Re: [scim] [EXTERNAL] Query on a specific known resource

[Danny Zollner <[e-mail]>]

Hi Julien,

RFC 7644 section 3.4.2 specifically is talking about queries. Retrieving or modifying known resources (i.e.: GET /Users/12345 ) does not require a ListResponse type response. A query of GET /Users?filter=displayname contains "contoso.com" or GET /Users?attributes=userName would require a ListResponse type response, as it does not identify a specific resource in the query URL via ID value (i.e.: "12345" in the previous example). On the other hand, GET /Users/12345?attributes=userName does not require the ListResponse type response as it does identify a specific resource.

To explicitly answer the final question in your email - the expected response to GET /Users/2819c223-7f76-453a-919d-413861904646?attributes=userName would be the second example you provided.

Cheers,

Danny Zollner

From: scim <[e-mail]> On Behalf Of Julien Schneider
Sent: Wednesday, July 6, 2022 3:41 AM
To: [e-mail]
Subject: [EXTERNAL] [scim] Query on a specific known resource

Some people who received this message don't often get email from [e-mail]<mailto:[e-mail]>. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>
Hi all,

I have a question about queries performed against a SCIM resource object (like "/Users/{id}").

The RFC (https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Frfc7644%23section-3.4.2&data=05%7C01%7Cdanny.zollner%40microsoft.com%7C29270780ce9941a0687808da5f2b53db%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637926937860837552%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=fVtTna44Hr973Z79OsTegu9U9%2FpDwRcBZignfi5Eluk%3D&reserved=0>) states:

Responses MUST be identified using the following URI:

   "urn:ietf:params:scim:api:messages:2.0:ListResponse"

If I understand correctly, that means the "schemas" parameter of the response to those queries must be set to:

"schemas":["urn:ietf:params:scim:api:messages:2.0:ListResponse"]

While I understand how that applies to queries on a resource type endpoint (like "/Users") or on the SCIM server root, I don't understand how that applies to queries on a specific resource object.
If I understand correctly, queries on a specific resource object actually are quite identical to "retrieving a known resource" (https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.1<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Frfc7644%23section-3.4.1&data=05%7C01%7Cdanny.zollner%40microsoft.com%7C29270780ce9941a0687808da5f2b53db%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637926937860837552%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=DQEZdlY7XBONxFIegf1SCJfpdjpDdWzBvh5%2FzB%2B2EpQ%3D&reserved=0>) which are a GET on a specific resource, like:

GET /Users/2819c223-7f76-453a-919d-413861904646
Responses to those requests should have the "schemas" parameter set to the resource schema(s):

{

     "schemas":["urn:ietf:params:scim:schemas:core:2.0:User"],

     "id":"2819c223-7f76-453a-919d-413861904646",

...

}

Now, how should the response to the following query should look like? And to what value should the "schemas" parameter of the response be set?

GET /Users/2819c223-7f76-453a-919d-413861904646?attributes=userName

Should it be:

   {

     "schemas":["urn:ietf:params:scim:api:messages:2.0:ListResponse"],

     "totalResults":1,

     "Resources":[

       {

         "id":"2819c223-7f76-453a-919d-413861904646",

         "userName":"bjensen"

       }

     ]

   }

Or something like:

   {

     "schemas":["urn:ietf:params:scim:schemas:core:2.0:User"],

     "id":"2819c223-7f76-453a-919d-413861904646",

     "meta":{

       "resourceType":"User",

       "created":"2011-08-01T18:29:49.793Z",

       "lastModified":"2011-08-01T18:29:49.793Z",

       "location":

   "https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646"<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fexample.com%2Fv2%2FUsers%2F2819c223-7f76-453a-919d-413861904646&data=05%7C01%7Cdanny.zollner%40microsoft.com%7C29270780ce9941a0687808da5f2b53db%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637926937860837552%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=HRI2UjMUWpVqb0IzoOcpDNA%2FVVDBG3lZ4gU6C60Gr1I%3D&reserved=0>,

       "version":"W\/\"f250dd84f0671c3\""

     },

     "userName":"bjensen"

   }

Thanks a lot in advance


--

Julien Schneider

Tel: [phone]

Fax: [phone]



http://www.audriga.com<https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.audriga.com%2F&data=05%7C01%7Cdanny.zollner%40microsoft.com%7C29270780ce9941a0687808da5f2b53db%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637926937860837552%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=37nDJF0vyrffA22bld7R3WHNu11PnoLTmWCne%2FGCios%3D&reserved=0> | http://www.twitter.com/audriga<https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.twitter.com%2Faudriga&data=05%7C01%7Cdanny.zollner%40microsoft.com%7C29270780ce9941a0687808da5f2b53db%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637926937860837552%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=P5As3bPNzRa4zSXSdYj9%2BirwGEkk6%2BYy5jkVKNAQnYw%3D&reserved=0>



--------------------------------------------------------------------------

audriga GmbH |  Alter Schlachthof 57  | 76137 Karlsruhe

Sitz der Gesellschaft: Karlsruhe - Amtsgericht Mannheim - HRB 713034

Geschäftsführer: Dr. Frank Dengler, Dr.-Ing. Hans-Jörg Happel

--------------------------------------------------------------------------