SCIM Users groups filter does not exclude organization groups #51614

Description

UserResourceTypeProvider.getAttributeExpression maps the SCIM groups filter attribute directly onto UserGroupMembershipEntity.groupId without any group-type restriction:

if ("groups".equals(attribute.getName())) {
    Join<?, ?> join = joinResolver.apply(UserGroupMembershipEntity.class,
            () -> root.join(UserGroupMembershipEntity.class));
    join.on(cb.equal(root.get("id"), join.get("user").get("id")));
    return join.get("groupId");
}

This means a caller who knows an organization group ID can use a SCIM filter like groups eq "<org-group-id>" to discover which users belong to that organization group, even though organization groups are excluded from the serialized groups attribute on the user resource (fixed in #51591).

The serialization boundary enforced by AbstractUserModelSchema.isOrganizationGroup does not apply to the filter/query path, creating an inconsistency between what can be queried and what is returned.

Expected behavior

SCIM filter expressions referencing the groups attribute should not match organization groups (GroupModel.Type.ORGANIZATION with a non-null organization), consistent with the serialization boundary.

Context

This was identified during the review of #51591, which fixed the serialization side. The PR author flagged this as a separate surface from serialization. See PR description note:

UserResourceTypeProvider.getAttributeExpression maps the SCIM groups filter onto UserGroupMembershipEntity.groupId without a type restriction, so a user can still be filtered by a known organization group id. That is a separate surface from serialization and is left out of this change.

Affected file

• scim/model/src/main/java/org/keycloak/scim/model/user/UserResourceTypeProvider.java — getAttributeExpression method