SCIM Connector with Azure APIM – Synchronization succeeds, but provisioning fails due to missing subscription key

Question

Hi everyone, 
 In our project, we are using the SCIM connector to integrate with SAP CIS, with Azure API Management (APIM) serving as the API gateway. In our configuration, APIM requires an Ocp-Apim-Subscription-Key to be included in every request header, regardless of the endpoint or HTTP operation. Authentication is handled via Basic Authentication using a provided username and password. 
 During the endpoint configuration wizard in OneIM, we successfully passed the required subscription key as a query parameter in the URL. Additionally, we defined a custom header for the Ocp-Apim-Subscription-Key . With this setup, we were able to complete the synchronization from the SCIM provider through APIM to both the UCI and CSM tables using:

a SCIM-based synchronization project and

a follow-up sync project using the UCI connector.

This configuration allowed us to successfully read users, groups, and memberships into OneIM 9.2.1 &mdash; everything worked as expected during synchronization. 
 However, an issue arises during provisioning, specifically when attempting to add memberships. While the memberships are initially written into the CSM layer and correctly passed to UCI, the provisioning to SAP CIS via the API gateway fails. The related job ( UCI_UCIGroup_Update ) freezes and throws an error indicating that the Ocp-Apim-Subscription-Key was not provided, even though the same header worked reliably for all previous GET operations. The exact error message of the frozen jobs states: 
 
[1777018] Error running synchronization project (SAP CIS (HTTPS://DEV.API.XXX.COM))'s workflow (Provisioning).

[1777124] Error running synchronization step (Group) of synchronization configuration (Provisioning (Provisioning)).

[1777004] Method (Update object (Update)) could not be run successfully.

[System.Exception] Error returned: { "statusCode": 401, "message": "Access denied due to missing subscription key. Make sure to include subscription key when making requests to an API." }

Error returned: ...

HTTP request returned the "ProtocolError" state. This state shows processing errors. URI : dev.api.XXX.com/.../6f9606a6-7ea1-4242-96e9-7c4a8c9eea57

Error returned: The remote server returned an error: (401) Unauthorized.

Sending data {

"displayName": "SCIM-DEV-1",

"members": [

{

"$ref": "https://XXX.com/scim/Users/1f814d14-a136-4b80-83a4-1591d6436ab8",

"type": "User",

"value": "1f814d14-a136-4b80-83a4-1591d6436ab8"

},

{

"type": "User",

"value": "0018db4f-ee38-4ddd-9e16-84cabf30428e"

}

],

"schemas": [

"urn:ietf:params:scim:schemas:core:2.0:Group"

]

}

Sending PUT request using URI dev.api.XXX.com/.../6f9606a6-7ea1-4242-96e9-7c4a8c9eea57

Sending GET request using URI dev.api.XXX.com/.../6f9606a6-7ea1-4242-96e9-7c4a8c9eea57

Method OnCommitObject called.

at VI.Projector.JobComponent.ProjectorComponent._AdHocProjection()

at VI.Projector.Database.ProjectorExecutor.Project(ISession session, IProjectionConfiguration configuration, ProjectionOption options, ISystemObject adHocObject, CancellationToken cancellationToken)

at VI.Projector.Projection.Extensions.Execute(IProjectorEngine engine, IProjectionConfiguration configuration, ProjectionOption options, ISystemObject adHocObject, CancellationToken cancellationToken)

at System.Threading.Tasks.Task.Wait(Int32 millisecondsTimeout, CancellationToken cancellationToken)

at System.Threading.Tasks.Task.ThrowIfExceptional(Boolean includeTaskCanceledExceptions)

---- Start of Inner Exception ----

at VI.Projector.Projection.ProjectorEngine.d__3.MoveNext()

---- Start of Inner Exception ----

at VI.Projector.Projection.ProjectorEngine.d__3.MoveNext()

---- Start of Inner Exception ----

at VI.Projector.Projection.ProjectorEngine.d__3.MoveNext()