Adding/Removing single member from a Group

[dhanan-np]

Do we have any SCIM REST API through which we can add or remove a user from Group.

[ossdhaval]

API reference.

I think @jgomer2001 can chime in here for more comments if needed.

[jgomer2001]

See https://github.com/JanssenProject/jans/blob/main/jans-scim/server/src/main/resources/jans-scim-openapi.yaml#L27

also check section 3.5 of RFC 7644

[dhanan-np]

Thanks a lot for the hint @jgomer2001 . However I was expecting some sample example. But I went through the code and found a test class for the same. And I have generated a curl for the operation. I wish if there was more validated way of removing any member from the Group. like for example....
DELETE ''https://gluu-auth.mydumyhost.com/jans-scim/restv1/v2/Groups/0c373a88-c476-4a30-9b04-f3a457218b0d/Members/member-uid'

Add a Member-

curl --location --request PATCH 'https://gluu-auth.mydumyhost.com/jans-scim/restv1/v2/Groups/0c373a88-c476-4a30-9b04-f3a457218b0d' \
--header 'Authorization: Bearer Token-Obtained-For-SCIM-OPERATION' \
--header 'Content-Type: application/json' \
--data '{
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:PatchOp"
    ],
    "Operations": [
        {
            "op": "add",
            "path": "members",
            "value": {
                "value": "27078a04-9e46-4072-bbc3-c89005f14e06",
                "type": "User"
            }
        }
    ]
}'

Remove User:

curl --location --request PATCH 'https://gluu-auth.mydumyhost.com/jans-scim/restv1/v2/Groups/0c373a88-c476-4a30-9b04-f3a457218b0d' \
--header 'Authorization: Bearer Token-Obtained-For-SCIM-OPERATION' \
--header 'Content-Type: application/json' \
--data '{
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:PatchOp"
    ],
    "Operations": [
        {
            "op": "remove",
            "path": "members[value eq \"342a7f8c-81cf-4571-8c36-bead137f70a7\"]"
        }
    ]
}'

[nynymike]

Use of Groups is discouraged in Jans Auth Server. There is no good reason to use groups anymore. Better to use the role attribute which can be passed more easily to the RP.

[dhanan-np]

Hello @nynymike. I have a case where we will have 4-5 kind of services and at any moment of time user can subscribe to any number of services.
And basis on that we allow the user to access the content from that services. We will adding/removing those services from user's profile through SCIM. And user's token would be containing those services as claims.
I request you to suggest and help me on this, how should we handle this case.
We deliberately want to store the information related to user=> services relation.