Skip to content

Fix PATCH /Users/{userId}/status ignoring caller's Accept header #4053

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
duanemay merged 2 commits into from
Aug 25, 2026
Merged

Fix PATCH /Users/{userId}/status ignoring caller's Accept header #4053

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1f5c312
Fix PATCH /Users/{userId}/status ignoring caller's Accept header
duanemay Aug 24, 2026
ee04ca0
Add regression test for missing-Accept-header account status requests
duanemay Aug 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions server/src/main/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpoints.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -555,6 +555,7 @@ public SearchResults<?> findUsers(
}

@PatchMapping("/Users/{userId}/status")
@ResponseBody
public UserAccountStatus updateAccountStatus(@RequestBody UserAccountStatus status, @PathVariable String userId) {
ScimUser user = scimUserProvisioning.retrieve(userId, identityZoneManager.getCurrentIdentityZoneId());
Comment thread
duanemay marked this conversation as resolved.

Expand Down
40 changes: 35 additions & 5 deletions ...test/java/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpointsMockMvcTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,7 +87,6 @@
@ExtendWith(ZoneSeederExtension.class)
@DefaultTestContext
class ScimUserEndpointsMockMvcTests {
private static final MediaType APPLICATION_JSON_UTF8 = new MediaType("application", "json", java.nio.charset.StandardCharsets.UTF_8);
private static final String HTTP_REDIRECT_EXAMPLE_COM = "http://redirect.example.com";
private static final String USER_PASSWORD = "pas5Word";
private String scimReadWriteToken;
Expand Down Expand Up @@ -630,7 +629,27 @@ void unlockAccount() throws Exception {
alteredAccountStatus.setLocked(false);
updateAccountStatus(userToLockout, alteredAccountStatus)
.andExpect(status().isOk())
.andExpect(content().contentType(APPLICATION_JSON_UTF8))
.andExpect(content().contentType(APPLICATION_JSON))
.andExpect(content().string(JsonUtils.writeValueAsString(alteredAccountStatus)));

attemptLogin(userToLockout)
.andExpect(redirectedUrl("/"));
}

@Test
void unlockAccountWithoutAcceptHeader() throws Exception {
// Regression test: without @ResponseBody on updateAccountStatus, a caller
// that omits Accept: application/json (e.g. uaa-cli's unlock-user, which
// issues a raw PATCH via its curl helper) gets routed into Thymeleaf view
// resolution instead of the normal HttpMessageConverter path, and 500s.
ScimUser userToLockout = createUser(uaaAdminToken);
attemptUnsuccessfulLogin(5, userToLockout.getUserName(), "");

UserAccountStatus alteredAccountStatus = new UserAccountStatus();
alteredAccountStatus.setLocked(false);
updateAccountStatusWithoutAcceptHeader(userToLockout, alteredAccountStatus)
.andExpect(status().isOk())
.andExpect(content().contentType(APPLICATION_JSON))
.andExpect(content().string(JsonUtils.writeValueAsString(alteredAccountStatus)));

attemptLogin(userToLockout)
Expand All @@ -644,7 +663,7 @@ void accountStatusEmptyPatchDoesNotUnlock() throws Exception {

updateAccountStatus(userToLockout, new UserAccountStatus())
.andExpect(status().isOk())
.andExpect(content().contentType(APPLICATION_JSON_UTF8))
.andExpect(content().contentType(APPLICATION_JSON))
.andExpect(content().string("{}"));

attemptLogin(userToLockout)
Expand Down Expand Up @@ -672,7 +691,7 @@ void unlockAccountWhenNotLocked() throws Exception {
alteredAccountStatus.setLocked(false);
updateAccountStatus(userToLockout, alteredAccountStatus)
.andExpect(status().isOk())
.andExpect(content().contentType(APPLICATION_JSON_UTF8))
.andExpect(content().contentType(APPLICATION_JSON))
.andExpect(content().string(JsonUtils.writeValueAsString(alteredAccountStatus)));

attemptLogin(userToLockout)
Expand Down Expand Up @@ -716,7 +735,7 @@ void forcePasswordChange() throws Exception {

updateAccountStatus(user, alteredAccountStatus)
.andExpect(status().isOk())
.andExpect(content().contentType(APPLICATION_JSON_UTF8))
.andExpect(content().contentType(APPLICATION_JSON))
.andExpect(content().string(JsonUtils.writeValueAsString(alteredAccountStatus)));

assertThat(usersRepository.checkPasswordChangeIndividuallyRequired(user.getId(), IdentityZoneHolder.get().getId())).isTrue();
Expand Down Expand Up @@ -1389,6 +1408,17 @@ private ResultActions updateAccountStatus(ScimUser user, UserAccountStatus alter
);
}

private ResultActions updateAccountStatusWithoutAcceptHeader(ScimUser user, UserAccountStatus alteredAccountStatus) throws Exception {
String jsonStatus = JsonUtils.writeValueAsString(alteredAccountStatus);
return mockMvc
.perform(
patch("/Users/" + user.getId() + "/status")
.header("Authorization", "Bearer " + uaaAdminToken)
.contentType(APPLICATION_JSON)
.content(jsonStatus)
);
}

private ResultActions attemptLogin(ScimUser user) throws Exception {
return mockMvc
.perform(post("/login.do")
Expand Down
9 changes: 4 additions & 5 deletions ...a/org/cloudfoundry/identity/uaa/scim/endpoints/ScimUserEndpointsMockMvcZonePathTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,7 +96,6 @@
@DefaultTestContext
@EnabledIfZonePathsEnabled
class ScimUserEndpointsMockMvcZonePathTests {
private static final MediaType APPLICATION_JSON_UTF8 = new MediaType("application", "json", java.nio.charset.StandardCharsets.UTF_8);
private static final String HTTP_REDIRECT_EXAMPLE_COM = "http://redirect.example.com";
private static final String USER_PASSWORD = "pas5Word";
private String scimReadWriteToken;
Expand Down Expand Up @@ -660,7 +659,7 @@ void unlockAccount(ZoneResolutionMode mode) throws Exception {
alteredAccountStatus.setLocked(false);
updateAccountStatus(userToLockout, alteredAccountStatus)
.andExpect(status().isOk())
.andExpect(content().contentType(APPLICATION_JSON_UTF8))
.andExpect(content().contentType(APPLICATION_JSON))
.andExpect(content().string(JsonUtils.writeValueAsString(alteredAccountStatus)));

attemptLogin(userToLockout)
Expand All @@ -675,7 +674,7 @@ void accountStatusEmptyPatchDoesNotUnlock(ZoneResolutionMode mode) throws Except

updateAccountStatus(userToLockout, new UserAccountStatus())
.andExpect(status().isOk())
.andExpect(content().contentType(APPLICATION_JSON_UTF8))
.andExpect(content().contentType(APPLICATION_JSON))
.andExpect(content().string("{}"));

attemptLogin(userToLockout)
Expand Down Expand Up @@ -703,7 +702,7 @@ void unlockAccountWhenNotLocked() throws Exception {
alteredAccountStatus.setLocked(false);
updateAccountStatus(userToLockout, alteredAccountStatus)
.andExpect(status().isOk())
.andExpect(content().contentType(APPLICATION_JSON_UTF8))
.andExpect(content().contentType(APPLICATION_JSON))
.andExpect(content().string(JsonUtils.writeValueAsString(alteredAccountStatus)));

attemptLogin(userToLockout)
Expand Down Expand Up @@ -747,7 +746,7 @@ void forcePasswordChange() throws Exception {

updateAccountStatus(user, alteredAccountStatus)
.andExpect(status().isOk())
.andExpect(content().contentType(APPLICATION_JSON_UTF8))
.andExpect(content().contentType(APPLICATION_JSON))
.andExpect(content().string(JsonUtils.writeValueAsString(alteredAccountStatus)));

assertThat(usersRepository.checkPasswordChangeIndividuallyRequired(user.getId(), IdentityZoneHolder.get().getId())).isTrue();
Expand Down
Loading