SCIM Connector Group Membership Modification Support

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

When using the SCIM connector with the API Gateway plugin to provision endpoint types (such as Google Cloud Platform), attempts to modify group membership via the Provisioning Manager (IMPM) or other backend tools may result in a NullPointerException.

This article clarifies the intended scope of group management for this connector.

Environment

Identity Manager 14.x

Cause

Group management via backend tools (such as the Provisioning Manager or UI-based bulk operations) is not supported for SCIM connectors. The SCIM connector architecture is designed primarily for identity (account) management.

Resolution

Group membership modification is currently not supported through the backend Provisioning Manager (IMPM) or direct UI attribute manipulation.

To manage group memberships when using a SCIM connector:

• Perform group membership management operations directly via the Identity Manager (IM) User Interface.
• The connector's design focuses on identity management (accounts). Operations involving group attributes (e.g., the members attribute in the Group class) should be handled through the IM UI, which ensures the appropriate connector operations are executed.

Additional Information

If you encounter a NullPointerException during group modification attempts, it confirms the operation is outside the supported design scope.

• Error Sample: 2021-04-16 17:14:16,953 ... ERROR - internal error in MODIFY(): java.lang.NullPointerException at com.ca.jcs.converter.connector.DNConverter.convertConnectorDNToKey(DNConverter.java:234)

For further technical context, refer to the official documentation on creating custom SCIM endpoint types using the Layer7 plugin: Create a Custom SCIM Endpoint Type.