[scim] Escape search filter values

[Mark Dobrinic <[e-mail]>]

Hi scim,

I've got a question on how to escape values that are part of the search
filter query in scim 2.

For example, when sending out a search request for a user with a
password, we're posting a JSON-message like this to our SCIM server:

{
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:SearchRequest"
    ],
    "filter": "userName eq \"teddie\" and password eq "\secret\""
}

But when the password contains control characters, like a double-quote
(") or backslash (\), what should we send to the other end?

For now, we've been following the JSON approach, and are JSON-escaping
the values inside the filter, such that when the password would be
'sec"ret', the JSON-message as it would be sent over becomes:

{
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:SearchRequest"
    ],
    "filter": "userName eq \"teddie\" and password eq "\sec\\\"ret\""
}

... but I could not find out how to deal with this in the spec.

What do you think is the right thing to do here?


-- 
Regards,

Mark Dobrinic
Software Engineer and Identity Specialist
Curity AB

[e-mail]
www.curity.io