Skip to content

Fix Google SCIM required-attribute handling, propagation delays, and authentication exception - #172

Merged
ggarima01 merged 2 commits into
AzureAD:masterfrom
ggarima01:fix-google-scim-validation-20261022-1455
Oct 23, 2026
Merged

ggarima01 merged 2 commits into
AzureAD:masterfrom
ggarima01:fix-google-scim-validation-20261022-1455

Conversation

@ggarima01

@ggarima01 ggarima01 commented Oct 23, 2026 •

Copy link
Copy Markdown
Collaborator

Summary

Improve Google SCIM validation while preserving existing behavior for other providers.

  • Increase the 12 existing post-create/post-PATCH propagation waits from 7 to 30 seconds for all providers.
  • Exclude Google-required attributes and subattributes from empty-string/null clearing, using both mapping metadata and /Schemas.
  • Protect whole-parent attributes such as emails when a descendant is required, while retaining optional sibling tests.
  • Omit blank/null required mapped sources and blank array entries from the Google Entra attribute-update PATCH; preserve populated values and reject entirely empty update bodies before calling Graph for Google connections only. Other providers retain their previous update-request behavior, including sending an empty body if one is produced.
  • Temporarily skip standalone authentication diagnostics for Google connections using the selected FederatedIdentity method. Mark aggregate authentication PASSED by explicit exception and expose the bypass reason.
  • Keep mandatory end-to-end provisioning and SCIM checks unchanged.

Scope

Google-specific behavior, including the empty update-body guard, is gated by the saved baseAddress containing googleapis.com, case-insensitively. The authentication exception additionally requires FederatedIdentity to be selected. The propagation-delay increase applies to all providers.

Create-user payloads, manager-removal lifecycle operations, and production provisioning mappings are unchanged.

Validation

User-reported validation: all 13 local regression tests passed in the development checkout, including Google empty-body rejection and preservation of non-Google empty-body requests. Those developer-only test files are not included in this export folder and were not executed during this PR update. JSON parsing and static inspection of the changed guard and Graph request dependency passed during this update. Live Azure/Google validation has not yet been performed.

Changed files

Microsoft.SCIM.LogicAppValidationTemplate/StandardLogicApp/

  • Initialization_Workflow.json
  • Orchestrator_Workflow.json
  • SCIM-Validation-Test-Overview.md
  • SCIMTests_Workflow.json
  • UserTests_Workflow.json
  • VERSION

Version

14.0 → 15.0.

assistance: agentic-cli
type: bug
agent-tool: copilot-cli
agent-model: gpt-6.1-sol
work-item: AB#n/a

…authentication exception

Improve Google-specific SCIM validation, preserve optional sibling coverage, increase propagation waits, and gate the FederatedIdentity authentication exception. Bump Standard Logic App VERSION from 14.0 to 15.0.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: f97536e8-a47e-4837-8387-eb36c35988aa
@ggarima01 ggarima01 added agentic-cli bug Something isn't working labels Oct 23, 2026
Preserve non-Google update-request behavior and clarify the Google-only validation guard in the test overview.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: f97536e8-a47e-4837-8387-eb36c35988aa
@ggarima01
ggarima01 merged commit fde52cc into AzureAD:master Oct 23, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

agentic-cli bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant