Unable to create user in WSO2 IS via SCIM2 API with external claims

Question

Im trying to create user with external claims, but something wents wrong. I added my claims to scim2-schema-extension.config, to external claims and local claims, but API's response for my request is:

{
"schemas": [
    "urn:ietf:params:scim:api:messages:2.0:Error"
],
"detail": "Error in adding the user: testoviy22@mail.ru to the user store.",
"status": "500"

}

In logs i have

: ERR_13735_ELEMENT_FOR_OID_DOES_NOT_EXIST ATTRIBUTE_TYPE for OID comment does not exist!]; remaining name 'mail=testoviy22@mail.ru'
at java.naming/com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3280)
at java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:3205)
at java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2996)
at java.naming/com.sun.jndi.ldap.LdapCtx.c_bind(LdapCtx.java:452)
at java.naming/com.sun.jndi.toolkit.ctx.ComponentDirContext.p_bind(ComponentDirContext.java:299)
at java.naming/com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.bind(PartialCompositeDirContext.java:217)
at org.wso2.carbon.user.core.ldap.UniqueIDReadWriteLDAPUserStoreManager.persistUser(UniqueIDReadWriteLDAPUserStoreManager.java:312)
... 73 more

Local claim External claim

Request sample:

{
"name": {
  "familyName": "Zubenko",
  "givenName": "Michael"
},
"password": "qwerty",
"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User": {
  "comment": "test"
},
"userName": "testoviy22@mail.ru"

}

Answer 1

Seems you are using an LDAP server as your primary userstore, and that server doesn't support the attribute named "comment" Refer to the note in https://is.docs.wso2.com/en/latest/references/extend/provisioning/extend-scim2-user-schemas/#map-the-custom-claim

You can use the word "customClaim" (or any other preferred word) as the Mapped Attribute only when using a JDBC userstore because JDBC userstores will automatically create a new attribute if it does not already exist in the user store. However, If you are using LDAP or Active Directory, you will have to use an attribute that exists in the user store already .

Change the mapped attribute of the local claim to some valid attribute in the LDAP schema