From dc634b75891ad23451ad571881c21371983477ba Mon Sep 17 00:00:00 2001
From: asha15 <165079T@uom.lk>
Date: Tue, 20 Feb 2024 22:36:45 +0530
Subject: [PATCH 01/11] get totalResults by user count

---
 .../scim2/common/impl/SCIMUserManager.java    | 79 ++++++++++++++++++-
 .../common/utils/SCIMCommonConstants.java     |  2 +
 .../scim2/common/utils/SCIMCommonUtils.java   | 11 +++
 3 files changed, 91 insertions(+), 1 deletion(-)

diff --git a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java
index 6f5a23dba..da34b5ad2 100644
--- a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java
+++ b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java
@@ -1447,7 +1447,13 @@ private UsersGetResponse filterUsersBySingleAttribute(ExpressionNode node, Map<S
                     maxLimit = Math.max(maxLimit, limit);
                 }
                 // Get total users based on the filter query without depending on pagination params.
-                totalResults += filterUsers(node, 1, maxLimit, sortBy, sortOrder, domainName).size();
+                if(SCIMCommonUtils.isRetrieveTotalResultsByUserCountEnabled()) {
+                    //Get the total user count by the filter query.
+                    totalResults += getUserCountByAttribute(node, 1, maxLimit, sortBy, sortOrder, domainName);
+                } else {
+                    totalResults += filterUsers(node, 1, maxLimit, sortBy, sortOrder, domainName).size();
+                }
+
             } else {
                 totalResults += users.size();
             }
@@ -1458,6 +1464,29 @@ private UsersGetResponse filterUsersBySingleAttribute(ExpressionNode node, Map<S
         return getDetailedUsers(filteredUsers, totalResults);
     }
 
+    /**
+     * method to get user count by filtering parameter.
+     *
+     * @param node       Expression node for single attribute filtering
+     * @param offset     Starting index of the count
+     * @param limit      Counting value
+     * @param sortBy     SortBy
+     * @param sortOrder  Sorting order
+     * @param domainName Domain to run the filter
+     * @return User count
+     * @throws BadRequestException
+     * @throws CharonException
+     */
+    private int getUserCountByAttribute(Node node, int offset, int limit, String sortBy,
+                             String sortOrder, String domainName) throws BadRequestException, CharonException {
+
+        if (SCIMConstants.UserSchemaConstants.GROUP_URI.equals(((ExpressionNode) node).getAttributeValue())) {
+            getUserCountByGroup(node, domainName);
+        }
+
+        return filterUsers(node, 1, limit, sortBy, sortOrder, domainName).size();
+    }
+
     /**
      * Method to check whether the all configured user stores are JDBC.
      *
@@ -1695,6 +1724,54 @@ private Set<org.wso2.carbon.user.core.common.User> filterUsers(Node node, int of
         }
     }
 
+    /**
+     * Method to get User Count by Group filter
+     *
+     * @param node       Expression or Operation node.
+     * @param domainName Domain name.
+     * @return User count for the filtered group.
+     * @throws CharonException
+     * @throws BadRequestException
+     */
+    private int getUserCountByGroup(Node node, String domainName)
+            throws CharonException, BadRequestException {
+
+        int count = 0;
+        // Set filter values.
+        String attributeName = ((ExpressionNode) node).getAttributeValue();
+        String filterOperation = ((ExpressionNode) node).getOperation();
+        String attributeValue = ((ExpressionNode) node).getValue();
+
+        /*
+        If there is a domain and if the domain separator is not found in the attribute value, append the domain
+        with the domain separator in front of the new attribute value.
+        */
+        attributeValue = UserCoreUtil.addDomainToName(((ExpressionNode) node).getValue(), domainName);
+
+        try {
+            List<String> roleNames = getRoleNames(attributeName, filterOperation, attributeValue);
+            count = getUserCountForRole(roleNames);
+            return count;
+        } catch (UserStoreException e) {
+            String errorMessage = String.format("Error while filtering the users for filter with attribute name: "
+                            + "%s, filter operation: %s and attribute value: %s.", attributeName, filterOperation,
+                    attributeValue);
+            throw resolveError(e, errorMessage);
+        }
+    }
+
+    private int getUserCountForRole(List<String> roleNames) throws
+                        org.wso2.carbon.user.core.UserStoreException {
+
+        int count = 0;
+        if (roleNames != null) {
+            for (String roleName : roleNames) {
+                count += carbonUM.getUserCountForRole(roleName);
+            }
+        }
+        return count;
+    }
+
     /**
      * Method to perform a multiple domain search when the domain is not specified in the request. The same function
      * can be used to listing users by passing a condition for conditionForListingUsers parameter.
diff --git a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/utils/SCIMCommonConstants.java b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/utils/SCIMCommonConstants.java
index b372bd78b..54b7036f4 100644
--- a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/utils/SCIMCommonConstants.java
+++ b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/utils/SCIMCommonConstants.java
@@ -102,6 +102,8 @@ public class SCIMCommonConstants {
             "SCIM2.ConsiderMaxLimitForTotalResult";
     public static final String SCIM_ENABLE_CONSIDER_TOTAL_RECORDS_FOR_TOTAL_RESULT_OF_LDAP =
             "SCIM2.ConsiderTotalRecordsForTotalResultOfLDAP";
+    public static final String SCIM_ENABLE_RETRIEVE_TOTAL_RESULTS_BY_User_Count =
+            "SCIM2.EnableRetrieveTotalResultsByUserCount";
     public static final String SCIM_ENABLE_MANDATE_DOMAIN_FOR_GROUPNAMES_IN_GROUPS_RESPONSE =
             "SCIM2.MandateDomainForGroupNamesInGroupsResponse";
     public static final String SCIM_ENABLE_MANDATE_DOMAIN_FOR_USERNAMES_AND_GROUPNAMES_IN_RESPONSE =
diff --git a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/utils/SCIMCommonUtils.java b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/utils/SCIMCommonUtils.java
index 4dd1f403c..62a01b82e 100644
--- a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/utils/SCIMCommonUtils.java
+++ b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/utils/SCIMCommonUtils.java
@@ -619,6 +619,17 @@ public static boolean isEnterpriseUserExtensionEnabled() {
                 .getProperty(SCIMCommonConstants.ENTERPRISE_USER_EXTENSION_ENABLED));
     }
 
+    /**
+     * Checks whether the identity.xml config is available to retrieve totalResults by user count.
+     *
+     * @return whether 'RetrieveTotalResultsByUserCount' property is enabled in identity.xml.
+     */
+    public static boolean isRetrieveTotalResultsByUserCountEnabled() {
+
+        return Boolean.parseBoolean(IdentityUtil.getProperty(
+                SCIMCommonConstants.SCIM_ENABLE_RETRIEVE_TOTAL_RESULTS_BY_User_Count));
+    }
+
     /**
      * Checks whether the identity.xml config is available to notify userstore availability.
      *

From 38df20b053c579ecb7fe837d5fb50b9f44665bed Mon Sep 17 00:00:00 2001
From: asha15 <165079T@uom.lk>
Date: Wed, 21 Feb 2024 12:24:25 +0530
Subject: [PATCH 02/11] add return statement

---
 .../wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java
index da34b5ad2..a2a4f03db 100644
--- a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java
+++ b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java
@@ -1481,7 +1481,7 @@ private int getUserCountByAttribute(Node node, int offset, int limit, String sor
                              String sortOrder, String domainName) throws BadRequestException, CharonException {
 
         if (SCIMConstants.UserSchemaConstants.GROUP_URI.equals(((ExpressionNode) node).getAttributeValue())) {
-            getUserCountByGroup(node, domainName);
+            return getUserCountByGroup(node, domainName);
         }
 
         return filterUsers(node, 1, limit, sortBy, sortOrder, domainName).size();

From 92fc824ee56344d63396a1afcc166e94e6dff0b0 Mon Sep 17 00:00:00 2001
From: asha15 <165079T@uom.lk>
Date: Mon, 18 Mar 2024 09:23:21 +0530
Subject: [PATCH 03/11] bump kernel version

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 98b4b8e3d..5b75844c8 100644
--- a/pom.xml
+++ b/pom.xml
@@ -284,7 +284,7 @@
         <cxf-bundle.version>3.3.7</cxf-bundle.version>
         <inbound.auth.oauth.version>6.5.3</inbound.auth.oauth.version>
         <commons-collections.version>3.2.0.wso2v1</commons-collections.version>
-        <carbon.kernel.version>4.10.2</carbon.kernel.version>
+        <carbon.kernel.version>4.10.10</carbon.kernel.version>
         <identity.framework.version>7.0.89</identity.framework.version>
         <junit.version>4.13.1</junit.version>
         <commons.lang.version>20030203.000129</commons.lang.version>

From 9ce165e50b057458b78b31a01ffd1b97eab06e91 Mon Sep 17 00:00:00 2001
From: dhaura <dhaurapathirana@gmail.com>
Date: Tue, 26 Mar 2024 18:26:27 +0530
Subject: [PATCH 04/11] Fix checkstyle issues

---
 .../carbon/identity/scim2/common/impl/SCIMUserManager.java   | 5 ++---
 .../identity/scim2/common/utils/SCIMCommonConstants.java     | 2 +-
 .../carbon/identity/scim2/common/utils/SCIMCommonUtils.java  | 2 +-
 3 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java
index a2a4f03db..f52bd3483 100644
--- a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java
+++ b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java
@@ -1447,13 +1447,12 @@ private UsersGetResponse filterUsersBySingleAttribute(ExpressionNode node, Map<S
                     maxLimit = Math.max(maxLimit, limit);
                 }
                 // Get total users based on the filter query without depending on pagination params.
-                if(SCIMCommonUtils.isRetrieveTotalResultsByUserCountEnabled()) {
-                    //Get the total user count by the filter query.
+                if (SCIMCommonUtils.isRetrieveTotalResultsByUserCountEnabled()) {
+                    // Get the total user count by the filter query.
                     totalResults += getUserCountByAttribute(node, 1, maxLimit, sortBy, sortOrder, domainName);
                 } else {
                     totalResults += filterUsers(node, 1, maxLimit, sortBy, sortOrder, domainName).size();
                 }
-
             } else {
                 totalResults += users.size();
             }
diff --git a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/utils/SCIMCommonConstants.java b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/utils/SCIMCommonConstants.java
index 54b7036f4..52c30f012 100644
--- a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/utils/SCIMCommonConstants.java
+++ b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/utils/SCIMCommonConstants.java
@@ -102,7 +102,7 @@ public class SCIMCommonConstants {
             "SCIM2.ConsiderMaxLimitForTotalResult";
     public static final String SCIM_ENABLE_CONSIDER_TOTAL_RECORDS_FOR_TOTAL_RESULT_OF_LDAP =
             "SCIM2.ConsiderTotalRecordsForTotalResultOfLDAP";
-    public static final String SCIM_ENABLE_RETRIEVE_TOTAL_RESULTS_BY_User_Count =
+    public static final String SCIM_ENABLE_RETRIEVE_TOTAL_RESULTS_BY_USER_COUNT =
             "SCIM2.EnableRetrieveTotalResultsByUserCount";
     public static final String SCIM_ENABLE_MANDATE_DOMAIN_FOR_GROUPNAMES_IN_GROUPS_RESPONSE =
             "SCIM2.MandateDomainForGroupNamesInGroupsResponse";
diff --git a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/utils/SCIMCommonUtils.java b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/utils/SCIMCommonUtils.java
index 62a01b82e..615264411 100644
--- a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/utils/SCIMCommonUtils.java
+++ b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/utils/SCIMCommonUtils.java
@@ -627,7 +627,7 @@ public static boolean isEnterpriseUserExtensionEnabled() {
     public static boolean isRetrieveTotalResultsByUserCountEnabled() {
 
         return Boolean.parseBoolean(IdentityUtil.getProperty(
-                SCIMCommonConstants.SCIM_ENABLE_RETRIEVE_TOTAL_RESULTS_BY_User_Count));
+                SCIMCommonConstants.SCIM_ENABLE_RETRIEVE_TOTAL_RESULTS_BY_USER_COUNT));
     }
 
     /**

From cdabb8f4afaa9050053affd3eb1144f06c9c2564 Mon Sep 17 00:00:00 2001
From: dhaura <dhaurapathirana@gmail.com>
Date: Fri, 29 Mar 2024 14:42:41 +0530
Subject: [PATCH 05/11] For JDBC userstores, if both role group separation and
 EnableRetrieveTotalResultsByUserCount config is enabled, retrieve users only
 for groups in scim2 user endpoint group filter.

---
 .../scim2/common/impl/SCIMUserManager.java    | 37 +++++++++++++++----
 1 file changed, 30 insertions(+), 7 deletions(-)

diff --git a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java
index f52bd3483..dc5a0c6bc 100644
--- a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java
+++ b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java
@@ -1680,7 +1680,13 @@ private Set<org.wso2.carbon.user.core.common.User> filterUsersByGroup(Node node,
 
         try {
             List<String> roleNames = getRoleNames(attributeName, filterOperation, attributeValue);
-            Set<org.wso2.carbon.user.core.common.User> users = getUserListOfRoles(roleNames);
+            Set<org.wso2.carbon.user.core.common.User> users;
+            if ((isJDBCUSerStore(domainName) || isAllConfiguredUserStoresJDBC()) &&
+                    SCIMCommonUtils.isRetrieveTotalResultsByUserCountEnabled()) {
+                users = getUserListOfGroups(roleNames);
+            } else {
+                users = getUserListOfRoles(roleNames);
+            }
             users = paginateUsers(users, limit, offset);
             return users;
         } catch (UserStoreException e) {
@@ -1749,7 +1755,7 @@ private int getUserCountByGroup(Node node, String domainName)
 
         try {
             List<String> roleNames = getRoleNames(attributeName, filterOperation, attributeValue);
-            count = getUserCountForRole(roleNames);
+            count = getUserCountForGroup(roleNames);
             return count;
         } catch (UserStoreException e) {
             String errorMessage = String.format("Error while filtering the users for filter with attribute name: "
@@ -1759,13 +1765,13 @@ private int getUserCountByGroup(Node node, String domainName)
         }
     }
 
-    private int getUserCountForRole(List<String> roleNames) throws
+    private int getUserCountForGroup(List<String> groupNames) throws
                         org.wso2.carbon.user.core.UserStoreException {
 
         int count = 0;
-        if (roleNames != null) {
-            for (String roleName : roleNames) {
-                count += carbonUM.getUserCountForRole(roleName);
+        if (groupNames != null) {
+            for (String groupName : groupNames) {
+                count += carbonUM.getUserCountForGroup(groupName);
             }
         }
         return count;
@@ -2053,7 +2059,12 @@ private Set<org.wso2.carbon.user.core.common.User> filterUsersUsingLegacyAPIs(Ex
         try {
             if (SCIMConstants.UserSchemaConstants.GROUP_URI.equals(attributeName)) {
                 List<String> roleNames = getRoleNames(attributeName, filterOperation, attributeValue);
-                users = getUserListOfRoles(roleNames);
+                if ((isJDBCUSerStore(domainName) || isAllConfiguredUserStoresJDBC()) &&
+                        SCIMCommonUtils.isRetrieveTotalResultsByUserCountEnabled()) {
+                    users = getUserListOfGroups(roleNames);
+                } else {
+                    users = getUserListOfRoles(roleNames);
+                }
             } else {
                 // Get the user name of the user with this id.
                 users = getUserNames(attributeName, filterOperation, attributeValue);
@@ -4812,6 +4823,18 @@ private Set<org.wso2.carbon.user.core.common.User> getUserListOfRoles(List<Strin
         return users;
     }
 
+    private Set<org.wso2.carbon.user.core.common.User> getUserListOfGroups(List<String> groupNames)
+            throws org.wso2.carbon.user.core.UserStoreException {
+
+        Set<org.wso2.carbon.user.core.common.User> users = new HashSet<>();
+        if (groupNames != null) {
+            for (String groupName : groupNames) {
+                users.addAll(new HashSet<>(carbonUM.getUserListOfGroupWithID(groupName)));
+            }
+        }
+        return users;
+    }
+
     /**
      * Get the search value after appending the delimiters according to the attribute name to be filtered.
      *

From 0e094f33a0cf90c2be7167ef48156788e02e11b2 Mon Sep 17 00:00:00 2001
From: dhaura <dhaurapathirana@gmail.com>
Date: Fri, 29 Mar 2024 16:33:54 +0530
Subject: [PATCH 06/11] Remove JDBC check in filterUsersByGroup method.

---
 .../carbon/identity/scim2/common/impl/SCIMUserManager.java     | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java
index dc5a0c6bc..7ed057238 100644
--- a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java
+++ b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java
@@ -1681,8 +1681,7 @@ private Set<org.wso2.carbon.user.core.common.User> filterUsersByGroup(Node node,
         try {
             List<String> roleNames = getRoleNames(attributeName, filterOperation, attributeValue);
             Set<org.wso2.carbon.user.core.common.User> users;
-            if ((isJDBCUSerStore(domainName) || isAllConfiguredUserStoresJDBC()) &&
-                    SCIMCommonUtils.isRetrieveTotalResultsByUserCountEnabled()) {
+            if (SCIMCommonUtils.isRetrieveTotalResultsByUserCountEnabled()) {
                 users = getUserListOfGroups(roleNames);
             } else {
                 users = getUserListOfRoles(roleNames);

From 2fb85efb82fea5e1858d5c0bc2ecd62cb3e51d66 Mon Sep 17 00:00:00 2001
From: dhaura <dhaurapathirana@gmail.com>
Date: Fri, 29 Mar 2024 16:43:29 +0530
Subject: [PATCH 07/11] Remove JDBC check in filterUsersByGroup method.

---
 .../carbon/identity/scim2/common/impl/SCIMUserManager.java     | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java
index aa818eb8c..df8af7a1c 100644
--- a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java
+++ b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java
@@ -2057,8 +2057,7 @@ private Set<org.wso2.carbon.user.core.common.User> filterUsersUsingLegacyAPIs(Ex
         try {
             if (SCIMConstants.UserSchemaConstants.GROUP_URI.equals(attributeName)) {
                 List<String> roleNames = getRoleNames(attributeName, filterOperation, attributeValue);
-                if ((isJDBCUSerStore(domainName) || isAllConfiguredUserStoresJDBC()) &&
-                        SCIMCommonUtils.isRetrieveTotalResultsByUserCountEnabled()) {
+                if (SCIMCommonUtils.isRetrieveTotalResultsByUserCountEnabled()) {
                     users = getUserListOfGroups(roleNames);
                 } else {
                     users = getUserListOfRoles(roleNames);

From 6971d7032dd66875fb60641349cbae8585474a28 Mon Sep 17 00:00:00 2001
From: dhaura <dhaurapathirana@gmail.com>
Date: Tue, 2 Apr 2024 12:58:02 +0530
Subject: [PATCH 08/11] Rename identity.xml scim2 config to
 EnableGroupBasedUserFilteringImprovements.

---
 .../scim2/common/impl/SCIMUserManager.java         | 14 +++++++-------
 .../scim2/common/utils/SCIMCommonConstants.java    |  4 ++--
 .../scim2/common/utils/SCIMCommonUtils.java        |  8 ++++----
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java
index df8af7a1c..3938be49a 100644
--- a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java
+++ b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java
@@ -1446,7 +1446,7 @@ private UsersGetResponse filterUsersBySingleAttribute(ExpressionNode node, Map<S
                     maxLimit = Math.max(maxLimit, limit);
                 }
                 // Get total users based on the filter query without depending on pagination params.
-                if (SCIMCommonUtils.isRetrieveTotalResultsByUserCountEnabled()) {
+                if (SCIMCommonUtils.isGroupBasedUserFilteringImprovementsEnabled()) {
                     // Get the total user count by the filter query.
                     totalResults += getUserCountByAttribute(node, 1, maxLimit, sortBy, sortOrder, domainName);
                 } else {
@@ -1472,8 +1472,8 @@ private UsersGetResponse filterUsersBySingleAttribute(ExpressionNode node, Map<S
      * @param sortOrder  Sorting order
      * @param domainName Domain to run the filter
      * @return User count
-     * @throws BadRequestException
-     * @throws CharonException
+     * @throws BadRequestException Exception occurred due to a bad request.
+     * @throws CharonException Error while filtering the users.
      */
     private int getUserCountByAttribute(Node node, int offset, int limit, String sortBy,
                              String sortOrder, String domainName) throws BadRequestException, CharonException {
@@ -1680,7 +1680,7 @@ private Set<org.wso2.carbon.user.core.common.User> filterUsersByGroup(Node node,
         try {
             List<String> roleNames = getRoleNames(attributeName, filterOperation, attributeValue);
             Set<org.wso2.carbon.user.core.common.User> users;
-            if (SCIMCommonUtils.isRetrieveTotalResultsByUserCountEnabled()) {
+            if (SCIMCommonUtils.isGroupBasedUserFilteringImprovementsEnabled()) {
                 users = getUserListOfGroups(roleNames);
             } else {
                 users = getUserListOfRoles(roleNames);
@@ -1733,8 +1733,8 @@ private Set<org.wso2.carbon.user.core.common.User> filterUsers(Node node, int of
      * @param node       Expression or Operation node.
      * @param domainName Domain name.
      * @return User count for the filtered group.
-     * @throws CharonException
-     * @throws BadRequestException
+     * @throws CharonException Error while filtering the users.
+     * @throws BadRequestException Exception occurred due to a bad request.
      */
     private int getUserCountByGroup(Node node, String domainName)
             throws CharonException, BadRequestException {
@@ -2057,7 +2057,7 @@ private Set<org.wso2.carbon.user.core.common.User> filterUsersUsingLegacyAPIs(Ex
         try {
             if (SCIMConstants.UserSchemaConstants.GROUP_URI.equals(attributeName)) {
                 List<String> roleNames = getRoleNames(attributeName, filterOperation, attributeValue);
-                if (SCIMCommonUtils.isRetrieveTotalResultsByUserCountEnabled()) {
+                if (SCIMCommonUtils.isGroupBasedUserFilteringImprovementsEnabled()) {
                     users = getUserListOfGroups(roleNames);
                 } else {
                     users = getUserListOfRoles(roleNames);
diff --git a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/utils/SCIMCommonConstants.java b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/utils/SCIMCommonConstants.java
index 52c30f012..08a8147a0 100644
--- a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/utils/SCIMCommonConstants.java
+++ b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/utils/SCIMCommonConstants.java
@@ -102,8 +102,8 @@ public class SCIMCommonConstants {
             "SCIM2.ConsiderMaxLimitForTotalResult";
     public static final String SCIM_ENABLE_CONSIDER_TOTAL_RECORDS_FOR_TOTAL_RESULT_OF_LDAP =
             "SCIM2.ConsiderTotalRecordsForTotalResultOfLDAP";
-    public static final String SCIM_ENABLE_RETRIEVE_TOTAL_RESULTS_BY_USER_COUNT =
-            "SCIM2.EnableRetrieveTotalResultsByUserCount";
+    public static final String SCIM_ENABLE_GROUP_BASED_USER_FILTERING_IMPROVEMENTS =
+            "SCIM2.EnableGroupBasedUserFilteringImprovements";
     public static final String SCIM_ENABLE_MANDATE_DOMAIN_FOR_GROUPNAMES_IN_GROUPS_RESPONSE =
             "SCIM2.MandateDomainForGroupNamesInGroupsResponse";
     public static final String SCIM_ENABLE_MANDATE_DOMAIN_FOR_USERNAMES_AND_GROUPNAMES_IN_RESPONSE =
diff --git a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/utils/SCIMCommonUtils.java b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/utils/SCIMCommonUtils.java
index 12f89a309..b57949a90 100644
--- a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/utils/SCIMCommonUtils.java
+++ b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/utils/SCIMCommonUtils.java
@@ -620,14 +620,14 @@ public static boolean isEnterpriseUserExtensionEnabled() {
     }
 
     /**
-     * Checks whether the identity.xml config is available to retrieve totalResults by user count.
+     * Checks whether the identity.xml config is available to enable group based user filtering improvements.
      *
-     * @return whether 'RetrieveTotalResultsByUserCount' property is enabled in identity.xml.
+     * @return Whether 'SCIM_ENABLE_GROUP_BASED_USER_FILTERING_IMPROVEMENTS' property is enabled in identity.xml.
      */
-    public static boolean isRetrieveTotalResultsByUserCountEnabled() {
+    public static boolean isGroupBasedUserFilteringImprovementsEnabled() {
 
         return Boolean.parseBoolean(IdentityUtil.getProperty(
-                SCIMCommonConstants.SCIM_ENABLE_RETRIEVE_TOTAL_RESULTS_BY_USER_COUNT));
+                SCIMCommonConstants.SCIM_ENABLE_GROUP_BASED_USER_FILTERING_IMPROVEMENTS));
     }
 
     /**

From dbd790bf39b5ce037dd10078ad1d609f0a7cb51e Mon Sep 17 00:00:00 2001
From: dhaura <dhaurapathirana@gmail.com>
Date: Wed, 3 Apr 2024 12:33:03 +0530
Subject: [PATCH 09/11] Use new total user count method for groups only for
 JDBC userstores.

---
 .../carbon/identity/scim2/common/impl/SCIMUserManager.java    | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java
index 3938be49a..2b31550af 100644
--- a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java
+++ b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java
@@ -1446,8 +1446,10 @@ private UsersGetResponse filterUsersBySingleAttribute(ExpressionNode node, Map<S
                     maxLimit = Math.max(maxLimit, limit);
                 }
                 // Get total users based on the filter query without depending on pagination params.
-                if (SCIMCommonUtils.isGroupBasedUserFilteringImprovementsEnabled()) {
+                if (SCIMCommonUtils.isGroupBasedUserFilteringImprovementsEnabled() &&
+                        (isJDBCUSerStore(domainName) || isAllConfiguredUserStoresJDBC())) {
                     // Get the total user count by the filter query.
+                    // This is only implemented for JDBC userstores.
                     totalResults += getUserCountByAttribute(node, 1, maxLimit, sortBy, sortOrder, domainName);
                 } else {
                     totalResults += filterUsers(node, 1, maxLimit, sortBy, sortOrder, domainName).size();

From 41d5fb40599620ad4bce7495050ee32ee32b3574 Mon Sep 17 00:00:00 2001
From: dhaura <dhaurapathirana@gmail.com>
Date: Wed, 3 Apr 2024 13:46:33 +0530
Subject: [PATCH 10/11] Fix formatting issues.

---
 .../identity/scim2/common/impl/SCIMUserManager.java      | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java
index 2b31550af..52331d4db 100644
--- a/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java
+++ b/components/org.wso2.carbon.identity.scim2.common/src/main/java/org/wso2/carbon/identity/scim2/common/impl/SCIMUserManager.java
@@ -1475,10 +1475,11 @@ private UsersGetResponse filterUsersBySingleAttribute(ExpressionNode node, Map<S
      * @param domainName Domain to run the filter
      * @return User count
      * @throws BadRequestException Exception occurred due to a bad request.
-     * @throws CharonException Error while filtering the users.
+     * @throws CharonException     Error while filtering the users.
      */
     private int getUserCountByAttribute(Node node, int offset, int limit, String sortBy,
-                             String sortOrder, String domainName) throws BadRequestException, CharonException {
+                                        String sortOrder, String domainName)
+            throws BadRequestException, CharonException {
 
         if (SCIMConstants.UserSchemaConstants.GROUP_URI.equals(((ExpressionNode) node).getAttributeValue())) {
             return getUserCountByGroup(node, domainName);
@@ -1735,7 +1736,7 @@ private Set<org.wso2.carbon.user.core.common.User> filterUsers(Node node, int of
      * @param node       Expression or Operation node.
      * @param domainName Domain name.
      * @return User count for the filtered group.
-     * @throws CharonException Error while filtering the users.
+     * @throws CharonException     Error while filtering the users.
      * @throws BadRequestException Exception occurred due to a bad request.
      */
     private int getUserCountByGroup(Node node, String domainName)
@@ -1766,7 +1767,7 @@ private int getUserCountByGroup(Node node, String domainName)
     }
 
     private int getUserCountForGroup(List<String> groupNames) throws
-                        org.wso2.carbon.user.core.UserStoreException {
+            org.wso2.carbon.user.core.UserStoreException {
 
         int count = 0;
         if (groupNames != null) {

From efc6e70e2db321677c93058577597de8378cee5b Mon Sep 17 00:00:00 2001
From: dhaura <dhaurapathirana@gmail.com>
Date: Wed, 10 Apr 2024 10:51:48 +0530
Subject: [PATCH 11/11] Bump kernel version.

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index f99ade447..df55808bf 100644
--- a/pom.xml
+++ b/pom.xml
@@ -284,7 +284,7 @@
         <cxf-bundle.version>3.3.7</cxf-bundle.version>
         <inbound.auth.oauth.version>6.5.3</inbound.auth.oauth.version>
         <commons-collections.version>3.2.0.wso2v1</commons-collections.version>
-        <carbon.kernel.version>4.10.10</carbon.kernel.version>
+        <carbon.kernel.version>4.10.12</carbon.kernel.version>
         <identity.framework.version>7.0.112</identity.framework.version>
         <junit.version>4.13.1</junit.version>
         <commons.lang.version>20030203.000129</commons.lang.version>