Re: [scim] Call this week

[Phil Hunt <[e-mail]>]

Summary of the informal last week. These are just my recollections - so please feel to correct and add on.

Attendees:

* Erik Wahlstrom
* Tony Nadalin
* Mike Jones
* Morteza Ansari
* Ian Glazer

As the WG is now between charters, some of us decided to talk about some of the items that have been discussed on the list. Some items are new, some are old. At this stage without more formal group discussion, I would not take this as any indication of priority. This is just what we managed to get through in the short time we had.  :-)

We discussed the following items:

Well-known:
The general feeling is that a simple well-known response for discovery of a SCIM root is strongly desirable.

There was less consensus on WebFinger. Mike indicated this would be helpful particularly in multi-tenancy scenarios because it could help a client locate a tenancy specific SCIM service provider based on a filter (e.g. userid or emails).

Notify:
Ian and Morteza indicated interest in getting back to work on this. We noted that there was a presentation from Confyrm at the Cloud Identity Summer about inter cloud-provider events.  Maybe this could tie in?  I (Phil) reported that the work on WebPUSH seems to be more divergent with out intent. 

Credentials:
We discussed some very rough ideas.  Some observations:
* Credentials might be shared by more than one user, device etc.  E.g a user might use a device and the same credential might be used to authenticate a device or the user on the device.  Erik mentioned a case where users might share a credential
* We could leverage the OAuth AMR draft from Mike in order to categorize credential types
* Handling as a simple multi-valued attribute might not be enough. Each credential may have common meta data (creation date, expiry etc) but may also have credential specific schema.
* We discussed making a credential instance its own resource type in SCIM (e.g. /Credentials). That would mean that each credential has its own resource identifier where the core schema for the resource type would have all the common management attributes (e.g. creation, expiry) etc and may have links to the owner/user of the credential.  Schema extensions for each credential type could be used to add authenticator specific attributes to the resources.

Downside:  By separating credentials from the User resources, it may impact how implementers get scale since credentials may have to be queried in a separate lookup. On a plus side, keeping credentials away from the User object may make access control easier to define — since non-priv access should not need access to credential resources.

We agreed to try to meet informally at IETF94. Hopefully one of the chairs can wangle a room.  We will work towards amending existing drafts and in the case of credentials, put enough information together to get an initial draft together.

I believe many of us are also going to IIW the week before. So we can definitely meet up there too.

Apologies if I left anything out or mis-construded/attributed comments.  I didn’t take notes this is just my recollection.

Phil

@independentid
www.independentid.com
[e-mail]

> On Oct 5, 2015, at 3:12 PM, Anthony Nadalin <[e-mail]> wrote:
> 
> yes
> 
> -----Original Message-----
> From: scim [mailto:[e-mail]] On Behalf Of Leif Johansson
> Sent: Sunday, October 4, 2015 11:28 AM
> To: [e-mail]
> Subject: Re: [scim] Call this week
> 
> On 2015-09-30 09:07, Erik Wahlström neXus wrote:
>> Thursday works for me, not Friday.
>> / Erik
>> 
> 
> did you guys have a call?
> 
> _______________________________________________
> scim mailing list
> [e-mail]
> https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fmailman%2flistinfo%2fscim&data=01%7c01%7ctonynad%40microsoft.com%7cf0af1fbb33ed42d9809908d2cce97b53%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=WBftVaoFTJKJOxLlu71ca7%2bf2BJKj80mIP%2bjVitKemk%3d
> 
> _______________________________________________
> scim mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/scim