SCIMWeb Class

Properties   Methods   Events   Config Settings   Errors  

The SCIMWeb class provides an easy way to add automatic user and group provisioning to your web application.

Syntax

class cloudsso.SCIMWeb

Remarks

The System for Cross-domain Identity Management (SCIM) protocol gives an Identity Provider (e.g., Okta or Microsoft Entra ID) a standardized way to automatically create, update, and deactivate accounts in your application. Instead of an administrator manually managing an account in every connected application, SCIM lets the Identity Provider push those changes out over a simple REST/JSON API whenever a user is hired, changes departments, or leaves the company.

The Identity Provider acts as the client, and your application is the SCIM service provider. This class implements the service provider role. It parses incoming HTTP requests, fires an event so your application can create, look up, update, or delete the corresponding record in its own data store, and then builds the SCIM JSON response.

Unlike the SCIMDesktop class, which hosts its own embedded HTTP server, this class is designed to be embedded within an existing web application or framework, using the process_request method to handle each incoming request. This makes it well suited to an application that is already running within an existing web server or framework.

Setup

The process_request method should be called from your web framework's request handler whenever a request arrives for the SCIM base URL. The incoming request is supplied to the class through the request_method, request_uri, request_headers, and request_body properties, which should be set before calling process_request. The response_status, response_headers, and response_body properties may then be read afterward to write the response.

scim.RequestMethod = request.Method; scim.RequestURI = request.RawUrl; scim.RequestHeaders = GetHeaderString(request); scim.RequestBody = requestBodyString; scim.ProcessRequest(); response.StatusCode = scim.ResponseStatus; WriteHeaders(response, scim.ResponseHeaders); response.Write(scim.ResponseBody);

The class may also be configured with information about which SCIM operations to support and how requests should be routed. The base_url property is the path prefix used to recognize SCIM resource paths, and the supported_operations property is a bitmask that controls which combinations of HTTP method and resource type are accepted. The max_results property dictates how many resources can be returned from a single list request.

scim.BaseURL = "/scim/v2"; scim.SupportedOperations = SupportedOperations.sopAll; scim.MaxResults = 200;

Authentication

Every incoming request fires the on_auth_request event before any resource-specific event is raised, giving the application the chance to accept or reject the request, unless the AuthEnabled configuration setting has been disabled. The AuthMethod parameter identifies the scheme supplied by the client, detailed below.

A static bearer token may be supplied to the class as shown.

scim.AuthToken = "the-token-issued-to-your-identity-provider";

Alternatively, custom validation may be performed as shown.

scim.OnAuthRequest += (sender, e) => { e.Accept = e.AuthMethod == "Bearer" && tokenStore.IsValid(e.Token); };

User Management

The class fires an event for each standard SCIM user operation, giving the application full control over how users are stored.

Creating a User

A POST /Users request causes the on_create_user event to be fired with the submitted attributes, including any addresses and phone numbers through the user_emails and user_phones properties and enterprise attributes (department, employee number, manager, and so on) through the user_extension property. The handler must assign and return a unique UserId and set the StatusCode parameter to 201.

Retrieving and Listing Users

A GET /Users/{id} request causes the on_get_user event to be fired. The handler populates the user's current attributes and the add_user_email, add_user_phone, and add_user_extension methods may be called to include any related data.

A GET /Users request causes the on_list_users event to be fired instead, with pagination reflected in the StartIndex and Count parameters and, for simple single-term filters such as userName eq "jsmith", the parsed FilterAttribute, FilterOperator, and FilterValue parameters. The add_user method should be called once per matching user, and the TotalResults parameter should be set to the total across all pages.

scim.OnListUsers += (sender, e) => { var page = db.QueryUsers(e.FilterAttribute, e.FilterOperator, e.FilterValue, e.StartIndex - 1, e.Count); foreach (var user in page.Results) { scim.AddUser(user.Id, user.UserName, user.DisplayName, user.ExternalId, user.Active); } e.TotalResults = page.TotalCount; e.StatusCode = 200; };

Updating and Deleting Users

Both PUT /Users/{id} and PATCH /Users/{id} requests cause the on_update_user event to be fired. For a PATCH request, the class first fires the on_get_user event to load the current record, applies the patch operations from the request (including path-filtered operations such as emails[type eq "work"]) internally, and then fires the on_update_user event with the fully merged result, so the handler always sees a complete, final representation of the user regardless of which method was used. The read-only request_type property should be used if the handler needs to distinguish which method triggered the current event.

A DELETE /Users/{id} request causes the on_delete_user event to be fired. Deactivating a user without deleting their record is done the standard SCIM way, by setting the Active parameter to False through an update rather than issuing a delete.

Group Management

Groups follow the same pattern as users, and the on_create_group, on_get_group, on_list_groups, on_update_group, and on_delete_group events all mirror their user counterparts. Group members are provided through the group_members properties on create and update, and are added to an outgoing response with the add_group_member method. The add_group method is used to add each group to a on_list_groups event response.

Discovery Endpoints

The class automatically answers the standard SCIM discovery endpoints so an Identity Provider can inspect your service provider's capabilities before provisioning begins.

A GET /ServiceProviderConfig request, which causes the on_get_service_provider_config event to be fired, advertises the supported authentication scheme and which operations are enabled, based on the supported_operations property. GET /ResourceTypes requests, which cause the on_get_resource_types event to be fired, and GET /Schemas requests, which cause the on_get_schemas event to be fired, describe the User and Group resource and schema definitions, including the enterprise user extension. All three events are informational, so the response body has already been generated by the time each one fires.

Property List

---

The following is the full list of the properties of the class with short descriptions. Click on the links for further details.

Method List

---

The following is the full list of the methods of the class with short descriptions. Click on the links for further details.

Event List

---

The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.

Config Settings

---

The following is a list of config settings for the class with short descriptions. Click on the links for further details.

auth_token property

The Bearer token used to authenticate incoming SCIM requests.

Syntax

def get_auth_token() -> str: ...

def set_auth_token(value: str) -> None: ...


auth_token = property(get_auth_token, set_auth_token)

Default Value

""

Remarks

When this property is set, the class compares the incoming authorization bearer token against its value and initializes the Accept parameter of the on_auth_request event accordingly before the event fires. If the token is missing or does not match, the Accept parameter will be set to False. Likewise, if a match is found, the Accept parameter will be set to True. This value may be overridden in the handler when the on_auth_request event fires (e.g., the handler can reject a matching token to enforce expiry or check a revocation list).

This property only takes effect for Bearer authentication and has no influence on other authentication schemes.

When this property is empty, no automatic comparison is performed and Accept defaults to False. Without an on_auth_request handler that explicitly accepts the request, all incoming requests receive a 401 Unauthorized response.

base_url property

The base URL path for SCIM endpoints.

Syntax

def get_base_url() -> str: ...

def set_base_url(value: str) -> None: ...


base_url = property(get_base_url, set_base_url)

Default Value

"/scim/v2"

Remarks

This property defines the base path prefix the class uses when routing incoming requests to SCIM endpoints. All SCIM resource paths are resolved relative to this value (e.g., with the default value of /scim/v2, a request for /scim/v2/Users is recognized as a User list request).

This value must begin with a forward slash. Trailing slashes are removed automatically, so /scim/v2/ and /scim/v2 are equivalent.

group_member_count property

The number of records in the GroupMember arrays.

Syntax

def get_group_member_count() -> int: ...


group_member_count = property(get_group_member_count, None)

Default Value

0

Remarks

This property controls the size of the following arrays:

• group_member_member_display
• group_member_member_id

The array indices start at 0 and end at group_member_count - 1.

This property is read-only.

group_member_member_display property

The display name of the group member.

Syntax

def get_group_member_member_display(group_member_index: int) -> str: ...

Default Value

""

Remarks

The display name of the group member.

This property contains the display name of the member user as provided by the Identity Provider. It may be empty if the Identity Provider did not supply a display name.

The group_member_index parameter specifies the index of the item in the array. The size of the array is controlled by the group_member_count property.

This property is read-only.

group_member_member_id property

The SCIM resource ID of the group member.

Syntax

def get_group_member_member_id(group_member_index: int) -> str: ...

Default Value

""

Remarks

The SCIM resource ID of the group member.

This property contains the unique identifier of the member user as assigned by the service provider.

The group_member_index parameter specifies the index of the item in the array. The size of the array is controlled by the group_member_count property.

This property is read-only.

max_results property

The maximum number of resources requested from the application in a single list request.

Syntax

def get_max_results() -> int: ...

def set_max_results(value: int) -> None: ...


max_results = property(get_max_results, set_max_results)

Default Value

200

Remarks

This property limits the Count parameter of the on_list_users and on_list_groups events. When the Identity Provider omits the count query parameter or requests more results than this value, Count is set to this value. The class does not remove resources from the response, so the event handler should add no more than Count resources.

This value is also reported in the ServiceProviderConfig discovery endpoint as the maximum allowed value for pagination.

request_body property

The body of the incoming SCIM request.

Syntax

def get_request_body() -> str: ...

def set_request_body(value: str) -> None: ...


request_body = property(get_request_body, set_request_body)

Default Value

""

Remarks

This property is used before calling the process_request method to provide the request body directly. For SCIM operations that include a body (e.g., POST, PUT, PATCH), this must contain the raw JSON payload.

The request is passed to the class by setting the request properties before calling process_request, as shown.

scim.RequestMethod = request.Method; scim.RequestURI = request.RawUrl; scim.RequestHeaders = GetHeaderString(request); scim.RequestBody = new StreamReader(request.InputStream).ReadToEnd(); scim.ProcessRequest(); response.StatusCode = scim.ResponseStatus; response.Write(scim.ResponseBody);

request_headers property

The HTTP headers of the incoming SCIM request.

Syntax

def get_request_headers() -> str: ...

def set_request_headers(value: str) -> None: ...


request_headers = property(get_request_headers, set_request_headers)

Default Value

""

Remarks

This property is used before calling the process_request method to provide the request headers directly. Headers must be formatted as Name: Value pairs separated by CRLF or newline.

Authorization: Bearer secret-token Content-Type: application/scim+json

The request is passed to the class by setting the request properties before calling process_request, as shown.

scim.RequestMethod = request.Method; scim.RequestURI = request.RawUrl; scim.RequestHeaders = GetHeaderString(request); scim.RequestBody = new StreamReader(request.InputStream).ReadToEnd(); scim.ProcessRequest(); response.StatusCode = scim.ResponseStatus; response.Write(scim.ResponseBody);

request_method property

The HTTP method of the incoming SCIM request.

Syntax

def get_request_method() -> str: ...

def set_request_method(value: str) -> None: ...


request_method = property(get_request_method, set_request_method)

Default Value

""

Remarks

This property is used before calling the process_request method to provide the HTTP method directly. Common values include GET, POST, PUT, PATCH, and DELETE.

The request is passed to the class by setting the request properties before calling process_request, as shown.

scim.RequestMethod = request.Method; scim.RequestURI = request.RawUrl; scim.RequestHeaders = GetHeaderString(request); scim.RequestBody = new StreamReader(request.InputStream).ReadToEnd(); scim.ProcessRequest(); response.StatusCode = scim.ResponseStatus; response.Write(scim.ResponseBody);

request_type property

The HTTP method of the request currently being processed.

Syntax

def get_request_type() -> str: ...


request_type = property(get_request_type, None)

Default Value

""

Remarks

This read-only property is used to determine the HTTP method (GET, POST, PUT, PATCH, or DELETE) of the request being processed. It is eligible to be queried during any event fired by the class.

When the class processes a PATCH request, it fires the on_get_user or on_get_group event to retrieve the current resource first. When the ETagEnabled configuration setting is True and the client includes an If-Match header on a PUT or DELETE request, the on_get_user or on_get_group event also fires to validate the ETag before the update or delete event.

This property is read-only.

request_uri property

The URI of the incoming SCIM request.

Syntax

def get_request_uri() -> str: ...

def set_request_uri(value: str) -> None: ...


request_uri = property(get_request_uri, set_request_uri)

Default Value

""

Remarks

This property is used before calling the process_request method to provide the request URI directly. The value should include the path and query string (e.g., /scim/v2/Users?filter=userName+eq+"jsmith").

The request is passed to the class by setting the request properties before calling process_request, as shown.

scim.RequestMethod = request.Method; scim.RequestURI = request.RawUrl; scim.RequestHeaders = GetHeaderString(request); scim.RequestBody = new StreamReader(request.InputStream).ReadToEnd(); scim.ProcessRequest(); response.StatusCode = scim.ResponseStatus; response.Write(scim.ResponseBody);

response_body property

The body of the SCIM response generated by the class.

Syntax

def get_response_body() -> str: ...


response_body = property(get_response_body, None)

Default Value

""

Remarks

After the process_request method returns, this property contains the JSON response body that must be written to the HTTP response. The value is a complete SCIM JSON document. For operations that produce no body (e.g., a successful DELETE, or a 304 Not Modified response when the ETagEnabled configuration setting is enabled), this property is empty.

This property is read-only.

response_headers property

The HTTP headers of the SCIM response generated by the class.

Syntax

def get_response_headers() -> str: ...


response_headers = property(get_response_headers, None)

Default Value

""

Remarks

After the process_request method returns, this property contains the CRLF-delimited response headers that must be written to the HTTP response. For responses with a JSON body, this includes a Content-Type header of application/scim+json, the media type specified for SCIM by RFC 7644. For 204 No Content responses, such as successful deletes, and 304 Not Modified responses, no Content-Type header is included.

This property is read-only.

response_status property

The HTTP status code of the SCIM response generated by the class.

Syntax

def get_response_status() -> int: ...


response_status = property(get_response_status, None)

Default Value

0

Remarks

After the process_request method returns, this property contains the HTTP status code that must be written to the HTTP response (e.g., 200, 201, 204, 400, 401, 404).

This property is read-only.

supported_operations property

A bitmask that controls which SCIM operations the class accepts.

Syntax

def get_supported_operations() -> int: ...

def set_supported_operations(value: int) -> None: ...


supported_operations = property(get_supported_operations, set_supported_operations)

Default Value

65535

Remarks

This property determines which SCIM operations are enabled. Requests for disabled operations receive a 501 Not Implemented response. The following flags are defined (specified in hexadecimal notation) and may be combined:

Bits not listed above are reserved for future use and are currently ignored. sopAll is defined as 0xFFFF to include any operations added in future versions.

Note that PUT and PATCH requests share the same flag (sopUserUpdate / sopGroupUpdate). Enabling the flag accepts both methods, and disabling it rejects both. For PATCH requests, the class retrieves the current resource via on_get_user or on_get_group, applies the patch operations, then fires on_update_user or on_update_group with the merged result.

When the ETagEnabled configuration setting is enabled and a PUT or DELETE request includes an If-Match header, the class also fires on_get_user or on_get_group to validate the ETag before the update or delete event fires.

The discovery endpoints (/ServiceProviderConfig, /ResourceTypes, /Schemas) are always available regardless of this property's value.

The capabilities advertised in the ServiceProviderConfig discovery endpoint are derived from this property automatically.

user_email_count property

The number of records in the UserEmail arrays.

Syntax

def get_user_email_count() -> int: ...


user_email_count = property(get_user_email_count, None)

Default Value

0

Remarks

This property controls the size of the following arrays:

• user_email_address
• user_email_primary
• user_email_type

The array indices start at 0 and end at user_email_count - 1.

This property is read-only.

user_email_address property

The email address.

Syntax

def get_user_email_address(user_email_index: int) -> str: ...

Default Value

""

Remarks

The email address.

This property contains the email address value.

The user_email_index parameter specifies the index of the item in the array. The size of the array is controlled by the user_email_count property.

This property is read-only.

user_email_primary property

Whether this is the primary email address.

Syntax

def get_user_email_primary(user_email_index: int) -> bool: ...

Default Value

False

Remarks

Whether this is the primary email address.

This property indicates whether this email address is the user's primary address. Only one entry in the collection should have Primary set to True.

The user_email_index parameter specifies the index of the item in the array. The size of the array is controlled by the user_email_count property.

This property is read-only.

user_email_type property

The type of email address.

Syntax

def get_user_email_type(user_email_index: int) -> str: ...

Default Value

""

Remarks

The type of email address.

This property classifies the email address. Common values include work, home, and other.

The user_email_index parameter specifies the index of the item in the array. The size of the array is controlled by the user_email_count property.

This property is read-only.

user_extension_cost_center property

The user's cost center.

Syntax

def get_user_extension_cost_center() -> str: ...


user_extension_cost_center = property(get_user_extension_cost_center, None)

Default Value

""

Remarks

The user's cost center.

This property identifies the cost center the user is associated with.

This property is read-only.

user_extension_department property

The user's department.

Syntax

def get_user_extension_department() -> str: ...


user_extension_department = property(get_user_extension_department, None)

Default Value

""

Remarks

The user's department.

This property contains the name of the department the user belongs to.

This property is read-only.

user_extension_division property

The user's division.

Syntax

def get_user_extension_division() -> str: ...


user_extension_division = property(get_user_extension_division, None)

Default Value

""

Remarks

The user's division.

This property contains the name of the division the user belongs to within the organization.

This property is read-only.

user_extension_employee_number property

The user's employee number.

Syntax

def get_user_extension_employee_number() -> str: ...


user_extension_employee_number = property(get_user_extension_employee_number, None)

Default Value

""

Remarks

The user's employee number.

This property contains a string identifier for the user within the organization, such as a payroll or HR system identifier.

This property is read-only.

user_extension_manager_display_name property

The display name of the user's manager.

Syntax

def get_user_extension_manager_display_name() -> str: ...


user_extension_manager_display_name = property(get_user_extension_manager_display_name, None)

Default Value

""

Remarks

The display name of the user's manager.

This property contains the human-readable name of the manager. It corresponds to the displayName sub-attribute of the manager complex attribute in the enterprise extension schema.

This property is read-only.

user_extension_manager_id property

The user identifier of the user's manager.

Syntax

def get_user_extension_manager_id() -> str: ...


user_extension_manager_id = property(get_user_extension_manager_id, None)

Default Value

""

Remarks

The user identifier of the user's manager.

This property contains the identifier of the manager's user resource within the application. It corresponds to the value sub-attribute of the manager complex attribute in the enterprise extension schema.

This property is read-only.

user_extension_manager_ref property

The URI of the manager's user resource.

Syntax

def get_user_extension_manager_ref() -> str: ...


user_extension_manager_ref = property(get_user_extension_manager_ref, None)

Default Value

""

Remarks

The URI of the manager's user resource.

This property contains the full URI reference to the manager's user resource (e.g., /scim/v2/Users/{id}). It corresponds to the $ref sub-attribute of the manager complex attribute in the enterprise extension schema.

This property is read-only.

user_extension_organization property

The user's organization.

Syntax

def get_user_extension_organization() -> str: ...


user_extension_organization = property(get_user_extension_organization, None)

Default Value

""

Remarks

The user's organization.

This property contains the name of the organization the user belongs to.

This property is read-only.

user_phone_count property

The number of records in the UserPhone arrays.

Syntax

def get_user_phone_count() -> int: ...


user_phone_count = property(get_user_phone_count, None)

Default Value

0

Remarks

This property controls the size of the following arrays:

• user_phone_number
• user_phone_primary
• user_phone_type

The array indices start at 0 and end at user_phone_count - 1.

This property is read-only.

user_phone_number property

The phone number.

Syntax

def get_user_phone_number(user_phone_index: int) -> str: ...

Default Value

""

Remarks

The phone number.

This property contains the phone number value.

The user_phone_index parameter specifies the index of the item in the array. The size of the array is controlled by the user_phone_count property.

This property is read-only.

user_phone_primary property

Whether this is the primary phone number.

Syntax

def get_user_phone_primary(user_phone_index: int) -> bool: ...

Default Value

False

Remarks

Whether this is the primary phone number.

This property indicates whether this phone number is the user's primary number. Only one entry in the collection should have Primary set to True.

The user_phone_index parameter specifies the index of the item in the array. The size of the array is controlled by the user_phone_count property.

This property is read-only.

user_phone_type property

The type of phone number.

Syntax

def get_user_phone_type(user_phone_index: int) -> str: ...

Default Value

""

Remarks

The type of phone number.

This property classifies the phone number. Common values include work, mobile, home, and other.

The user_phone_index parameter specifies the index of the item in the array. The size of the array is controlled by the user_phone_count property.

This property is read-only.

add_group method

Adds a group entry to the outgoing list response.

Syntax

def add_group(group_id: str, display_name: str, external_id: str) -> None: ...

Remarks

This method should be called within a on_list_groups event handler once for each group in the current page of results. The class then assembles all added entries into the SCIM ListResponse envelope.

group_id is the unique identifier for the group, and display_name may be empty if not available.

The stored external_id should be passed for the group (or "" (empty string) if not recorded).

After all entries have been added, the TotalResults event parameter should be set to the total number of matching groups across all pages, which may be greater than the number of entries added in the current method call.

scim.OnListGroups += (sender, e) => { var page = db.QueryGroups(e.FilterAttribute, e.FilterOperator, e.FilterValue, e.StartIndex - 1, e.Count); foreach (var group in page.Results) { scim.AddGroup(group.Id, group.DisplayName, group.ExternalId); } e.TotalResults = page.TotalCount; e.StatusCode = 200; };

add_group_member method

Adds a member to the outgoing group response.

Syntax

def add_group_member(group_id: str, member_id: str, member_display: str) -> None: ...

Remarks

This method should be called within a on_get_group or on_list_groups event handler once for each group member to be included in the SCIM response.

group_id identifies the group to which the member belongs, and member_id and member_display represent the SCIM resource ID and display name of the member user, respectively.

scim.OnGetGroup += (sender, e) => { var group = db.FindGroup(e.GroupId); e.DisplayName = group.DisplayName; e.ExternalId = group.ExternalId; foreach (var member in group.Members) { scim.AddGroupMember(e.GroupId, member.UserId, member.DisplayName); } e.StatusCode = 200; };

add_user method

Adds a user entry to the outgoing list response.

Syntax

def add_user(user_id: str, user_name: str, display_name: str, external_id: str, active: bool) -> None: ...

Remarks

This method should be called within a on_list_users event handler once for each user in the current page of results. The class then assembles all added entries into the SCIM ListResponse envelope.

user_id is the unique identifier for the user, user_name is the user's SCIM username, and display_name may be empty if not available.

The stored external_id should be passed for the user (or "" (empty string) if not recorded). active indicates whether the user account is enabled.

After all entries have been added, the TotalResults event parameter should be set to the total number of matching users across all pages, which may be greater than the number of entries added in the current method call.

void scim_ListUsers(object sender, SCIMWebListUsersEventArgs e) { var results = db.QueryUsers(e.FilterAttribute, e.FilterOperator, e.FilterValue, e.StartIndex - 1, e.Count); foreach (var user in results.Page) scim.AddUser(user.Id, user.UserName, user.DisplayName, user.ExternalId, user.Active); e.TotalResults = results.TotalCount; e.StatusCode = 0; }

add_user_email method

Adds an email address to the outgoing user response.

Syntax

def add_user_email(user_id: str, address: str, email_type: str, primary: bool) -> None: ...

Remarks

This method should be called within a on_get_user or on_list_users event handler once for each user's email address to be included in the response.

user_id identifies which user the address belongs to. address is the email address string, and email_type classifies the address (common values include work, home, and other). primary should be set to True only for the user's primary address.

scim.OnGetUser += (sender, e) => { var user = db.FindUser(e.UserId); e.UserName = user.UserName; e.DisplayName = user.DisplayName; e.Active = user.Active; foreach (var email in user.Emails) { scim.AddUserEmail(e.UserId, email.Address, email.EmailType, email.Primary); } e.StatusCode = 200; };

add_user_extension method

Adds enterprise extension attributes to the outgoing user response.

Syntax

def add_user_extension(user_id: str, department: str, employee_number: str, cost_center: str, organization: str, division: str, manager_id: str, manager_ref: str, manager_display_name: str) -> None: ...

Remarks

This method should be called within a on_get_user or on_list_users event handler once for each user's enterprise extension data to be included in the response.

user_id identifies which user the data belongs to. department, employee_number, cost_center, organization, and division are the enterprise user attributes.

manager_id is the user identifier of the user's manager, manager_ref is the full URI of the manager's user resource, and manager_display_name is the manager's display name.

"" (empty string) should be passed for any attribute that is not applicable or not stored.

scim.OnGetUser += (sender, e) => { var user = db.FindUser(e.UserId); e.UserName = user.UserName; e.DisplayName = user.DisplayName; e.Active = user.Active; if (user.HasManager) { scim.AddUserExtension(e.UserId, user.Department, user.EmployeeNumber, user.CostCenter, user.Organization, user.Division, user.ManagerId, "", user.ManagerDisplayName); } e.StatusCode = 200; };

The class natively supports the SCIM enterprise user extension schema (urn:ietf:params:scim:schemas:extension:enterprise:2.0:User). The extension schema namespace is handled internally. The API exposes extension attributes directly without requiring the URN to be specified. Additional extension schemas may be supported in future releases.

add_user_phone method

Adds a phone number to the outgoing user response.

Syntax

def add_user_phone(user_id: str, number: str, phone_type: str, primary: bool) -> None: ...

Remarks

This method should be called within a on_get_user or on_list_users event handler once for each user's phone number to be included in the response.

user_id identifies which user the number belongs to. number is the phone number string, and phone_type classifies the number (common values include work, mobile, home, and other). primary should be set to True only for the user's primary number.

scim.OnGetUser += (sender, e) => { var user = db.FindUser(e.UserId); e.UserName = user.UserName; e.DisplayName = user.DisplayName; e.Active = user.Active; foreach (var phone in user.Phones) { scim.AddUserPhone(e.UserId, phone.Number, phone.PhoneType, phone.Primary); } e.StatusCode = 200; };

config method

Sets or retrieves a configuration setting.

Syntax

def config(configuration_string: str) -> str: ...

Remarks

config is a generic method available in every class. It is used to set and retrieve configuration settings for the class.

These settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the config method.

To set a configuration setting named PROPERTY, you must call Config("PROPERTY=VALUE"), where VALUE is the value of the setting expressed as a string. For boolean values, use the strings "True", "False", "0", "1", "Yes", or "No" (case does not matter).

To read (query) the value of a configuration setting, you must call Config("PROPERTY"). The value will be returned as a string.

process_request method

Processes an incoming SCIM request and generates a response.

Syntax

def process_request() -> None: ...

Remarks

This method is used as the primary entry point for the SCIMWeb class and should be called from your web framework's request handler whenever a request is received for the SCIM base URL.

The request_method, request_uri, request_headers, and request_body properties supply the request to the class and must be set before this method is called. These properties are not cleared automatically after process_request returns, so when they are set explicitly, a new value should be assigned to each of them before every subsequent call.

Internally, the class authenticates the request (i.e., fires the on_auth_request event), routes it to the appropriate resource handler, fires the corresponding event (such as on_create_user or on_list_groups), and assembles the response. The response_status, response_headers, and response_body properties are populated with the response.

Manual Request Passing Example

scim.RequestMethod = request.Method; scim.RequestURI = request.RawUrl; scim.RequestHeaders = GetHeaderString(request); scim.RequestBody = new StreamReader(request.InputStream).ReadToEnd(); scim.ProcessRequest(); response.StatusCode = scim.ResponseStatus; response.Write(scim.ResponseBody);

reset method

This method will reset the class.

Syntax

def reset() -> None: ...

Remarks

This method will reset the class's properties to their default values.

on_auth_request event

Fired for every incoming request to control access to specific endpoints.

Syntax

class SCIMWebAuthRequestEventParams(object):
  @property
  def request_id() -> int: ...
  @property
  def auth_method() -> str: ...
  @property
  def user() -> str: ...
  @property
  def token() -> str: ...
  @property
  def accept() -> bool: ...
  @accept.setter
  def accept(value) -> None: ...
# In class SCIMWeb:
@property
def on_auth_request() -> Callable[[SCIMWebAuthRequestEventParams], None]: ...
@on_auth_request.setter
def on_auth_request(event_hook: Callable[[SCIMWebAuthRequestEventParams], None]) -> None: ...

Remarks

This event fires for every incoming request before any resource event is raised, allowing the application to implement custom authentication logic.

The auth_method parameter identifies the authentication scheme supplied by the client.

The accept value may be changed when additional logic outside of the class is required (e.g., to enforce token expiry, check a revocation list, or accept an alternative authentication scheme).

Requests rejected by this event receive a 401 Unauthorized response.

The request_id parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.

Note that this event is not fired when the AuthEnabled configuration setting is disabled.

Custom validation covering multiple authentication schemes may be performed as shown.

scim.OnAuthRequest += (sender, e) => { if (e.AuthMethod == "Bearer") { e.Accept = tokenStore.IsValid(e.Token); } else if (e.AuthMethod == "Basic") { e.Accept = userStore.CheckPassword(e.User, e.Token); } else { e.Accept = false; } };

on_create_group event

Fired when a request to create a new group is received.

Syntax

class SCIMWebCreateGroupEventParams(object):
  @property
  def request_id() -> int: ...
  @property
  def external_id() -> str: ...
  @property
  def display_name() -> str: ...
  @property
  def group_id() -> str: ...
  @group_id.setter
  def group_id(value) -> None: ...
  @property
  def status_code() -> int: ...
  @status_code.setter
  def status_code(value) -> None: ...
# In class SCIMWeb:
@property
def on_create_group() -> Callable[[SCIMWebCreateGroupEventParams], None]: ...
@on_create_group.setter
def on_create_group(event_hook: Callable[[SCIMWebCreateGroupEventParams], None]) -> None: ...

Remarks

This event fires when the class receives a POST /Groups request from the Identity Provider. The inbound group attributes are provided as event parameters.

If the Identity Provider included an external_id in the request, it is made available in the external_id parameter. This value should be stored alongside the group record so it can be returned in future on_get_group event responses.

If the request includes group members, they are made available via the group_members collection, where each entry exposes a MemberId and MemberDisplay property.

If the group is created successfully, the group_id parameter must be set to the newly assigned identifier, and the status_code parameter must be set to 201. The full created resource is returned to the Identity Provider in the 201 Created response body. To signal an error, status_code must be set to the appropriate HTTP status code (e.g., 409 for a duplicate group). The status_code parameter defaults to 500, and a value of 0 is treated as 201.

The request_id parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.

on_create_user event

Fired when a request to create a new user is received.

Syntax

class SCIMWebCreateUserEventParams(object):
  @property
  def request_id() -> int: ...
  @property
  def external_id() -> str: ...
  @property
  def user_name() -> str: ...
  @property
  def given_name() -> str: ...
  @property
  def family_name() -> str: ...
  @property
  def display_name() -> str: ...
  @property
  def active() -> bool: ...
  @property
  def user_id() -> str: ...
  @user_id.setter
  def user_id(value) -> None: ...
  @property
  def status_code() -> int: ...
  @status_code.setter
  def status_code(value) -> None: ...
# In class SCIMWeb:
@property
def on_create_user() -> Callable[[SCIMWebCreateUserEventParams], None]: ...
@on_create_user.setter
def on_create_user(event_hook: Callable[[SCIMWebCreateUserEventParams], None]) -> None: ...

Remarks

This event fires when the class receives a POST /Users request from the Identity Provider. The inbound user attributes are provided as event parameters.

If the Identity Provider included an external_id in the request, it is made available in the external_id parameter. This value should be stored alongside the user record so it can be returned in future on_get_user event responses.

The active parameter indicates whether the new user account should be enabled. If the Identity Provider does not include an active attribute in the request, active defaults to True.

Email addresses and phone numbers supplied in the request are made available via the user_emails and user_phones collections, where each entry exposes an Address, EmailType, and Primary property (for emails) or a Number, PhoneType, and Primary property (for phones). If the Identity Provider included enterprise extension attributes in the request, they are also made available via the user_extension property.

If the user is created successfully, the user_id parameter must be set to the newly assigned identifier, and the status_code parameter must be set to 201. The full created resource is returned to the Identity Provider in the 201 Created response body. To signal an error, status_code must be set to the appropriate HTTP status code (e.g., 409 for a duplicate user). The status_code parameter defaults to 500, and a value of 0 is treated as 201.

The request_id parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.

on_delete_group event

Fired when a request to delete a group is received.

Syntax

class SCIMWebDeleteGroupEventParams(object):
  @property
  def request_id() -> int: ...
  @property
  def group_id() -> str: ...
  @property
  def status_code() -> int: ...
  @status_code.setter
  def status_code(value) -> None: ...
# In class SCIMWeb:
@property
def on_delete_group() -> Callable[[SCIMWebDeleteGroupEventParams], None]: ...
@on_delete_group.setter
def on_delete_group(event_hook: Callable[[SCIMWebDeleteGroupEventParams], None]) -> None: ...

Remarks

This event fires when the class receives a DELETE /Groups/{id} request from the Identity Provider. The group_id parameter identifies the group to delete.

If the deletion is successful, the status_code parameter must be set to 204. The class then returns a 204 No Content response. If the group is not found, status_code must be set to 404. The status_code parameter defaults to 500, and a value of 0 is treated as 204.

The request_id parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.

on_delete_user event

Fired when a request to delete a user is received.

Syntax

class SCIMWebDeleteUserEventParams(object):
  @property
  def request_id() -> int: ...
  @property
  def user_id() -> str: ...
  @property
  def status_code() -> int: ...
  @status_code.setter
  def status_code(value) -> None: ...
# In class SCIMWeb:
@property
def on_delete_user() -> Callable[[SCIMWebDeleteUserEventParams], None]: ...
@on_delete_user.setter
def on_delete_user(event_hook: Callable[[SCIMWebDeleteUserEventParams], None]) -> None: ...

Remarks

This event fires when the class receives a DELETE /Users/{id} request from the Identity Provider. The user_id parameter identifies the user to delete.

If the deletion is successful, the status_code parameter must be set to 204. The class then returns a 204 No Content response. If the user is not found, status_code must be set to 404. The status_code parameter defaults to 500, and a value of 0 is treated as 204.

The request_id parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.

on_error event

Fired when an error occurs while processing a SCIM request.

Syntax

class SCIMWebErrorEventParams(object):
  @property
  def request_id() -> int: ...
  @property
  def error_code() -> int: ...
  @property
  def description() -> str: ...
# In class SCIMWeb:
@property
def on_error() -> Callable[[SCIMWebErrorEventParams], None]: ...
@on_error.setter
def on_error(event_hook: Callable[[SCIMWebErrorEventParams], None]) -> None: ...

Remarks

This event fires when the class cannot complete a SCIM request, immediately before the error response is returned to the Identity Provider. It fires both for requests the class itself rejects, such as a malformed request body or a failed authentication, and for requests an application event handler rejects by setting its StatusCode parameter to 400 or higher.

error_code identifies the condition. Requests rejected by the class report one of the codes listed in the Error Codes section, while a status returned by an application event handler reports the generic error code 1.

description is the message carried in the detail field of the SCIM error response body.

This event is informational. The HTTP status and the response body have already been determined by the time it fires, so a handler cannot suppress the error or change what is returned to the Identity Provider.

The request_id parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.

on_get_group event

Fired when a request to retrieve a group is received, before a PATCH group update, or when ETags are enabled and a PUT or DELETE request includes an If-Match header.

Syntax

class SCIMWebGetGroupEventParams(object):
  @property
  def request_id() -> int: ...
  @property
  def group_id() -> str: ...
  @property
  def external_id() -> str: ...
  @external_id.setter
  def external_id(value) -> None: ...
  @property
  def display_name() -> str: ...
  @display_name.setter
  def display_name(value) -> None: ...
  @property
  def status_code() -> int: ...
  @status_code.setter
  def status_code(value) -> None: ...
# In class SCIMWeb:
@property
def on_get_group() -> Callable[[SCIMWebGetGroupEventParams], None]: ...
@on_get_group.setter
def on_get_group(event_hook: Callable[[SCIMWebGetGroupEventParams], None]) -> None: ...

Remarks

This event fires when the class receives a GET /Groups/{id} request from the Identity Provider. It also fires before processing a PATCH /Groups/{id} request, or when the ETagEnabled configuration setting is True and a PUT /Groups/{id} or DELETE /Groups/{id} request includes an If-Match header. The group_id parameter identifies the group to retrieve.

The display_name must be set to the group's display name. If an external_id was stored for this group, it must be set as well. To include group members in the response, the add_group_member method should be called once for each member. This event must supply the full group for a PATCH request to work correctly.

When the group is found, the status_code parameter must be set to 200. If the group is not found, status_code must be set to 404.

The request_type property may be used to determine whether this event was fired by a direct GET request or internally before a PATCH or a conditional PUT/DELETE.

The status_code parameter defaults to 500, and a value of 0 is treated as 200.

The request_id parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.

on_get_resource_types event

Fired when a request for the resource type definitions is received.

Syntax

class SCIMWebGetResourceTypesEventParams(object):
  @property
  def request_id() -> int: ...
  @property
  def response_body() -> bytes: ...
# In class SCIMWeb:
@property
def on_get_resource_types() -> Callable[[SCIMWebGetResourceTypesEventParams], None]: ...
@on_get_resource_types.setter
def on_get_resource_types(event_hook: Callable[[SCIMWebGetResourceTypesEventParams], None]) -> None: ...

Remarks

This event fires when the class receives a GET /ResourceTypes request from the Identity Provider. The class returns the standard SCIM User and Group resource type definitions automatically and populates the response_body parameter with the serialized JSON before firing this event.

This event is informational and may be used to log or audit discovery requests and inspect the generated response.

The request_id parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.

on_get_schemas event

Fired when a request for the schema definitions is received.

Syntax

class SCIMWebGetSchemasEventParams(object):
  @property
  def request_id() -> int: ...
  @property
  def response_body() -> bytes: ...
# In class SCIMWeb:
@property
def on_get_schemas() -> Callable[[SCIMWebGetSchemasEventParams], None]: ...
@on_get_schemas.setter
def on_get_schemas(event_hook: Callable[[SCIMWebGetSchemasEventParams], None]) -> None: ...

Remarks

This event fires when the class receives a GET /Schemas request from the Identity Provider. The class returns the standard SCIM User and Group schema definitions, including the enterprise user extension, automatically and populates the response_body parameter with the serialized JSON before firing this event.

This event is informational and may be used to log or audit discovery requests and inspect the generated response.

The request_id parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.

on_get_service_provider_config event

Fired when a request for the service provider configuration is received.

Syntax

class SCIMWebGetServiceProviderConfigEventParams(object):
  @property
  def request_id() -> int: ...
  @property
  def response_body() -> bytes: ...
# In class SCIMWeb:
@property
def on_get_service_provider_config() -> Callable[[SCIMWebGetServiceProviderConfigEventParams], None]: ...
@on_get_service_provider_config.setter
def on_get_service_provider_config(event_hook: Callable[[SCIMWebGetServiceProviderConfigEventParams], None]) -> None: ...

Remarks

This event fires when the class receives a GET /ServiceProviderConfig request from the Identity Provider. The class generates the configuration document automatically based on the supported_operations and max_results properties and populates the response_body parameter with the serialized JSON before firing this event.

This event is informational and may be used to log or audit discovery requests and inspect the generated response.

The request_id parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.

on_get_user event

Fired when a request to retrieve a user is received, before a PATCH user update, or when ETags are enabled and a PUT or DELETE request includes an If-Match header.

Syntax

class SCIMWebGetUserEventParams(object):
  @property
  def request_id() -> int: ...
  @property
  def user_id() -> str: ...
  @property
  def external_id() -> str: ...
  @external_id.setter
  def external_id(value) -> None: ...
  @property
  def user_name() -> str: ...
  @user_name.setter
  def user_name(value) -> None: ...
  @property
  def given_name() -> str: ...
  @given_name.setter
  def given_name(value) -> None: ...
  @property
  def family_name() -> str: ...
  @family_name.setter
  def family_name(value) -> None: ...
  @property
  def display_name() -> str: ...
  @display_name.setter
  def display_name(value) -> None: ...
  @property
  def active() -> bool: ...
  @active.setter
  def active(value) -> None: ...
  @property
  def status_code() -> int: ...
  @status_code.setter
  def status_code(value) -> None: ...
# In class SCIMWeb:
@property
def on_get_user() -> Callable[[SCIMWebGetUserEventParams], None]: ...
@on_get_user.setter
def on_get_user(event_hook: Callable[[SCIMWebGetUserEventParams], None]) -> None: ...

Remarks

This event fires when the class receives a GET /Users/{id} request from the Identity Provider. It also fires before processing a PATCH /Users/{id} request, or when the ETagEnabled configuration setting is True and a PUT /Users/{id} or DELETE /Users/{id} request includes an If-Match header. The user_id parameter identifies the user to retrieve.

The output parameters (i.e., user_name, given_name, family_name, display_name, active) must be set to the current user data. If an external_id was stored for this user, it must be set as well. To include email addresses, phone numbers, and enterprise extension data in the response, the add_user_email, add_user_phone, and add_user_extension methods should be called once for each address, number, and user with extension data on record. This event must supply the full user for a PATCH request to work correctly.

When the user is found, the status_code parameter must be set to 200. If the user is not found, status_code must be set to 404.

The request_type property may be used to determine whether this event was fired by a direct GET request or internally before a PATCH or a conditional PUT/DELETE.

The status_code parameter defaults to 500, and a value of 0 is treated as 200.

The request_id parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.

on_list_groups event

Fired when a request to list groups is received.

Syntax

class SCIMWebListGroupsEventParams(object):
  @property
  def request_id() -> int: ...
  @property
  def filter() -> str: ...
  @property
  def filter_attribute() -> str: ...
  @property
  def filter_operator() -> str: ...
  @property
  def filter_value() -> str: ...
  @property
  def start_index() -> int: ...
  @property
  def count() -> int: ...
  @property
  def total_results() -> int: ...
  @total_results.setter
  def total_results(value) -> None: ...
  @property
  def status_code() -> int: ...
  @status_code.setter
  def status_code(value) -> None: ...
# In class SCIMWeb:
@property
def on_list_groups() -> Callable[[SCIMWebListGroupsEventParams], None]: ...
@on_list_groups.setter
def on_list_groups(event_hook: Callable[[SCIMWebListGroupsEventParams], None]) -> None: ...

Remarks

This event fires when the class receives a GET /Groups request from the Identity Provider. The filter parameter contains the raw SCIM filter expression from the request, or "" (empty string) if no filter was specified. For simple single-term filters (e.g., displayName eq "Admins"), the filter_attribute, filter_operator, and filter_value parameters are also populated with the parsed components for convenience. For compound or nested filter expressions, only filter is populated. The application must parse it directly.

The start_index and count parameters reflect the pagination values from the request. start_index is 1-based, and count is capped by the value of the max_results property. When the Identity Provider does not include a count parameter, count defaults to max_results. The application should use these values to query its data source and return only the matching page of results. The sortBy and sortOrder query parameters are not currently supported and are ignored when received.

The add_group method must be called once for each group in the current page of results, after which the total_results parameter must be set to the total number of matching groups across all pages. To include members for each group, the add_group_member method may be called as needed. The status_code must be set to 200 when the operation succeeds.

To signal an error, status_code must be set to the appropriate HTTP status code. The status_code parameter defaults to 500, and a value of 0 is treated as 200.

The request_id parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.

on_list_users event

Fired when a request to list users is received.

Syntax

class SCIMWebListUsersEventParams(object):
  @property
  def request_id() -> int: ...
  @property
  def filter() -> str: ...
  @property
  def filter_attribute() -> str: ...
  @property
  def filter_operator() -> str: ...
  @property
  def filter_value() -> str: ...
  @property
  def start_index() -> int: ...
  @property
  def count() -> int: ...
  @property
  def total_results() -> int: ...
  @total_results.setter
  def total_results(value) -> None: ...
  @property
  def status_code() -> int: ...
  @status_code.setter
  def status_code(value) -> None: ...
# In class SCIMWeb:
@property
def on_list_users() -> Callable[[SCIMWebListUsersEventParams], None]: ...
@on_list_users.setter
def on_list_users(event_hook: Callable[[SCIMWebListUsersEventParams], None]) -> None: ...

Remarks

This event fires when the class receives a GET /Users request from the Identity Provider. The filter parameter contains the raw SCIM filter expression from the request, or "" (empty string) if no filter was specified. For simple single-term filters (e.g., userName eq "jsmith"), the filter_attribute, filter_operator, and filter_value parameters are also populated with the parsed components for convenience. For compound or nested filter expressions, only filter is populated. The application must parse it directly.

The start_index and count parameters reflect the pagination values from the request. start_index is 1-based, and count is capped by the value of the max_results property. When the Identity Provider does not include a count parameter, count defaults to max_results. The application should use these values to query its data source and return only the matching page of results. The sortBy and sortOrder query parameters are not currently supported and are ignored when received.

The add_user method must be called once for each user in the current page of results. To include email addresses, phone numbers, or enterprise extension data for each user, the add_user_email, add_user_phone, and add_user_extension methods may be called as needed. After all users have been added, the total_results parameter must be set to the total number of matching users across all pages. This value may be greater than count if the result set is paginated. The status_code must be set to 200 when the operation succeeds.

To signal an error, status_code must be set to the appropriate HTTP status code. The status_code parameter defaults to 500, and a value of 0 is treated as 200.

The request_id parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.

on_log event

Fired once for each log message.

Syntax

class SCIMWebLogEventParams(object):
  @property
  def request_id() -> int: ...
  @property
  def log_level() -> int: ...
  @property
  def message() -> str: ...
  @property
  def log_type() -> str: ...
# In class SCIMWeb:
@property
def on_log() -> Callable[[SCIMWebLogEventParams], None]: ...
@on_log.setter
def on_log(event_hook: Callable[[SCIMWebLogEventParams], None]) -> None: ...

Remarks

This event fires once for each log message generated by the class while it processes a SCIM request. The verbosity is controlled by the LogLevel configuration setting.

log_level indicates the level of the message. Possible values are as follows:

message is the log entry.

log_type is always SCIM for this class.

The request_id parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.

on_update_group event

Fired after the current group has been loaded and a replace or update request has been applied.

Syntax

class SCIMWebUpdateGroupEventParams(object):
  @property
  def request_id() -> int: ...
  @property
  def group_id() -> str: ...
  @property
  def external_id() -> str: ...
  @property
  def display_name() -> str: ...
  @property
  def status_code() -> int: ...
  @status_code.setter
  def status_code(value) -> None: ...
# In class SCIMWeb:
@property
def on_update_group() -> Callable[[SCIMWebUpdateGroupEventParams], None]: ...
@on_update_group.setter
def on_update_group(event_hook: Callable[[SCIMWebUpdateGroupEventParams], None]) -> None: ...

Remarks

This event fires when the class receives a PUT /Groups/{id} or PATCH /Groups/{id} request from the Identity Provider. For PUT, the event parameters reflect the full group representation from the request body directly. For PATCH, the class first retrieves the current group via the on_get_group event, applies the patch operations, then fires this event.

For a PUT request, the external_id parameter contains the external_id value from the request body, or "" (empty string) if not provided.

For a PUT request, the provided display_name and member list should be applied to the group identified by group_id, and any attributes not present in the request should be cleared. For a PATCH request, the event parameters likewise reflect the complete final group, with the values loaded through the on_get_group event and the patch operations applied on top. All parameters should be applied in the same way, since any attribute the patch did not touch carries its original value.

Updated members are made available via the group_members collection. The collection always reflects the full current member list after the request is applied. All stored members should be replaced with the collection contents.

When the update succeeds, status_code must be set to 200. It may also be set to 204, which is valid when the updated resource does not need to be returned, causing the class to return a 204 No Content response with no body. Some Identity Providers require a 200 response with the updated resource body. Check your Identity Provider's SCIM implementation guide before returning 204. If the group is not found, status_code must be set to 404. The status_code parameter defaults to 500, and a value of 0 is treated as 200.

The request_id parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.

on_update_user event

Fired after the current user has been loaded and a replace or update request has been applied.

Syntax

class SCIMWebUpdateUserEventParams(object):
  @property
  def request_id() -> int: ...
  @property
  def user_id() -> str: ...
  @property
  def external_id() -> str: ...
  @property
  def user_name() -> str: ...
  @property
  def given_name() -> str: ...
  @property
  def family_name() -> str: ...
  @property
  def display_name() -> str: ...
  @property
  def active() -> bool: ...
  @property
  def status_code() -> int: ...
  @status_code.setter
  def status_code(value) -> None: ...
# In class SCIMWeb:
@property
def on_update_user() -> Callable[[SCIMWebUpdateUserEventParams], None]: ...
@on_update_user.setter
def on_update_user(event_hook: Callable[[SCIMWebUpdateUserEventParams], None]) -> None: ...

Remarks

This event fires when the class receives a PUT /Users/{id} or PATCH /Users/{id} request from the Identity Provider. For PUT, the event parameters reflect the full user representation from the request body directly. For PATCH, the class first retrieves the current user via the on_get_user event, applies the patch operations, then fires this event.

For a PUT request, the external_id parameter contains the external_id value from the request body, or "" (empty string) if not provided.

For a PUT request, all event parameters should be applied to the user identified by user_id, and any attributes not present in the request should be cleared. For a PATCH request, the event parameters likewise reflect the complete final user, with the values loaded through the on_get_user event and the patch operations applied on top. All parameters should be applied in the same way, since any attribute the patch did not touch carries its original value.

The active parameter reflects the user's active state. For a PUT request, active defaults to True if active is absent from the request body.

Email addresses and phone numbers are made available via the user_emails and user_phones collections. The collections always reflect the full current state of the user after the request is applied. All stored entries should be replaced with the collection contents. Enterprise extension attributes are made available via the user_extension property and likewise reflect the full current state after the request is applied.

When the update succeeds, status_code must be set to 200. It may also be set to 204, which is valid when the updated resource does not need to be returned, causing the class to return a 204 No Content response with no body. Some Identity Providers require a 200 response with the updated resource body. Check your Identity Provider's SCIM implementation guide before returning 204. If the user is not found, status_code must be set to 404. The status_code parameter defaults to 500, and a value of 0 is treated as 200.

The request_id parameter identifies the current request. It may be used to correlate events that are fired when processing the same request.

SCIMWeb Config Settings

The class accepts one or more of the following configuration settings. Configuration settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the config method.

SCIMWeb Config Settings

Base Config Settings

SCIMWeb Errors

SCIMWeb Errors

The class may also return one of the following error codes, which are inherited from other classes.