Re: [scim] scim over messaging

I’m looking for events that are the same as current SCIM to go over messaging, the security would be known and a callback wouldn’t be needed.  But the way you specify would work too, I hope something like this can be adopted soon.  Thanks, Chris

From: Phil Hunt [mailto:phil.hunt@oracle.com]
Sent: Tuesday, October 13, 2015 4:16 PM
To: Chris Hyzer
Cc: scim@ietf.org
Subject: Re: [scim] scim over messaging

Chris,

Good question.

Yes. There has been some discussion. However it might not be quite the same use case.

Take a look at this:
https://tools.ietf.org/html/draft-hunt-scim-notify-00 (the draft has expired)

Some of us are still interested.  The current proposal is an asynchronous notification method to let one domain provider notify one or more subscribers of a changes they may be interested in. It could be tenancy to tenancy (domain wide), or it may be changes about a single resource to a subscribing mobile application.

When there are multiple domains, there are many cases where a change (e.g. a specific PATCH) might not work well in another domain - because each domain likely has a different set of information and thus slightly different information “state”.  Instead of pushing commands (as in the normal SCIM approach), the notify approach lets the receiver decide the correct action.  Eg.  Domain A provider notifies a mobile app of a change (Resource /Users/{id} had its name attribute change).  The subscriber calls back to the publishing domain provider and does a GET and decides what to do.  When the subscriber calls back, the subscribers right to see all of the information is then reviewed.

A couple of benefits:
* Makes differences in state between systems less problematic
* Allows normal SCIM access control to decide who should see what - this makes the definition of feeds and subscribers much simpler
* Dramatically reduces the information content (and privacy risk) in messages

The draft uses JWTs/JOSE to send notifications securely and makes it easy then to deliver via an alternate protocol.

Phil

@independentid
www.independentid.com<http://www.independentid.com>
phil.hunt@oracle.com<mailto:phil.hunt@oracle.com>

On Oct 13, 2015, at 1:00 PM, Chris Hyzer <mchyzer@isc.upenn.edu<mailto:mchyzer@isc.upenn.edu>> wrote:

Has there been discussion about SCIM over messaging?

Ie. If sending SCIM through a messaging system (e.g. AWS SQS, activeMQ, etc)  where it is not HTTP.  Basically this means there is no response, and the request would need whatever would normally be in HTTP be in the message object.  E.g.

{

  "method": "PATCH",

  "resource": "/Groups/acbf3ae7-8463-4692-b4fd-9b4da3f908ce"

  "body": {

    "schemas": ["urn:scim:schemas:core:1.0"],

    "members": [

      {

        "display": "Babs Jensen",

        "value": "pennperson:12345678",

        "operation": "delete"

      }

    ]

  }

}

Is something like this something that could be added to a future roadmap if not there already?

Thanks,
Chris

Ps. tried to send this earlier, sorry if this is a dupe
_______________________________________________
scim mailing list
scim@ietf.org<mailto:scim@ietf.org>
https://www.ietf.org/mailman/listinfo/scim