Analysis

Upon calling the GET /scim2/v2/Roles API with filtering option, the listWithGETRole() method is executed, leading to the creation of a Node associated with the filter (Node creation). The FilterTreeManager class is then used to build the filter tree, where the logic (Filter Processing) processes the filter string and generates an intermediate filter expressions list (tempTokenList).

For example, if the filter string is audienceId ne test and displayName co or, the tempTokenList will be ["audienceId ne test", "and", "displayName co", "or"]. Subsequently, another logic step (Final Token List Generation) converts this into the final filter expressions list(tokenList) as ["audienceId ne test", "and", "displayName co or"], ensuring proper expression generation for processing.

Next, the listRolesWithGET() method is invoked, which internally invokebuildSearchFilter(), which constructs and returns the search filter string ("audienceId ne test and displayName co or") to the role service layer (SCIMRoleManagerV2.java#L498).

Within the role service layer, getExpressionNodes() is called, utilizing the FilterTreeBuilder class to construct the filter tree.

The root cause of the internal server error occurs at this stage. Within FilterTreeBuilder.java, the filter expression list(token list) remains unchanged: ["audienceId ne test", "and", "displayName co", "or"] as no additional processing is defined to handleand andor correctly when it is expected to be value string.
Hence, when the system attempts to build the filter tree, it fails leading to an exception.

To resolve this issue, two possible solutions are available:

• Modify the SCIM layer : Before passing the filter string to the service layer, wrap value strings (ex:or) in single quotes (ex:'or') so that it is correctly treated as an attribute value rather than a operator.
  • Fix server error while filtering with special characters wso2-extensions/identity-inbound-provisioning-scim2#606
• Modify FilterTreeBuilder Logic: Update the FilterTreeBuilder class to handle and and or in a manner similar to FilterTreeManager.
  • Add filtering support when filter value is OR, AND or NOT carbon-identity-framework#6440