How to retrieve groups for a specific user using the AWS SSO SCIM API?

Question

I am trying to use the AWS SSO SCIM API in order to retrieve the AWS SSO groups for a particular user.

Looking at the documentation https://docs.aws.amazon.com/singlesignon/latest/developerguide/listgroups.html

It mentions the following

• To see group info for a certain member, call ListGroup with a member filter
• If you're using the member filter, you have to use the id filter (refer to supported filter combinations).
• It appears that the id filter, is the group ID, because of this note: Note that the use of id as an individual filter, while valid, should be avoided as there is already a getGroup endpoint available.

Also, at https://docs.aws.amazon.com/singlesignon/latest/developerguide/limitations.html next to the members attribute it mentions that it is supported, but cannot be read in a response.

I have been playing with the API but could not get any group info for a user regardless of the combination of the parameters.

Based on the above, I conclude that the API does not support retrieving group data for a user. Would you agree?

Answer 1

I don't have access to an AWS SSO SCIM endpoint, but from looking at the documentation I suspect one of the two approaches may be possible:

1. GET /users/id and look at the value for "groups" - this one seems questionable as the limitations page says they support the user resource's "groups" attribute, but there's also a note about not supporting multi-valued user attributes. You may need to explicitly add the ?attributes=groups parameter to your GET to ask for that attribute to be returned, if it is in fact supported.

2. GET /groups?filter=members[value eq "userId"] or some variation of that depending on what syntax they allow. This isn't listed as supported, but if it works, I expect that you would get a list of groups in response that did not contain the "members" attribute - but that each group returned would match the query.

There's some amount of uncertainty with both of these, but with the information available those seem like the two most likely paths to successfully accomplish what you are aiming for. If neither of those work, it may not be possible - but a support case with AWS would probably be helpful to confirm there.