Support multivalued user attributes in SCIM - #50865
Open
cgeorgilakis wants to merge 2 commits into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds SCIM exposure of all values from multivalued user-profile attributes.
Changes:
- Returns collections for multivalued attributes.
- Serializes
.valueattributes as SCIM complex arrays. - Adds integration coverage for simple and complex custom attributes.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
AbstractUserModelSchema.java |
Reads all values for multivalued attributes. |
UserExtensionModelSchema.java |
Maps multivalued extension values to SCIM arrays. |
UserTest.java |
Tests both supported multivalued representations. |
Comment on lines
+84
to
+87
| AttributeMetadata metadata = attributes.getMetadata(name); | ||
| //support multivalued user attribute to scim as array | ||
| if (metadata != null && metadata.isMultivalued()) { | ||
| return attributes.get(name); |
Comment on lines
+210
to
+214
| if ("value".equals(attributeName) && value instanceof Collection<?> values) { | ||
| subAttributes.put(parentAttributeName, values.stream() | ||
| .filter(Objects::nonNull) | ||
| .map(v -> Map.<String, Object>of("value", v)) | ||
| .toList()); |
Comment on lines
+208
to
+214
| // Handle multivalued attributes annotated as "<parent>.value" | ||
| // so that SCIM gets: "<parent>": [ { "value": "..." }, ... ] | ||
| if ("value".equals(attributeName) && value instanceof Collection<?> values) { | ||
| subAttributes.put(parentAttributeName, values.stream() | ||
| .filter(Objects::nonNull) | ||
| .map(v -> Map.<String, Object>of("value", v)) | ||
| .toList()); |
Comment on lines
+139
to
+140
| if (isMultivalued) { | ||
| builder = builder.multivalued(); |
Comment on lines
90
to
+94
| Attribute parent = topLevelAttributes.computeIfAbsent(topName, k -> { | ||
| Attribute p = new Attribute(); | ||
| p.setName(k); | ||
| p.setType("complex"); | ||
| p.setMultiValued(false); | ||
| p.setMultiValued(attribute.isMultivalued()); |
Comment on lines
+219
to
+220
| if (existingParent instanceof Map<?, ?> existingMap && !existingMap.isEmpty()) { | ||
| return; |
cgeorgilakis
force-pushed
the
50856_scim_multivalues
branch
from
July 15, 2026 13:24
48f10e5 to
160abdf
Compare
Comment on lines
32
to
34
| import org.keycloak.scim.resource.Scim; | ||
| import org.keycloak.scim.resource.schema.Schema; | ||
| import org.keycloak.scim.resource.user.Email; |
| private Attribute<UserModel, User> createCustomAttribute(Object scimName, boolean isMultivalued) { | ||
| Attribute.Builder<UserModel, User> builder = Attribute.<UserModel, User>simple(scimName.toString()); | ||
| if (isMultivalued) { | ||
| builder = builder.multivalued() |
Comment on lines
+223
to
+225
| if (values == null || values.isEmpty()) { | ||
| model.removeAttribute(name); | ||
| return; |
Comment on lines
+223
to
+225
| if (values == null || values.isEmpty()) { | ||
| model.removeAttribute(name); | ||
| return; |
Comment on lines
+320
to
+322
| // Handle multivalued attributes annotated as "<parent>.value" | ||
| // so that SCIM gets: "<parent>": [ { "value": "..." }, ... ] | ||
| if ("value".equals(attributeName) && value instanceof Collection<?> values) { |
Closes keycloak#50856 Signed-off-by: cgeorgilakis-grnet <cgeorgilakis@admin.grnet.gr>
cgeorgilakis
force-pushed
the
50856_scim_multivalues
branch
from
July 15, 2026 13:37
72e3b60 to
8d864bc
Compare
Comment on lines
87
to
89
| if (value.isArray()) { | ||
| values = value.valueStream().map(JsonNode::asText).collect(Collectors.toSet()); | ||
| values = value.valueStream().map(AttributeMapper::asMultivaluedString).collect(Collectors.toSet()); | ||
| } else { |
sguilhen
suggested changes
Jul 17, 2026
| * return a single value. | ||
| */ | ||
| protected boolean shouldReturnMultivaluedValues(AttributeMetadata metadata, Attribute<UserModel, User> scimAttribute) { | ||
| return metadata != null && scimAttribute != null && metadata.isMultivalued() && (scimAttribute.isMultivalued() || ( isInternal() && scimAttribute.isExtension())); |
Contributor
There was a problem hiding this comment.
The isInternal() && scimAttribute.isExtension() fallback here appears unreachable today: for the extension schema (where isInternal() is true), createCustomAttribute always mirrors metadata.isMultivalued() onto the SCIM attribute, so scimAttribute.isMultivalued() already covers it. For core/enterprise schemas, isInternal() is false so the right side never fires. So the entire right side of the or seems to be dead code, no?
More importantly, if we later publish custom schemas via /Schemas (flipping isInternal() to false), this fallback would stop working as it guards on isInternal() == true, which is the opposite of what a published schema would have.
| } | ||
|
|
||
| @Test | ||
| public void testGetMultivaluedCustomAttributesWithAndWithoutValueSubAttribute() { |
Contributor
There was a problem hiding this comment.
Wouldn't it be good to have tests covering PUT, PATCH, and maybe scenarios exercising the validateExtensionAttributeMappings path?
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (2)
scim/model/src/main/java/org/keycloak/scim/model/user/UserExtensionModelSchema.java:225
- A filtered PATCH remove on these new multivalued mappings deletes the entire attribute. For example,
remove assurance[value eq "x"]resolves the mapper through its.valuealias, butScimFilterToJsonNodeConverterreturnsnullwhencomplexType == null; this branch then interprets that as remove-all instead of removing onlyx. The filter conversion needs to support these simple-backed multivalued mappings (and this case should be covered by a PATCH test).
if (values == null || values.isEmpty()) {
model.removeAttribute(name);
return;
scim/model/src/main/java/org/keycloak/scim/model/user/UserExtensionModelSchema.java:322
- Multivalued nested mappings are only shaped correctly when the sub-attribute is named
value. A mapping such asroles.typefalls through and emits"roles":{"type":[...]}, while the schema change declaresrolesitself multivalued (which requires an array of complex objects). Either serialize every multivalued nested mapping as an array of objects or reject non-valuemappings during validation.
// Handle multivalued attributes annotated as "<parent>.value"
// so that SCIM gets: "<parent>": [ { "value": "..." }, ... ]
if ("value".equals(attributeName) && value instanceof Collection<?> values) {
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #50856