Repository navigation
[BUG] Rejected SCIM PATCH requests still modify stored identities #45
Description
Description
A SCIM PATCH rejected for duplicate userName nevertheless commits the duplicate value. The same mutation-before-validation path serves users, groups and service principals.
Reproduced on MiniLake 1.9.0, commit fe8837dcfac9df621dfabc440abc07ebb4cdbcbb, using the repository's Docker test image, a real HTTP server, and fresh disposable state. Image Python sources were verified byte-for-byte against this commit. No mocks or production data were used.
Affected Components
- src/minilake/services/scim.py —
_apply_patch - src/minilake/services/scim.py —
patch_user - src/minilake/services/scim.py —
_unique_check
Steps to Reproduce
Use a disposable instance and data directory. Paths below are relative to its HTTP base URL; bodies are JSON unless explicitly described as raw bytes. IDs shown as W/J/R/Q/C/HANDLE are replaced with the IDs returned by prior calls.
- POST
/api/2.0/preview/scim/v2/Userswith{"userName":"alice"}, then with{"userName":"bob"}; retain Bob's id B. - PATCH
/api/2.0/preview/scim/v2/Users/Bwith{"Operations":[{"op":"replace","path":"userName","value":"alice"}]}. - Observe HTTP 409, then GET Bob's original resource URL.
- List users filtered by
userName eq "alice".
Expected Behavior
The conflicting PATCH is rejected atomically and Bob remains Bob; there is still only one Alice.
Actual Behavior
PATCH returns RESOURCE_ALREADY_EXISTS, but GET of B now has userName:"alice", leaving two records with the same supposedly unique name.
Root Cause Analysis
_apply_patch mutates the live stored dictionary before running _unique_check. Validation errors escape without rollback. Later invalid operations can similarly leave earlier operations applied.
Impact
Failed identity-management requests corrupt directory state and can make name-based lookups ambiguous. This concerns stored-record integrity, independent of the documented lack of authentication enforcement.
Severity is assessed within MiniLake's documented local development/CI use; it does not assume a shared production Databricks deployment.
Suggested Fix
Apply all operations to a deep copy, validate the complete resulting resource, then replace the stored value only on success.
Test Coverage Gaps
SCIM tests cover successful patches and duplicate creation, but do not assert stored state after a rejected update. Add duplicate-name and partially-invalid multi-operation PATCH cases for all three resource types.
Severity
Medium
Confidence
High — reproduced through the real HTTP API and traced to the source paths above.
Recommended Labels
bug
Existing Issue Matches
No reasonable duplicate found. Reviewed all open and closed issues and open pull requests in dmux/minilake, then searched component/function/symptom terms for this finding. The only open PR at review time, #29, changes the virtualenv lock entry and does not address this defect. The documented intentional limitations were checked before reporting.
Activity