为什么 WSO2 IS 5.6.0 SCIM2 Group API 在尝试插入或更新用户时会抛出错误？

Question

I'm trying to use the WSO2 Identity Server SCIM2 APIs to create and update users and groups. However I am facing problems with the Group Update API (PUT /scim2/Groups/{id}): If I try to insert some user into the body of the message, the API always returns HTTP Error 500 ("Error occurred while accessing Java Security Manager Privilege Block ").

Here's how to reproduce the failure:

1) First we create a user:

curl -X POST \
  https://auth-server:9444/scim2/Users/ \
  -H 'Accept: */*' \
  -H 'Authorization: Basic YWRtaW46YWRtaW4=' \
  -H 'Content-Type: application/json' \
  -H 'Postman-Token: a43e26c0-fb00-4fa0-9482-74f62078d6b1' \
  -H 'cache-control: no-cache' \
  -d '{
    "emails": [{
        "type": "home",
        "value": "test.user@test.com.br",
        "primary": true
    }],
    "password": "test.user",
    "name": {
        "familyName": "Test",
        "givenName": "User"
    },
    "userName": "test.user"
}'

We receive as response HTTP 200 with body:

{
    "emails": [
        {
            "type": "home",
            "value": "test.user@test.com.br",
            "primary": true
        }
    ],
    "meta": {
        "created": "2019-01-09T20:41:27Z",
        "location": "https://localhost:9444/scim2/Users/14fc39fc-1b0c-4db2-9e3a-bd5c522770bb",
        "lastModified": "2019-01-09T20:41:27Z",
        "resourceType": "User"
    },
    "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:User",
        "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"
    ],
    "name": {
        "familyName": "Test",
        "givenName": "User"
    },
    "id": "14fc39fc-1b0c-4db2-9e3a-bd5c522770bb",
    "userName": "test.user"
}

2) Next we create a group:

curl -X POST \
  https://auth-server:9444/scim2/Groups/ \
  -H 'Accept: */*' \
  -H 'Authorization: Basic YWRtaW46YWRtaW4=' \
  -H 'Content-Type: application/json' \
  -H 'Postman-Token: 45d2220d-d33d-42ba-8ce5-205646aa2963' \
  -H 'cache-control: no-cache' \
  -d '{
    "displayName": "Application/Test",
    "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:Group"
    ]
}'

We receive as response HTTP 200 with body:

{
    "displayName": "APPLICATION/Test",
    "meta": {
        "created": "2019-01-09T20:43:22Z",
        "location": "https://localhost:9444/scim2/Groups/7feb0a54-18c5-4265-bdd6-7ceecd96bf0d",
        "lastModified": "2019-01-09T20:43:22Z",
        "resourceType": "Group"
    },
    "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:Group"
    ],
    "id": "7feb0a54-18c5-4265-bdd6-7ceecd96bf0d"
}

3) When we try to associate the newly created user with the group, we receive an HTTP 500 error. See below:

curl -X PUT \
  https://auth-server:9444/scim2/Groups/7feb0a54-18c5-4265-bdd6-7ceecd96bf0d \
  -H 'Accept: */*' \
  -H 'Authorization: Basic c2NpbS5kY2xvZ2c6c2NpbS5kY2xvZ2c=' \
  -H 'Content-Type: application/json' \
  -H 'Postman-Token: 6db43a33-af40-452e-83eb-40f8d6e3c5e3' \
  -H 'cache-control: no-cache' \
  -d '{
    "displayName": "APPLICATION/Test",
    "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:Group"
    ],
    "members": [
        {
            "value": "14fc39fc-1b0c-4db2-9e3a-bd5c522770bb",
            "display": "test"
        }
    ]
}'

HTTP 500 error:

{
    "schemas": "urn:ietf:params:scim:api:messages:2.0:Error",
    "detail": "Error occurred while accessing Java Security Manager Privilege Block",
    "status": "500"
}

For authentication, I am using basic authentication, with the user "admin" of Identity Server; but I also tried to create a user with all possible permissions, but the error is always the same. In the execution console I have tried to refine the log, however only the message below is displayed:

[2019-01-09 20:47:00,656] DEBUG {org.wso2.carbon.user.core.common.AbstractUserStoreManager} -  Domain: APPLICATION is passed with the claim and user store manager is loaded for the given domain name.
[2019-01-09 20:47:00,658] ERROR {org.wso2.carbon.user.core.common.AbstractUserStoreManager} -  Error occurred while accessing Java Security Manager Privilege Block

Does this Group API really work for update requests?

If anyone can help, I appreciate it. Thank you.

Answer 1

Please change your request of adding a user to a group as follows, this works fine for me.

curl -v -k --user admin:admin -X PUT -d '{"displayName":"PRIMARY/manager","members":[{"value":"416aaa06-d9ed-465b-8ac4-1a321624d158","display":"test.user"}]}' --header "Content-Type:application/json" https://localhost:9444/scim2/Groups/5d6ffce8-fab8-45ee-a407-b1cae0e4ecee