRequestEventArgs : EventArgs { public string RequestId { get; } public string AuthMethod { get; } public string User { get; } public string Token { get; } public bool Accept { get; set; } } Async Version public event AsyncEventHandler<SCIMWebAuthRequestEventArgs> OnAuthRequest; public delegate Task AsyncEventHandler<TEventArgs>(object sender, TEventArgs e); public class SCIMWebAuthRequestEventArgs : AsyncEventArgs { public CancellationToken CancellationToken { get; } public string RequestId { get; } public string AuthMethod { get; } public string User { get; } public string Token { get; } public bool Accept { get; set; } }
Public Event OnAuthRequest As OnAuthRequestHandler Public Delegate Sub OnAuthRequestHandler(sender As Object, e As SCIMWebAuthRequestEventArgs) Public Class SCIMWebAuthRequestEventArgs Inherits EventArgs Public ReadOnly Property RequestId As String Public ReadOnly Property AuthMethod As String Public ReadOnly Property User As String Public ReadOnly Property Token As String Public Property Accept As Boolean End Class Async Version Public Event OnAuthRequest As AsyncEventHandler(Of SCIMWebAuthRequestEventArgs) Public Delegate Function AsyncEventHandler(Of TEventArgs)(sender As Object, e As TEventArgs) As Task Public Class SCIMWebAuthRequestEventArgs Inherits AsyncEventArgs Public ReadOnly Property CancellationToken As CancellationToken Public ReadOnly Property RequestId As String Public ReadOnly Property AuthMethod As String Public ReadOnly Property User As String Public ReadOnly Property Token As String Public Property Accept As Boolean End Class
Remarks
This event fires for every incoming request before any resource event is raised, allowing the application to implement custom authentication logic.
The AuthMethod parameter identifies the authentication scheme supplied by the client.
| Bearer | The Token parameter contains the raw bearer token, and the User parameter remains empty. If the AuthToken property has been set, the component automatically compares it against the incoming token and pre-initializes the Accept parameter with the result. When AuthToken is not set, Accept defaults to false. |
| Basic | The component decodes the base64 credentials and splits them on the colon separator. User contains the username and Token contains the password. Accept defaults to false. No automatic credential check is performed. |
| Other/Unrecognized | The AuthMethod parameter contains the scheme name as supplied by the client. Token contains everything following it and User is empty. Accept defaults to false. |
| "" (empty string) | No Authorization header was present. User and Token are both set to "" (empty string). Accept defaults to false. |
The Accept value may be changed when additional logic outside of the component is required (e.g., to enforce token expiry, check a revocation list, or accept an alternative authentication scheme).
Requests rejected by this event receive a 401 Unauthorized response.
The RequestId parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.
Note that this event is not fired when the AuthEnabled configuration setting is disabled.
Custom validation covering multiple authentication schemes may be performed as shown.
scim.OnAuthRequest += (sender, e) => {
if (e.AuthMethod == "Bearer") {
e.Accept = tokenStore.IsValid(e.Token);
} else if (e.AuthMethod == "Basic") {
e.Accept = userStore.CheckPassword(e.User, e.Token);
} else {
e.Accept = false;
}
};
CreateGroup Event (SCIMWeb Component)
Fired when a request to create a new group is received.
Syntax
public event OnCreateGroupHandler OnCreateGroup; public delegate void OnCreateGroupHandler(object sender, SCIMWebCreateGroupEventArgs e); public class SCIMWebCreateGroupEventArgs : EventArgs { public string RequestId { get; } public string ExternalId { get; } public string DisplayName { get; } public string GroupId { get; set; } public int StatusCode { get; set; } } Async Version public event AsyncEventHandler<SCIMWebCreateGroupEventArgs> OnCreateGroup; public delegate Task AsyncEventHandler<TEventArgs>(object sender, TEventArgs e); public class SCIMWebCreateGroupEventArgs : AsyncEventArgs { public CancellationToken CancellationToken { get; } public string RequestId { get; } public string ExternalId { get; } public string DisplayName { get; } public string GroupId { get; set; } public int StatusCode { get; set; } }
Public Event OnCreateGroup As OnCreateGroupHandler Public Delegate Sub OnCreateGroupHandler(sender As Object, e As SCIMWebCreateGroupEventArgs) Public Class SCIMWebCreateGroupEventArgs Inherits EventArgs Public ReadOnly Property RequestId As String Public ReadOnly Property ExternalId As String Public ReadOnly Property DisplayName As String Public Property GroupId As String Public Property StatusCode As Integer End Class Async Version Public Event OnCreateGroup As AsyncEventHandler(Of SCIMWebCreateGroupEventArgs) Public Delegate Function AsyncEventHandler(Of TEventArgs)(sender As Object, e As TEventArgs) As Task Public Class SCIMWebCreateGroupEventArgs Inherits AsyncEventArgs Public ReadOnly Property CancellationToken As CancellationToken Public ReadOnly Property RequestId As String Public ReadOnly Property ExternalId As String Public ReadOnly Property DisplayName As String Public Property GroupId As String Public Property StatusCode As Integer End Class
Remarks
This event fires when the component receives a POST /Groups request from the Identity Provider. The inbound group attributes are provided as event parameters.
If the Identity Provider included an externalId in the request, it is made available in the ExternalId parameter. This value should be stored alongside the group record so it can be returned in future GetGroup event responses.
If the request includes group members, they are made available via the GroupMembers collection, where each entry exposes a MemberId and MemberDisplay field.
If the group is created successfully, the GroupId parameter must be set to the newly assigned identifier, and the StatusCode parameter must be set to 201. The full created resource is returned to the Identity Provider in the 201 Created response body. To signal an error, StatusCode must be set to the appropriate HTTP status code (e.g., 409 for a duplicate group). The StatusCode parameter defaults to 500, and a value of 0 is treated as 201.
The RequestId parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.
CreateUser Event (SCIMWeb Component)
Fired when a request to create a new user is received.
Syntax
public event OnCreateUserHandler OnCreateUser; public delegate void OnCreateUserHandler(object sender, SCIMWebCreateUserEventArgs e); public class SCIMWebCreateUserEventArgs : EventArgs { public string RequestId { get; } public string ExternalId { get; } public string UserName { get; } public string GivenName { get; } public string FamilyName { get; } public string DisplayName { get; } public bool Active { get; } public string UserId { get; set; } public int StatusCode { get; set; } } Async Version public event AsyncEventHandler<SCIMWebCreateUserEventArgs> OnCreateUser; public delegate Task AsyncEventHandler<TEventArgs>(object sender, TEventArgs e); public class SCIMWebCreateUserEventArgs : AsyncEventArgs { public CancellationToken CancellationToken { get; } public string RequestId { get; } public string ExternalId { get; } public string UserName { get; } public string GivenName { get; } public string FamilyName { get; } public string DisplayName { get; } public bool Active { get; } public string UserId { get; set; } public int StatusCode { get; set; } }
Public Event OnCreateUser As OnCreateUserHandler Public Delegate Sub OnCreateUserHandler(sender As Object, e As SCIMWebCreateUserEventArgs) Public Class SCIMWebCreateUserEventArgs Inherits EventArgs Public ReadOnly Property RequestId As String Public ReadOnly Property ExternalId As String Public ReadOnly Property UserName As String Public ReadOnly Property GivenName As String Public ReadOnly Property FamilyName As String Public ReadOnly Property DisplayName As String Public ReadOnly Property Active As Boolean Public Property UserId As String Public Property StatusCode As Integer End Class Async Version Public Event OnCreateUser As AsyncEventHandler(Of SCIMWebCreateUserEventArgs) Public Delegate Function AsyncEventHandler(Of TEventArgs)(sender As Object, e As TEventArgs) As Task Public Class SCIMWebCreateUserEventArgs Inherits AsyncEventArgs Public ReadOnly Property CancellationToken As CancellationToken Public ReadOnly Property RequestId As String Public ReadOnly Property ExternalId As String Public ReadOnly Property UserName As String Public ReadOnly Property GivenName As String Public ReadOnly Property FamilyName As String Public ReadOnly Property DisplayName As String Public ReadOnly Property Active As Boolean Public Property UserId As String Public Property StatusCode As Integer End Class
Remarks
This event fires when the component receives a POST /Users request from the Identity Provider. The inbound user attributes are provided as event parameters.
If the Identity Provider included an externalId in the request, it is made available in the ExternalId parameter. This value should be stored alongside the user record so it can be returned in future GetUser event responses.
The Active parameter indicates whether the new user account should be enabled. If the Identity Provider does not include an active attribute in the request, Active defaults to true.
Email addresses and phone numbers supplied in the request are made available via the UserEmails and UserPhones collections, where each entry exposes an Address, EmailType, and Primary field (for emails) or a Number, PhoneType, and Primary field (for phones). If the Identity Provider included enterprise extension attributes in the request, they are also made available via the UserExtension property.
If the user is created successfully, the UserId parameter must be set to the newly assigned identifier, and the StatusCode parameter must be set to 201. The full created resource is returned to the Identity Provider in the 201 Created response body. To signal an error, StatusCode must be set to the appropriate HTTP status code (e.g., 409 for a duplicate user). The StatusCode parameter defaults to 500, and a value of 0 is treated as 201.
The RequestId parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.
DeleteGroup Event (SCIMWeb Component)
Fired when a request to delete a group is received.
Syntax
public event OnDeleteGroupHandler OnDeleteGroup; public delegate void OnDeleteGroupHandler(object sender, SCIMWebDeleteGroupEventArgs e); public class SCIMWebDeleteGroupEventArgs : EventArgs { public string RequestId { get; } public string GroupId { get; } public int StatusCode { get; set; } } Async Version public event AsyncEventHandler<SCIMWebDeleteGroupEventArgs> OnDeleteGroup; public delegate Task AsyncEventHandler<TEventArgs>(object sender, TEventArgs e); public class SCIMWebDeleteGroupEventArgs : AsyncEventArgs { public CancellationToken CancellationToken { get; } public string RequestId { get; } public string GroupId { get; } public int StatusCode { get; set; } }
Public Event OnDeleteGroup As OnDeleteGroupHandler Public Delegate Sub OnDeleteGroupHandler(sender As Object, e As SCIMWebDeleteGroupEventArgs) Public Class SCIMWebDeleteGroupEventArgs Inherits EventArgs Public ReadOnly Property RequestId As String Public ReadOnly Property GroupId As String Public Property StatusCode As Integer End Class Async Version Public Event OnDeleteGroup As AsyncEventHandler(Of SCIMWebDeleteGroupEventArgs) Public Delegate Function AsyncEventHandler(Of TEventArgs)(sender As Object, e As TEventArgs) As Task Public Class SCIMWebDeleteGroupEventArgs Inherits AsyncEventArgs Public ReadOnly Property CancellationToken As CancellationToken Public ReadOnly Property RequestId As String Public ReadOnly Property GroupId As String Public Property StatusCode As Integer End Class
Remarks
This event fires when the component receives a DELETE /Groups/{id} request from the Identity Provider. The GroupId parameter identifies the group to delete.
If the deletion is successful, the StatusCode parameter must be set to 204. The component then returns a 204 No Content response. If the group is not found, StatusCode must be set to 404. The StatusCode parameter defaults to 500, and a value of 0 is treated as 204.
The RequestId parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.
DeleteUser Event (SCIMWeb Component)
Fired when a request to delete a user is received.
Syntax
public event OnDeleteUserHandler OnDeleteUser; public delegate void OnDeleteUserHandler(object sender, SCIMWebDeleteUserEventArgs e); public class SCIMWebDeleteUserEventArgs : EventArgs { public string RequestId { get; } public string UserId { get; } public int StatusCode { get; set; } } Async Version public event AsyncEventHandler<SCIMWebDeleteUserEventArgs> OnDeleteUser; public delegate Task AsyncEventHandler<TEventArgs>(object sender, TEventArgs e); public class SCIMWebDeleteUserEventArgs : AsyncEventArgs { public CancellationToken CancellationToken { get; } public string RequestId { get; } public string UserId { get; } public int StatusCode { get; set; } }
Public Event OnDeleteUser As OnDeleteUserHandler Public Delegate Sub OnDeleteUserHandler(sender As Object, e As SCIMWebDeleteUserEventArgs) Public Class SCIMWebDeleteUserEventArgs Inherits EventArgs Public ReadOnly Property RequestId As String Public ReadOnly Property UserId As String Public Property StatusCode As Integer End Class Async Version Public Event OnDeleteUser As AsyncEventHandler(Of SCIMWebDeleteUserEventArgs) Public Delegate Function AsyncEventHandler(Of TEventArgs)(sender As Object, e As TEventArgs) As Task Public Class SCIMWebDeleteUserEventArgs Inherits AsyncEventArgs Public ReadOnly Property CancellationToken As CancellationToken Public ReadOnly Property RequestId As String Public ReadOnly Property UserId As String Public Property StatusCode As Integer End Class
Remarks
This event fires when the component receives a DELETE /Users/{id} request from the Identity Provider. The UserId parameter identifies the user to delete.
If the deletion is successful, the StatusCode parameter must be set to 204. The component then returns a 204 No Content response. If the user is not found, StatusCode must be set to 404. The StatusCode parameter defaults to 500, and a value of 0 is treated as 204.
The RequestId parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.
Error Event (SCIMWeb Component)
Fired when an error occurs while processing a SCIM request.
Syntax
public event OnErrorHandler OnError; public delegate void OnErrorHandler(object sender, SCIMWebErrorEventArgs e); public class SCIMWebErrorEventArgs : EventArgs { public string RequestId { get; } public int ErrorCode { get; } public string Description { get; } } Async Version public event AsyncEventHandler<SCIMWebErrorEventArgs> OnError; public delegate Task AsyncEventHandler<TEventArgs>(object sender, TEventArgs e); public class SCIMWebErrorEventArgs : AsyncEventArgs { public CancellationToken CancellationToken { get; } public string RequestId { get; } public int ErrorCode { get; } public string Description { get; } }
Public Event OnError As OnErrorHandler Public Delegate Sub OnErrorHandler(sender As Object, e As SCIMWebErrorEventArgs) Public Class SCIMWebErrorEventArgs Inherits EventArgs Public ReadOnly Property RequestId As String Public ReadOnly Property ErrorCode As Integer Public ReadOnly Property Description As String End Class Async Version Public Event OnError As AsyncEventHandler(Of SCIMWebErrorEventArgs) Public Delegate Function AsyncEventHandler(Of TEventArgs)(sender As Object, e As TEventArgs) As Task Public Class SCIMWebErrorEventArgs Inherits AsyncEventArgs Public ReadOnly Property CancellationToken As CancellationToken Public ReadOnly Property RequestId As String Public ReadOnly Property ErrorCode As Integer Public ReadOnly Property Description As String End Class
Remarks
This event fires when the component cannot complete a SCIM request, immediately before the error response is returned to the Identity Provider. It fires both for requests the component itself rejects, such as a malformed request body or a failed authentication, and for requests an application event handler rejects by setting its StatusCode parameter to 400 or higher.
ErrorCode identifies the condition. Requests rejected by the component report one of the codes listed in the Error Codes section, while a status returned by an application event handler reports the generic error code 1.
Description is the message carried in the detail field of the SCIM error response body.
This event is informational. The HTTP status and the response body have already been determined by the time it fires, so a handler cannot suppress the error or change what is returned to the Identity Provider.
The RequestId parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.
GetGroup Event (SCIMWeb Component)
Fired when a request to retrieve a group is received, before a PATCH group update, or when ETags are enabled and a PUT or DELETE request includes an If-Match header.
Syntax
public event OnGetGroupHandler OnGetGroup; public delegate void OnGetGroupHandler(object sender, SCIMWebGetGroupEventArgs e); public class SCIMWebGetGroupEventArgs : EventArgs { public string RequestId { get; } public string GroupId { get; } public string ExternalId { get; set; } public string DisplayName { get; set; } public int StatusCode { get; set; } } Async Version public event AsyncEventHandler<SCIMWebGetGroupEventArgs> OnGetGroup; public delegate Task AsyncEventHandler<TEventArgs>(object sender, TEventArgs e); public class SCIMWebGetGroupEventArgs : AsyncEventArgs { public CancellationToken CancellationToken { get; } public string RequestId { get; } public string GroupId { get; } public string ExternalId { get; set; } public string DisplayName { get; set; } public int StatusCode { get; set; } }
Public Event OnGetGroup As OnGetGroupHandler Public Delegate Sub OnGetGroupHandler(sender As Object, e As SCIMWebGetGroupEventArgs) Public Class SCIMWebGetGroupEventArgs Inherits EventArgs Public ReadOnly Property RequestId As String Public ReadOnly Property GroupId As String Public Property ExternalId As String Public Property DisplayName As String Public Property StatusCode As Integer End Class Async Version Public Event OnGetGroup As AsyncEventHandler(Of SCIMWebGetGroupEventArgs) Public Delegate Function AsyncEventHandler(Of TEventArgs)(sender As Object, e As TEventArgs) As Task Public Class SCIMWebGetGroupEventArgs Inherits AsyncEventArgs Public ReadOnly Property CancellationToken As CancellationToken Public ReadOnly Property RequestId As String Public ReadOnly Property GroupId As String Public Property ExternalId As String Public Property DisplayName As String Public Property StatusCode As Integer End Class
Remarks
This event fires when the component receives a GET /Groups/{id} request from the Identity Provider. It also fires before processing a PATCH /Groups/{id} request, or when the ETagEnabled configuration setting is true and a PUT /Groups/{id} or DELETE /Groups/{id} request includes an If-Match header. The GroupId parameter identifies the group to retrieve.
The DisplayName must be set to the group's display name. If an ExternalId was stored for this group, it must be set as well. To include group members in the response, the AddGroupMember method should be called once for each member. This event must supply the full group for a PATCH request to work correctly.
When the group is found, the StatusCode parameter must be set to 200. If the group is not found, StatusCode must be set to 404.
The RequestType property may be used to determine whether this event was fired by a direct GET request or internally before a PATCH or a conditional PUT/DELETE.
The StatusCode parameter defaults to 500, and a value of 0 is treated as 200.
The RequestId parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.
GetResourceTypes Event (SCIMWeb Component)
Fired when a request for the resource type definitions is received.
Syntax
public event OnGetResourceTypesHandler OnGetResourceTypes; public delegate void OnGetResourceTypesHandler(object sender, SCIMWebGetResourceTypesEventArgs e); public class SCIMWebGetResourceTypesEventArgs : EventArgs { public string RequestId { get; } public string ResponseBody { get; }
public byte[] ResponseBodyB { get; } } Async Version public event AsyncEventHandler<SCIMWebGetResourceTypesEventArgs> OnGetResourceTypes; public delegate Task AsyncEventHandler<TEventArgs>(object sender, TEventArgs e); public class SCIMWebGetResourceTypesEventArgs : AsyncEventArgs { public CancellationToken CancellationToken { get; } public string RequestId { get; } public string ResponseBody { get; }
public byte[] ResponseBodyB { get; } }
Public Event OnGetResourceTypes As OnGetResourceTypesHandler Public Delegate Sub OnGetResourceTypesHandler(sender As Object, e As SCIMWebGetResourceTypesEventArgs) Public Class SCIMWebGetResourceTypesEventArgs Inherits EventArgs Public ReadOnly Property RequestId As String Public ReadOnly Property ResponseBody As String
Public ReadOnly Property ResponseBodyB As Byte() End Class Async Version Public Event OnGetResourceTypes As AsyncEventHandler(Of SCIMWebGetResourceTypesEventArgs) Public Delegate Function AsyncEventHandler(Of TEventArgs)(sender As Object, e As TEventArgs) As Task Public Class SCIMWebGetResourceTypesEventArgs Inherits AsyncEventArgs Public ReadOnly Property CancellationToken As CancellationToken Public ReadOnly Property RequestId As String Public ReadOnly Property ResponseBody As String
Public ReadOnly Property ResponseBodyB As Byte() End Class
Remarks
This event fires when the component receives a GET /ResourceTypes request from the Identity Provider. The component returns the standard SCIM User and Group resource type definitions automatically and populates the ResponseBody parameter with the serialized JSON before firing this event.
This event is informational and may be used to log or audit discovery requests and inspect the generated response.
The RequestId parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.
GetSchemas Event (SCIMWeb Component)
Fired when a request for the schema definitions is received.
Syntax
public event OnGetSchemasHandler OnGetSchemas; public delegate void OnGetSchemasHandler(object sender, SCIMWebGetSchemasEventArgs e); public class SCIMWebGetSchemasEventArgs : EventArgs { public string RequestId { get; } public string ResponseBody { get; }
public byte[] ResponseBodyB { get; } } Async Version public event AsyncEventHandler<SCIMWebGetSchemasEventArgs> OnGetSchemas; public delegate Task AsyncEventHandler<TEventArgs>(object sender, TEventArgs e); public class SCIMWebGetSchemasEventArgs : AsyncEventArgs { public CancellationToken CancellationToken { get; } public string RequestId { get; } public string ResponseBody { get; }
public byte[] ResponseBodyB { get; } }
Public Event OnGetSchemas As OnGetSchemasHandler Public Delegate Sub OnGetSchemasHandler(sender As Object, e As SCIMWebGetSchemasEventArgs) Public Class SCIMWebGetSchemasEventArgs Inherits EventArgs Public ReadOnly Property RequestId As String Public ReadOnly Property ResponseBody As String
Public ReadOnly Property ResponseBodyB As Byte() End Class Async Version Public Event OnGetSchemas As AsyncEventHandler(Of SCIMWebGetSchemasEventArgs) Public Delegate Function AsyncEventHandler(Of TEventArgs)(sender As Object, e As TEventArgs) As Task Public Class SCIMWebGetSchemasEventArgs Inherits AsyncEventArgs Public ReadOnly Property CancellationToken As CancellationToken Public ReadOnly Property RequestId As String Public ReadOnly Property ResponseBody As String
Public ReadOnly Property ResponseBodyB As Byte() End Class
Remarks
This event fires when the component receives a GET /Schemas request from the Identity Provider. The component returns the standard SCIM User and Group schema definitions, including the enterprise user extension, automatically and populates the ResponseBody parameter with the serialized JSON before firing this event.
This event is informational and may be used to log or audit discovery requests and inspect the generated response.
The RequestId parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.
GetServiceProviderConfig Event (SCIMWeb Component)
Fired when a request for the service provider configuration is received.
Syntax
public event OnGetServiceProviderConfigHandler OnGetServiceProviderConfig; public delegate void OnGetServiceProviderConfigHandler(object sender, SCIMWebGetServiceProviderConfigEventArgs e); public class SCIMWebGetServiceProviderConfigEventArgs : EventArgs { public string RequestId { get; } public string ResponseBody { get; }
public byte[] ResponseBodyB { get; } } Async Version public event AsyncEventHandler<SCIMWebGetServiceProviderConfigEventArgs> OnGetServiceProviderConfig; public delegate Task AsyncEventHandler<TEventArgs>(object sender, TEventArgs e); public class SCIMWebGetServiceProviderConfigEventArgs : AsyncEventArgs { public CancellationToken CancellationToken { get; } public string RequestId { get; } public string ResponseBody { get; }
public byte[] ResponseBodyB { get; } }
Public Event OnGetServiceProviderConfig As OnGetServiceProviderConfigHandler Public Delegate Sub OnGetServiceProviderConfigHandler(sender As Object, e As SCIMWebGetServiceProviderConfigEventArgs) Public Class SCIMWebGetServiceProviderConfigEventArgs Inherits EventArgs Public ReadOnly Property RequestId As String Public ReadOnly Property ResponseBody As String
Public ReadOnly Property ResponseBodyB As Byte() End Class Async Version Public Event OnGetServiceProviderConfig As AsyncEventHandler(Of SCIMWebGetServiceProviderConfigEventArgs) Public Delegate Function AsyncEventHandler(Of TEventArgs)(sender As Object, e As TEventArgs) As Task Public Class SCIMWebGetServiceProviderConfigEventArgs Inherits AsyncEventArgs Public ReadOnly Property CancellationToken As CancellationToken Public ReadOnly Property RequestId As String Public ReadOnly Property ResponseBody As String
Public ReadOnly Property ResponseBodyB As Byte() End Class
Remarks
This event fires when the component receives a GET /ServiceProviderConfig request from the Identity Provider. The component generates the configuration document automatically based on the SupportedOperations and MaxResults properties and populates the ResponseBody parameter with the serialized JSON before firing this event.
This event is informational and may be used to log or audit discovery requests and inspect the generated response.
The RequestId parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.
GetUser Event (SCIMWeb Component)
Fired when a request to retrieve a user is received, before a PATCH user update, or when ETags are enabled and a PUT or DELETE request includes an If-Match header.
Syntax
public event OnGetUserHandler OnGetUser; public delegate void OnGetUserHandler(object sender, SCIMWebGetUserEventArgs e); public class SCIMWebGetUserEventArgs : EventArgs { public string RequestId { get; } public string UserId { get; } public string ExternalId { get; set; } public string UserName { get; set; } public string GivenName { get; set; } public string FamilyName { get; set; } public string DisplayName { get; set; } public bool Active { get; set; } public int StatusCode { get; set; } } Async Version public event AsyncEventHandler<SCIMWebGetUserEventArgs> OnGetUser; public delegate Task AsyncEventHandler<TEventArgs>(object sender, TEventArgs e); public class SCIMWebGetUserEventArgs : AsyncEventArgs { public CancellationToken CancellationToken { get; } public string RequestId { get; } public string UserId { get; } public string ExternalId { get; set; } public string UserName { get; set; } public string GivenName { get; set; } public string FamilyName { get; set; } public string DisplayName { get; set; } public bool Active { get; set; } public int StatusCode { get; set; } }
Public Event OnGetUser As OnGetUserHandler Public Delegate Sub OnGetUserHandler(sender As Object, e As SCIMWebGetUserEventArgs) Public Class SCIMWebGetUserEventArgs Inherits EventArgs Public ReadOnly Property RequestId As String Public ReadOnly Property UserId As String Public Property ExternalId As String Public Property UserName As String Public Property GivenName As String Public Property FamilyName As String Public Property DisplayName As String Public Property Active As Boolean Public Property StatusCode As Integer End Class Async Version Public Event OnGetUser As AsyncEventHandler(Of SCIMWebGetUserEventArgs) Public Delegate Function AsyncEventHandler(Of TEventArgs)(sender As Object, e As TEventArgs) As Task Public Class SCIMWebGetUserEventArgs Inherits AsyncEventArgs Public ReadOnly Property CancellationToken As CancellationToken Public ReadOnly Property RequestId As String Public ReadOnly Property UserId As String Public Property ExternalId As String Public Property UserName As String Public Property GivenName As String Public Property FamilyName As String Public Property DisplayName As String Public Property Active As Boolean Public Property StatusCode As Integer End Class
Remarks
This event fires when the component receives a GET /Users/{id} request from the Identity Provider. It also fires before processing a PATCH /Users/{id} request, or when the ETagEnabled configuration setting is true and a PUT /Users/{id} or DELETE /Users/{id} request includes an If-Match header. The UserId parameter identifies the user to retrieve.
The output parameters (i.e., UserName, GivenName, FamilyName, DisplayName, Active) must be set to the current user data. If an ExternalId was stored for this user, it must be set as well. To include email addresses, phone numbers, and enterprise extension data in the response, the AddUserEmail, AddUserPhone, and AddUserExtension methods should be called once for each address, number, and user with extension data on record. This event must supply the full user for a PATCH request to work correctly.
When the user is found, the StatusCode parameter must be set to 200. If the user is not found, StatusCode must be set to 404.
The RequestType property may be used to determine whether this event was fired by a direct GET request or internally before a PATCH or a conditional PUT/DELETE.
The StatusCode parameter defaults to 500, and a value of 0 is treated as 200.
The RequestId parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.
ListGroups Event (SCIMWeb Component)
Fired when a request to list groups is received.
Syntax
public event OnListGroupsHandler OnListGroups; public delegate void OnListGroupsHandler(object sender, SCIMWebListGroupsEventArgs e); public class SCIMWebListGroupsEventArgs : EventArgs { public string RequestId { get; } public string Filter { get; } public string FilterAttribute { get; } public string FilterOperator { get; } public string FilterValue { get; } public int StartIndex { get; } public int Count { get; } public int TotalResults { get; set; } public int StatusCode { get; set; } } Async Version public event AsyncEventHandler<SCIMWebListGroupsEventArgs> OnListGroups; public delegate Task AsyncEventHandler<TEventArgs>(object sender, TEventArgs e); public class SCIMWebListGroupsEventArgs : AsyncEventArgs { public CancellationToken CancellationToken { get; } public string RequestId { get; } public string Filter { get; } public string FilterAttribute { get; } public string FilterOperator { get; } public string FilterValue { get; } public int StartIndex { get; } public int Count { get; } public int TotalResults { get; set; } public int StatusCode { get; set; } }
Public Event OnListGroups As OnListGroupsHandler Public Delegate Sub OnListGroupsHandler(sender As Object, e As SCIMWebListGroupsEventArgs) Public Class SCIMWebListGroupsEventArgs Inherits EventArgs Public ReadOnly Property RequestId As String Public ReadOnly Property Filter As String Public ReadOnly Property FilterAttribute As String Public ReadOnly Property FilterOperator As String Public ReadOnly Property FilterValue As String Public ReadOnly Property StartIndex As Integer Public ReadOnly Property Count As Integer Public Property TotalResults As Integer Public Property StatusCode As Integer End Class Async Version Public Event OnListGroups As AsyncEventHandler(Of SCIMWebListGroupsEventArgs) Public Delegate Function AsyncEventHandler(Of TEventArgs)(sender As Object, e As TEventArgs) As Task Public Class SCIMWebListGroupsEventArgs Inherits AsyncEventArgs Public ReadOnly Property CancellationToken As CancellationToken Public ReadOnly Property RequestId As String Public ReadOnly Property Filter As String Public ReadOnly Property FilterAttribute As String Public ReadOnly Property FilterOperator As String Public ReadOnly Property FilterValue As String Public ReadOnly Property StartIndex As Integer Public ReadOnly Property Count As Integer Public Property TotalResults As Integer Public Property StatusCode As Integer End Class
Remarks
This event fires when the component receives a GET /Groups request from the Identity Provider. The Filter parameter contains the raw SCIM filter expression from the request, or "" (empty string) if no filter was specified. For simple single-term filters (e.g., displayName eq "Admins"), the FilterAttribute, FilterOperator, and FilterValue parameters are also populated with the parsed components for convenience. For compound or nested filter expressions, only Filter is populated. The application must parse it directly.
The StartIndex and Count parameters reflect the pagination values from the request. StartIndex is 1-based, and Count is capped by the value of the MaxResults property. When the Identity Provider does not include a count parameter, Count defaults to MaxResults. The application should use these values to query its data source and return only the matching page of results. The sortBy and sortOrder query parameters are not currently supported and are ignored when received.
The AddGroup method must be called once for each group in the current page of results, after which the TotalResults parameter must be set to the total number of matching groups across all pages. To include members for each group, the AddGroupMember method may be called as needed. The StatusCode must be set to 200 when the operation succeeds.
To signal an error, StatusCode must be set to the appropriate HTTP status code. The StatusCode parameter defaults to 500, and a value of 0 is treated as 200.
The RequestId parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.
ListUsers Event (SCIMWeb Component)
Fired when a request to list users is received.
Syntax
public event OnListUsersHandler OnListUsers; public delegate void OnListUsersHandler(object sender, SCIMWebListUsersEventArgs e); public class SCIMWebListUsersEventArgs : EventArgs { public string RequestId { get; } public string Filter { get; } public string FilterAttribute { get; } public string FilterOperator { get; } public string FilterValue { get; } public int StartIndex { get; } public int Count { get; } public int TotalResults { get; set; } public int StatusCode { get; set; } } Async Version public event AsyncEventHandler<SCIMWebListUsersEventArgs> OnListUsers; public delegate Task AsyncEventHandler<TEventArgs>(object sender, TEventArgs e); public class SCIMWebListUsersEventArgs : AsyncEventArgs { public CancellationToken CancellationToken { get; } public string RequestId { get; } public string Filter { get; } public string FilterAttribute { get; } public string FilterOperator { get; } public string FilterValue { get; } public int StartIndex { get; } public int Count { get; } public int TotalResults { get; set; } public int StatusCode { get; set; } }
Public Event OnListUsers As OnListUsersHandler Public Delegate Sub OnListUsersHandler(sender As Object, e As SCIMWebListUsersEventArgs) Public Class SCIMWebListUsersEventArgs Inherits EventArgs Public ReadOnly Property RequestId As String Public ReadOnly Property Filter As String Public ReadOnly Property FilterAttribute As String Public ReadOnly Property FilterOperator As String Public ReadOnly Property FilterValue As String Public ReadOnly Property StartIndex As Integer Public ReadOnly Property Count As Integer Public Property TotalResults As Integer Public Property StatusCode As Integer End Class Async Version Public Event OnListUsers As AsyncEventHandler(Of SCIMWebListUsersEventArgs) Public Delegate Function AsyncEventHandler(Of TEventArgs)(sender As Object, e As TEventArgs) As Task Public Class SCIMWebListUsersEventArgs Inherits AsyncEventArgs Public ReadOnly Property CancellationToken As CancellationToken Public ReadOnly Property RequestId As String Public ReadOnly Property Filter As String Public ReadOnly Property FilterAttribute As String Public ReadOnly Property FilterOperator As String Public ReadOnly Property FilterValue As String Public ReadOnly Property StartIndex As Integer Public ReadOnly Property Count As Integer Public Property TotalResults As Integer Public Property StatusCode As Integer End Class
Remarks
This event fires when the component receives a GET /Users request from the Identity Provider. The Filter parameter contains the raw SCIM filter expression from the request, or "" (empty string) if no filter was specified. For simple single-term filters (e.g., userName eq "jsmith"), the FilterAttribute, FilterOperator, and FilterValue parameters are also populated with the parsed components for convenience. For compound or nested filter expressions, only Filter is populated. The application must parse it directly.
The StartIndex and Count parameters reflect the pagination values from the request. StartIndex is 1-based, and Count is capped by the value of the MaxResults property. When the Identity Provider does not include a count parameter, Count defaults to MaxResults. The application should use these values to query its data source and return only the matching page of results. The sortBy and sortOrder query parameters are not currently supported and are ignored when received.
The AddUser method must be called once for each user in the current page of results. To include email addresses, phone numbers, or enterprise extension data for each user, the AddUserEmail, AddUserPhone, and AddUserExtension methods may be called as needed. After all users have been added, the TotalResults parameter must be set to the total number of matching users across all pages. This value may be greater than Count if the result set is paginated. The StatusCode must be set to 200 when the operation succeeds.
To signal an error, StatusCode must be set to the appropriate HTTP status code. The StatusCode parameter defaults to 500, and a value of 0 is treated as 200.
The RequestId parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.
Log Event (SCIMWeb Component)
Fired once for each log message.
Syntax
public event OnLogHandler OnLog; public delegate void OnLogHandler(object sender, SCIMWebLogEventArgs e); public class SCIMWebLogEventArgs : EventArgs { public string RequestId { get; } public int LogLevel { get; } public string Message { get; } public string LogType { get; } } Async Version public event AsyncEventHandler<SCIMWebLogEventArgs> OnLog; public delegate Task AsyncEventHandler<TEventArgs>(object sender, TEventArgs e); public class SCIMWebLogEventArgs : AsyncEventArgs { public CancellationToken CancellationToken { get; } public string RequestId { get; } public int LogLevel { get; } public string Message { get; } public string LogType { get; } }
Public Event OnLog As OnLogHandler Public Delegate Sub OnLogHandler(sender As Object, e As SCIMWebLogEventArgs) Public Class SCIMWebLogEventArgs Inherits EventArgs Public ReadOnly Property RequestId As String Public ReadOnly Property LogLevel As Integer Public ReadOnly Property Message As String Public ReadOnly Property LogType As String End Class Async Version Public Event OnLog As AsyncEventHandler(Of SCIMWebLogEventArgs) Public Delegate Function AsyncEventHandler(Of TEventArgs)(sender As Object, e As TEventArgs) As Task Public Class SCIMWebLogEventArgs Inherits AsyncEventArgs Public ReadOnly Property CancellationToken As CancellationToken Public ReadOnly Property RequestId As String Public ReadOnly Property LogLevel As Integer Public ReadOnly Property Message As String Public ReadOnly Property LogType As String End Class
Remarks
This event fires once for each log message generated by the component while it processes a SCIM request. The verbosity is controlled by the LogLevel configuration setting.
LogLevel indicates the level of the message. Possible values are as follows:
| 0 (None) | No messages are logged. |
| 1 (Info - default) | Each request received, its completion status, and the result of authenticating the request are logged. |
| 2 (Verbose) | Equivalent to 1 (Info) for this component. No additional detail is logged at this level. |
| 3 (Debug) | Additionally logs which event (e.g., CreateUser or ListGroups) is about to be invoked to handle the current request. |
Message is the log entry.
LogType is always SCIM for this component.
The RequestId parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.
UpdateGroup Event (SCIMWeb Component)
Fired after the current group has been loaded and a replace or update request has been applied.
Syntax
public event OnUpdateGroupHandler OnUpdateGroup; public delegate void OnUpdateGroupHandler(object sender, SCIMWebUpdateGroupEventArgs e); public class SCIMWebUpdateGroupEventArgs : EventArgs { public string RequestId { get; } public string GroupId { get; } public string ExternalId { get; } public string DisplayName { get; } public int StatusCode { get; set; } } Async Version public event AsyncEventHandler<SCIMWebUpdateGroupEventArgs> OnUpdateGroup; public delegate Task AsyncEventHandler<TEventArgs>(object sender, TEventArgs e); public class SCIMWebUpdateGroupEventArgs : AsyncEventArgs { public CancellationToken CancellationToken { get; } public string RequestId { get; } public string GroupId { get; } public string ExternalId { get; } public string DisplayName { get; } public int StatusCode { get; set; } }
Public Event OnUpdateGroup As OnUpdateGroupHandler Public Delegate Sub OnUpdateGroupHandler(sender As Object, e As SCIMWebUpdateGroupEventArgs) Public Class SCIMWebUpdateGroupEventArgs Inherits EventArgs Public ReadOnly Property RequestId As String Public ReadOnly Property GroupId As String Public ReadOnly Property ExternalId As String Public ReadOnly Property DisplayName As String Public Property StatusCode As Integer End Class Async Version Public Event OnUpdateGroup As AsyncEventHandler(Of SCIMWebUpdateGroupEventArgs) Public Delegate Function AsyncEventHandler(Of TEventArgs)(sender As Object, e As TEventArgs) As Task Public Class SCIMWebUpdateGroupEventArgs Inherits AsyncEventArgs Public ReadOnly Property CancellationToken As CancellationToken Public ReadOnly Property RequestId As String Public ReadOnly Property GroupId As String Public ReadOnly Property ExternalId As String Public ReadOnly Property DisplayName As String Public Property StatusCode As Integer End Class
Remarks
This event fires when the component receives a PUT /Groups/{id} or PATCH /Groups/{id} request from the Identity Provider. For PUT, the event parameters reflect the full group representation from the request body directly. For PATCH, the component first retrieves the current group via the GetGroup event, applies the patch operations, then fires this event.
For a PUT request, the ExternalId parameter contains the externalId value from the request body, or "" (empty string) if not provided.
For a PUT request, the provided DisplayName and member list should be applied to the group identified by GroupId, and any attributes not present in the request should be cleared. For a PATCH request, the event parameters likewise reflect the complete final group, with the values loaded through the GetGroup event and the patch operations applied on top. All parameters should be applied in the same way, since any attribute the patch did not touch carries its original value.
Updated members are made available via the GroupMembers collection. The collection always reflects the full current member list after the request is applied. All stored members should be replaced with the collection contents.
When the update succeeds, StatusCode must be set to 200. It may also be set to 204, which is valid when the updated resource does not need to be returned, causing the component to return a 204 No Content response with no body. Some Identity Providers require a 200 response with the updated resource body. Check your Identity Provider's SCIM implementation guide before returning 204. If the group is not found, StatusCode must be set to 404. The StatusCode parameter defaults to 500, and a value of 0 is treated as 200.
The RequestId parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.
UpdateUser Event (SCIMWeb Component)
Fired after the current user has been loaded and a replace or update request has been applied.
Syntax
public event OnUpdateUserHandler OnUpdateUser; public delegate void OnUpdateUserHandler(object sender, SCIMWebUpdateUserEventArgs e); public class SCIMWebUpdateUserEventArgs : EventArgs { public string RequestId { get; } public string UserId { get; } public string ExternalId { get; } public string UserName { get; } public string GivenName { get; } public string FamilyName { get; } public string DisplayName { get; } public bool Active { get; } public int StatusCode { get; set; } } Async Version public event AsyncEventHandler<SCIMWebUpdateUserEventArgs> OnUpdateUser; public delegate Task AsyncEventHandler<TEventArgs>(object sender, TEventArgs e); public class SCIMWebUpdateUserEventArgs : AsyncEventArgs { public CancellationToken CancellationToken { get; } public string RequestId { get; } public string UserId { get; } public string ExternalId { get; } public string UserName { get; } public string GivenName { get; } public string FamilyName { get; } public string DisplayName { get; } public bool Active { get; } public int StatusCode { get; set; } }
Public Event OnUpdateUser As OnUpdateUserHandler Public Delegate Sub OnUpdateUserHandler(sender As Object, e As SCIMWebUpdateUserEventArgs) Public Class SCIMWebUpdateUserEventArgs Inherits EventArgs Public ReadOnly Property RequestId As String Public ReadOnly Property UserId As String Public ReadOnly Property ExternalId As String Public ReadOnly Property UserName As String Public ReadOnly Property GivenName As String Public ReadOnly Property FamilyName As String Public ReadOnly Property DisplayName As String Public ReadOnly Property Active As Boolean Public Property StatusCode As Integer End Class Async Version Public Event OnUpdateUser As AsyncEventHandler(Of SCIMWebUpdateUserEventArgs) Public Delegate Function AsyncEventHandler(Of TEventArgs)(sender As Object, e As TEventArgs) As Task Public Class SCIMWebUpdateUserEventArgs Inherits AsyncEventArgs Public ReadOnly Property CancellationToken As CancellationToken Public ReadOnly Property RequestId As String Public ReadOnly Property UserId As String Public ReadOnly Property ExternalId As String Public ReadOnly Property UserName As String Public ReadOnly Property GivenName As String Public ReadOnly Property FamilyName As String Public ReadOnly Property DisplayName As String Public ReadOnly Property Active As Boolean Public Property StatusCode As Integer End Class
Remarks
This event fires when the component receives a PUT /Users/{id} or PATCH /Users/{id} request from the Identity Provider. For PUT, the event parameters reflect the full user representation from the request body directly. For PATCH, the component first retrieves the current user via the GetUser event, applies the patch operations, then fires this event.
For a PUT request, the ExternalId parameter contains the externalId value from the request body, or "" (empty string) if not provided.
For a PUT request, all event parameters should be applied to the user identified by UserId, and any attributes not present in the request should be cleared. For a PATCH request, the event parameters likewise reflect the complete final user, with the values loaded through the GetUser event and the patch operations applied on top. All parameters should be applied in the same way, since any attribute the patch did not touch carries its original value.
The Active parameter reflects the user's active state. For a PUT request, Active defaults to true if active is absent from the request body.
Email addresses and phone numbers are made available via the UserEmails and UserPhones collections. The collections always reflect the full current state of the user after the request is applied. All stored entries should be replaced with the collection contents. Enterprise extension attributes are made available via the UserExtension property and likewise reflect the full current state after the request is applied.
When the update succeeds, StatusCode must be set to 200. It may also be set to 204, which is valid when the updated resource does not need to be returned, causing the component to return a 204 No Content response with no body. Some Identity Providers require a 200 response with the updated resource body. Check your Identity Provider's SCIM implementation guide before returning 204. If the user is not found, StatusCode must be set to 404. The StatusCode parameter defaults to 500, and a value of 0 is treated as 200.
The RequestId parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.
SCIMEmail Type
An email address associated with a SCIM user.
Remarks
This type represents a single email address entry in a SCIM user resource, including its type classification and whether it is the primary address.
Fields
Address
string (read-only)
Default:
""
The email address.
This field contains the email address value.
EmailType
string (read-only)
Default:
""
The type of email address.
This field classifies the email address. Common values include work, home, and other.
Primary
bool (read-only)
Default:
false
Whether this is the primary email address.
This field indicates whether this email address is the user's primary address. Only one entry in the collection should have Primary set to true.
Constructors
SCIMExtension Type
Enterprise extension attributes associated with a SCIM user.
Remarks
This type represents the enterprise extension attributes defined by the urn:ietf:params:scim:schemas:extension:enterprise:2.0:User schema. It is exposed via the UserExtension property during create and update events, and populated via the AddUserExtension method in get and list events.
Fields
CostCenter
string (read-only)
Default:
""
The user's cost center.
This field identifies the cost center the user is associated with.
Department
string (read-only)
Default:
""
The user's department.
This field contains the name of the department the user belongs to.
Division
string (read-only)
Default:
""
The user's division.
This field contains the name of the division the user belongs to within the organization.
EmployeeNumber
string (read-only)
Default:
""
The user's employee number.
This field contains a string identifier for the user within the organization, such as a payroll or HR system identifier.
ManagerDisplayName
string (read-only)
Default:
""
The display name of the user's manager.
This field contains the human-readable name of the manager. It corresponds to the displayName sub-attribute of the manager complex attribute in the enterprise extension schema.
ManagerId
string (read-only)
Default:
""
The user identifier of the user's manager.
This field contains the identifier of the manager's user resource within the application. It corresponds to the value sub-attribute of the manager complex attribute in the enterprise extension schema.
ManagerRef
string (read-only)
Default:
""
The URI of the manager's user resource.
This field contains the full URI reference to the manager's user resource (e.g., /scim/v2/Users/{id}). It corresponds to the $ref sub-attribute of the manager complex attribute in the enterprise extension schema.
Organization
string (read-only)
Default:
""
The user's organization.
This field contains the name of the organization the user belongs to.
Constructors
public SCIMExtension();
Public SCIMExtension()
SCIMMember Type
A member entry associated with a SCIM group.
Remarks
This type represents a single member of a SCIM group resource, including the member's resource ID and display name.
Fields
MemberDisplay
string (read-only)
Default:
""
The display name of the group member.
This field contains the display name of the member user as provided by the Identity Provider. It may be empty if the Identity Provider did not supply a display name.
MemberId
string (read-only)
Default:
""
The SCIM resource ID of the group member.
This field contains the unique identifier of the member user as assigned by the service provider.
Constructors
public SCIMMember();
Public SCIMMember()
SCIMPhone Type
A phone number associated with a SCIM user.
Remarks
This type represents a single phone number entry in a SCIM user resource, including its type classification and whether it is the primary number.
Fields
PhoneType
string (read-only)
Default:
""
The type of phone number.
This field classifies the phone number. Common values include work, mobile, home, and other.
Primary
bool (read-only)
Default:
false
Whether this is the primary phone number.
This field indicates whether this phone number is the user's primary number. Only one entry in the collection should have Primary set to true.
Constructors
Config Settings (SCIMWeb Component)
The component accepts one or more of the following configuration settings. Configuration settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the component, access to these internal properties is provided through the Config method.SCIMWeb Config Settings
When this setting is disabled, both the AuthToken property and the AuthRequest event are bypassed entirely and all requests are accepted without authentication checks. This setting should be disabled only when the hosting application, web server, or reverse proxy has already authenticated the request.
A missing header does not prevent the operation. When supplied, the header must equal the current ETag or be *. A non-matching value returns 412 Precondition Failed before the update or delete event fires.
On a GET /Users/{id} or GET /Groups/{id} request, the component also compares an incoming If-None-Match header against the current resource's ETag. When the header is present and equals the current ETag or *, a 304 Not Modified response is returned with no body instead of the resource representation.
This feature is disabled by default and should be enabled if the connecting Identity Provider requires versioned resources.
This setting does not suppress errors for a missing PatchOp schema, an empty Operations array, or an invalid operation name.
When the LogLevel configuration setting is set to 3, each ignored attribute path is recorded through the Log event. Attribute values and filter values are not included in this log entry.
JSON XPath values are rooted at /json. For example, /json/displayName selects the displayName property, and /json/members/[1]/value selects the first member's value property. XPath indices are 1-based.
Requests with an empty or invalid JSON body clear the current JSON XPath state.
Base Config Settings
In some non-GUI applications, an invalid message loop may be discovered that will result in errant behavior. In these cases, setting GUIAvailable to false will ensure that the component does not attempt to process external events.
- Product: The product the license is for.
- Product Key: The key the license was generated from.
- License Source: Where the license was found (e.g., RuntimeLicense, License File).
- License Type: The type of license installed (e.g., Royalty Free, Single Server).
- Last Valid Build: The last valid build number for which the license will work.
Setting this configuration setting to true tells the component to use the internal implementation instead of using the system security libraries.
On Windows, this setting is set to false by default. On Linux/macOS, this setting is set to true by default.
NOTE: This setting is static. The value set is applicable to all components used in the application.
When this value is set, the product's system dynamic link library (DLL) is no longer required as a reference, as all unmanaged code is stored in that file.
Trappable Errors (SCIMWeb Component)
SCIMWeb Errors
| 961 | Authentication failed. The request was rejected because the AuthRequest event did not accept the credentials. |
| 962 | Invalid request. The request body could not be parsed as valid SCIM JSON, a required field is missing, a PATCH operation or path is not supported, or an If-Match precondition failed. |
| 963 | Unsupported operation. The requested HTTP method and resource type combination is not enabled in the SupportedOperations property. |
| 964 | Filter parse error. The SCIM filter expression supplied in a GET /Users or GET /Groups request could not be parsed. |
| 965 | Endpoint not found. The request URI does not match a SCIM endpoint under the BaseURL path, or it names a resource type or schema that does not exist. |
| 966 | Method not allowed. The HTTP method is not supported by the requested SCIM endpoint. |
The component may also return one of the following error codes, which are inherited from other components.