SCIM filter specification

Last modified 04 May 2026 13:29 +02:00
Table of Contents

SCIM 2.0 supports complex filter expressions. The framework provides a fluent API to specify supported filters. This is a reference for the SCIMREST filter specification API: declaring supported SCIM 2.0 search filters for simple, nested, and schema extension attributes.

This document is part of the SCIM 2.0 connector tutorial. See Introduction to SCIMREST framework for other topics.

Filter specification API

The FilterSpecification API provides methods to define supported filter specification:

limitations {
    supportedFilter attribute("userName").eq().anySingleValue()
}

Components:

  • attribute(name) - Specify the attribute name

  • .eq() - Equals filter (also .contains())

  • .anySingleValue() - Must have exactly one value

Filter types

Equals filter

supportedFilter attribute("userName").eq().anySingleValue()
supportedFilter attribute("externalId").eq().anySingleValue()
supportedFilter attribute("displayName").eq().anySingleValue()

Contains filter

supportedFilter attribute("displayName").contains().anySingleValue()

Multi-valued attributes

For attributes like groups with nested fields:

// Filter by groups.value
supportedFilter attribute("groups").child("value").eq().anySingleValue()

// Filter by emails.primary
supportedFilter attribute("emails").valueFilter("primary", true).child("value").eq().anySingleValue()

Extension attributes

For SCIM schema extensions:

// Using extension name
supportedFilter attribute("employeeNumber")
    .path(extension("enterprise").child("employeeNumber"))
    .eq().anySingleValue()

// Using full URN
supportedFilter attribute("urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:employeeNumber")
    .eq().anySingleValue()

Complex filter combinations

Combine multiple filters with and logic:

limitations {
    supportedFilter attribute("userName").eq().anySingleValue()
    supportedFilter attribute("externalId").eq().anySingleValue()
    supportedFilter attribute("groups").child("value").eq().anySingleValue()
    supportedFilter attribute("active").eq().anySingleValue()
}

The connector will use any of these filters when the client requests them.

Empty filter support

Framework assumes support for empty filters out of the box for SCIM servers. If server does not support empty filters, it must be specified in limitations section:

limitations {
    emptyFilterSupported false
}

Complete example

objectClass("User") {
    search {
        scim {
            limitations {
                emptyFilterSupported false
                supportedFilter attribute("userName").eq().anySingleValue()
                supportedFilter attribute("externalId").eq().anySingleValue()
                supportedFilter attribute("displayName").contains().anySingleValue()
                supportedFilter attribute("groups").child("value").eq().anySingleValue()
                supportedFilter attribute("active").eq().anySingleValue()
            }
        }
    }
}

Filter specification methods

Method

Description

Example

attribute(name)

Specify attribute

attribute("userName")

.eq()

Equals filter

.eq()

.contains()

Contains filter

.contains()

.anySingleValue()

Single value

.anySingleValue()

.child(name)

Nested path

.child("givenName")

path(path)

Explicit path

path extension("e").child("attr")
Was this page helpful?
YES NO
Thanks for your feedback