Skip to content

Handle SCIM filter predicate case-insensitive matching correctly #51530

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pedroigor merged 1 commit into from
Aug 10, 2026
Merged

Handle SCIM filter predicate case-insensitive matching correctly #51530

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 19 additions & 2 deletions scim/core/src/main/java/org/keycloak/scim/resource/schema/attribute/Attribute.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,6 +106,7 @@ public static <M extends Model, R extends ResourceTypeRepresentation> Builder<M,
private boolean required;
private boolean caseExact;
private String uniqueness;
private boolean storedLowerCase;

private Attribute(String name, AttributeMapper<M, R> mapper, String parentName, String alias) {
this.name = name;
Expand Down Expand Up @@ -217,6 +218,14 @@ public boolean isCaseExact() {
return caseExact;
}

public boolean isStoredLowerCase() {
return storedLowerCase;
}

public void setStoredLowerCase(boolean storedLowerCase) {
this.storedLowerCase = storedLowerCase;
}

public void setUniqueness(String uniqueness) {
this.uniqueness = uniqueness;
}
Expand Down Expand Up @@ -345,6 +354,7 @@ public static class Builder<M extends Model, R extends ResourceTypeRepresentatio
private TriConsumer<M, String, Set<?>> modelAdder;
private boolean required;
private boolean caseExact = true;
private boolean storedLowerCase;
private String uniqueness = "none";

private Builder(String name, Class<?> complexType) {
Expand Down Expand Up @@ -385,7 +395,7 @@ public Builder<M, R> withAttribute(String name, String alias, TriConsumer<M, Str
String subName = this.name + "." + name;
Attribute<M, R> attribute = assembleAttribute(subName, this.name, alias,
new AttributeMapper<>(modelSetter, new ComplexAttributeSetter<>(this.name, name, complexType)),
modelAttributeResolver, "string", null, returned, false, false, true, null, null);
modelAttributeResolver, "string", null, returned, false, false, true, false, null, null);
attributes.add(attribute);
return this;
}
Expand Down Expand Up @@ -423,7 +433,7 @@ public Builder<M, R> returned(String returned) {
public List<Attribute<M, R>> build() {
Attribute<M, R> attribute = assembleAttribute(name, null, null,
new AttributeMapper<>(modelSetter, representationSetter, modelRemover, modelAdder),
modelAttributeResolver, type, mutability, returned, multivalued, required, caseExact, uniqueness, complexType);
modelAttributeResolver, type, mutability, returned, multivalued, required, caseExact, storedLowerCase, uniqueness, complexType);
if (attributes.isEmpty()) {
// do not add the root attribute if there are subattributes
attributes.add(attribute);
Expand All @@ -438,6 +448,7 @@ private Attribute<M, R> assembleAttribute(String name, String parentName, String
boolean multivalued,
boolean required,
boolean caseExact,
boolean storedLowerCase,
String uniqueness,
Class<?> complexType) {
Attribute<M, R> attribute = new Attribute<>(name, mapper, parentName, alias);
Expand All @@ -451,6 +462,7 @@ private Attribute<M, R> assembleAttribute(String name, String parentName, String
attribute.setComplexType(complexType);
attribute.setRequired(required);
attribute.setCaseExact(caseExact);
attribute.setStoredLowerCase(storedLowerCase);
attribute.setUniqueness(uniqueness == null ? "none" : uniqueness);
return attribute;
}
Expand Down Expand Up @@ -480,6 +492,11 @@ public Builder<M, R> notCaseExact() {
return this;
}

public Builder<M, R> storedLowerCase() {
this.storedLowerCase = true;
return this;
}

public Builder<M, R> serverUnique() {
this.uniqueness = "server";
return this;
Expand Down
6 changes: 4 additions & 2 deletions scim/model/src/main/java/org/keycloak/scim/model/filter/ScimJPAPredicateProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,9 +140,11 @@ private Predicate getAttributePredicate(Attribute<?,?> attrInfo, String operatio
basePredicate = cb.equal(join.get("name"), modelAttributeName);
}

if (value != null && !attrInfo.isCaseExact() && "string".equals(attrInfo.getType())) {
if (value != null && (attrInfo.isStoredLowerCase() || !attrInfo.isCaseExact())) {
value = value.toString().toLowerCase();
expression = cb.lower((Expression<String>) expression);
if (!attrInfo.isStoredLowerCase()) {
expression = cb.lower((Expression<String>) expression);
}
}

Predicate predicate = operatorMap.get(operation).apply(cb, expression, value);
Expand Down
2 changes: 2 additions & 0 deletions scim/model/src/main/java/org/keycloak/scim/model/user/UserCoreModelSchema.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,13 +58,15 @@ protected Map<String, Attribute<UserModel, User>> getAttributeMappers() {
attributes.addAll(Attribute.<UserModel, User>simple("userName")
.required()
.notCaseExact()
.storedLowerCase()
.serverUnique()
.modelAttributeResolver(this::createModelAttributeResolver)
.withModelSetter(UserModel::setSingleAttribute)
.build());
attributes.addAll(Attribute.<UserModel, User>complex("emails", Email.class)
.modelAttributeResolver(this::createModelAttributeResolver)
.notCaseExact()
.storedLowerCase()
.globalUnique()
.multivalued()
.withModelSetter((TriConsumer<UserModel, String, Set<Email>>) (model, name, values) -> {
Expand Down
5 changes: 5 additions & 0 deletions scim/tests/base/src/test/java/org/keycloak/tests/scim/tck/FilterTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -502,6 +502,11 @@ public void testFilterByEmail() {
filter = ResourceFilter.filter().co("emails", "keycloak").build();
response = client.users().getAll(filter);
assertThat(response.getTotalResults(), is(2));

// using a mixed case email
filter = ResourceFilter.filter().eq("emails.value", "ALICE@KEYCLOAK.org").build();
response = client.users().getAll(filter);
assertSingleResult(response, alice.getUserName());
}

@Test
Expand Down
Loading