server icon indicating copy to clipboard operation
server copied to clipboard

SCIM /Users listing does not return any users unless the `startIndex` and `count` is specified

Open dougedey-sf opened this issue 1 year ago • 1 comments

Steps To Reproduce

  1. Enable SCIM Provisioning on an account
  2. Request the users listing using the provided SCIM Url and add /Users to the end (i.e.: https://scim.bitwarden.com/v2/<Tenant ID>/Users

Expected Result

You should get a list of users, unfiltered.

Actual Result

No data is returned

Screenshots or Videos

No response

Additional Context

I believe this is a bug, but it may be intentional, based on the third check on line 58 in GetUsersListQuery, it requires the startIndex and count to be set, these are defined as optional parameters in the SCIM Paginaiton RFC, and should default to startIndex of 1 and the server defined count

Query Resources does not state that startIndex and count are required query variables, and the example given:

GET /Users?attributes=userName
Host: example.com
Accept: application/scim+json
Authorization: Bearer h480djs93hd8

Also does not work with the BitWarden API.

I believe the fix here is to add an:

else
{
  userList = orgUsers.OrderBy(ou => ou.Email)
    .Take(10) # I am unsure what the real default should be here
    .ToList();
  totalResults = orgUsers.Count;
}

Build Version

2024.4.1

Environment

Cloud (bitwarden.com)

Environment Details

No response

Issue Tracking Info

  • [X] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

dougedey-sf avatar Apr 30 '24 15:04 dougedey-sf

Hi there,

Thank you for your report!

I have flagged this to our engineering team.

If you wish to add any further information/screenshots/recordings etc., please feel free to do so at any time - our engineering team will be happy to review these.

Thanks once again!

cbbit avatar Apr 30 '24 20:04 cbbit