Account Locked attribute not getting added in response for scim2 GET Users API in wso2

Question

I am trying retrieve the user list which have locked accounts in WSO2 IS 5.9 version. I tried after adding account lock attribute to below claims:

• http://schemas.xmlsoap.org/ws/2005/05/identity

• urn:ietf:params:scim:schemas:core:2.0

• urn:ietf:params:scim:schemas:core:2.0:User

• urn:ietf:params:scim:schemas:extension:enterprise:2.0:User

I have followed below URL as well to add the custom claim: https://is.docs.wso2.com/en/5.9.0/develop/extending-scim2-user-schemas/

{ "attributeURI":"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:accountLock",
 "attributeName":"accountLock",
 "dataType":"boolean",
 "multiValued":"false",
 "description":"Account lock",
 "required":"false",
 "caseExact":"false",
 "mutability":"readwrite",
 "returned":"default",
 "uniqueness":"none",
 "subAttributes":"null",
 "multiValuedAttributeChildName":"null",
 "canonicalValues":[],
"referenceTypes":[]
}

But still i am not able to get the accountLock attribute in response to GET Users API of scim2.

Response

   "totalResults": 10,
   "startIndex": 1,
   "itemsPerPage": 10,
   "schemas": [
       "urn:ietf:params:scim:api:messages:2.0:ListResponse"
   ],
   "Resources": [
       
       {
           "emails": [
               "divya@abc.com"
           ],
           "meta": {
               "created": "2020-06-25T07:49:35.465Z",
               "lastModified": "2020-06-25T11:20:13.482Z",
               "resourceType": "User"
           },
           "name": {
               "givenName": "guest",
               "familyName": "guest"
           },
           "groups": [
               {
                   "display": "Application/sp1"
               },
               {
                   "display": "Application/sp2"
               },
               {
                   "display": "Application/Read"
               }
           ],
           "id": "9ffbed2e-3703-470c-a2c8-e738f4c09709",
           "userName": "guest12"
       }
   ]}```

Answer 1

The following reasons may cause to accoutLock attribute does not appear in SCIM2 GET user response.

1. You might missed to add the new attribute ( "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:accountLock") as a sub attribute of urn:ietf:params:scim:schemas:extension:enterprise:2.0:User object. (Point 3 in https://is.docs.wso2.com/en/5.9.0/develop/extending-scim2-user-schemas/#extending-the-scim-20-api . "subAttributes":" accoutLock verifyEmail askPassword employeeNumber costCenter organization division department manager")

    "attributeURI":"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User", "attributeName":"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User", "dataType":"complex", "multiValued":"false", "description":"Enterprise User", "required":"false", "caseExact":"false", "mutability":"readWrite", "returned":"default", "uniqueness":"none", "subAttributes":"accoutLock verifyEmail askPassword employeeNumber costCenter organization division department manager", "canonicalValues":[], "referenceTypes":["external"] }``` 

2. The mapped attribute of the added custom claim ( https://is.docs.wso2.com/en/5.9.0/develop/extending-scim2-user-schemas/#add-the-custom-claim ) should be an existing attribute in LDAP schema if you are using the default LDAP userstore. (However, if you have done this mistake you won't be able to update/add claim value. It gives One or more attributes you are trying to add/update are not supported by underlying LDAP for user: error)

3. The response of SCIM2 GET users doesn't contain the attributes which don't have a value. Thus, set true/false to the claim value.

Moreover, it is enough to add the new attribute to urn:ietf:params:scim:schemas:extension:enterprise:2.0:User claim dialect. Follow steps in https://is.docs.wso2.com/en/5.9.0/develop/extending-scim2-user-schemas/