Update profile always clears out custom profile properties

[brussellc5]

To reproduce:

1. Create a user and add some custom profile attribute, in my case the attribute is a string named "uuid"
2. POST to /api/v1/users/:id following the example given here https://developer.okta.com/docs/api/resources/users.html#update-user
3. See that the custom profile attribute has been cleared out/set to null

I created an issue in the stormpath-sdk-java repository thinking that the implementation of that SDK had a bug, but after circumventing that SDK entirely to make Okta API calls, I am still getting this behavior.

Our user profiles include a uuid that is important for our current authorization system. Currently all attempts to reset a password clears out all custom properties from our user profiles. POST vs PUT does not make a difference, the uuid is always cleared out of the profile.

This is how I'm performing the update: okta_user_update.txt

[bdemers]

@brussellc5 bonus points for including the example, thanks!

One question though: When you update the user are you including the full user object, or just the delta? Sounds like you tried to PUT the whole object and had the same result, but I want to confirm before digging in.

[brussellc5]

Just the delta, the json sent has the same shape as in the password update example:
{
"credentials": {
"password" : { "value": "..." }
}

I tried the PUT after trying POST to see if maybe the docs were backwards regarding partial updates. But it wasn't a PUT of the whole object, just the delta.

[bdemers]

Use a PUT of the whole object, we are working on better idempotent support of POST across all of our objects.

But you mentioned the Okta version of the Stormpath SDK ran into this problem too?

[brussellc5]

Thanks for the clear answer @bdemers, I'll PUT the whole user.

With the Okta version of the Stormpath SDK, we're getting these same results (loss of custom profile attributes) in the following scenarios:

To reset a forgotten password: Application.resetPassword(token, password)
To update a password: resolve Account from servlet request, Account.setPassword(), Account.save()

In each case I'd view that as a problem in that I wouldn't expect either of those methods to update anything other than a password.

[bdemers]

@brussellc5 agreed! I'll close this one, and open an issue for the stormpath repo

Thanks for all of the details!!