Re: [scim] Fwd: Escape search filter values

Mark Dobrinic <mark.dobrinic@curity.io> Tue, 06 November 2018 08:59 UTC

Cc: scim@ietf.org
References: <370d231f-1041-5d28-f097-38882481a256@curity.io> <b5a522c1-afb1-aa6d-e37a-2ab1b4c0db58@curity.io> <D4D868E4-B826-43BF-8A85-0AC44028121D@oracle.com>
From: Mark Dobrinic <mark.dobrinic@curity.io>
Message-ID: <1a2b4cff-7761-884c-f680-298126bc2875@curity.io>
Date: Tue, 06 Nov 2018 09:59:25 +0100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:52.0) Gecko/20100101 Thunderbird/52.9.1
MIME-Version: 1.0
In-Reply-To: <D4D868E4-B826-43BF-8A85-0AC44028121D@oracle.com>
Content-Type: multipart/alternative; boundary="------------421C553D203AF65A7973A519"
Content-Language: en-US
Archived-At: <https://mailarchive.ietf.org/arch/msg/scim/Jo65dBF7-oTwltvpZiDx4RrBCiM>
Subject: Re: [scim] Fwd: Escape search filter values
Precedence: list

Hi Phil,

Gotcha, and thanks for that!

We'll continue with the JSON-encoding approach.

Kind regards,

Mark

On 05/11/18 18:26, Phil Hunt wrote:
> Mark
>
> You are correct. Per sec 3.1, SCIM uses RFC7159/JSON for protocol
> payload messages as well as resources. 
>
> Iow. Escape as specified in json. 
>
> Phil
>
> On Nov 5, 2018, at 12:50 AM, Mark Dobrinic <mark.dobrinic@curity.io
> <mailto:mark.dobrinic@curity.io>> wrote:
>
>> Hi guys,
>>
>> have posted this question a month ago and didn't get a follow up.
>> Anybody has thoughts on it?
>>
>> Thanks,
>>
>> Mark
>>
>>
>> -------- Forwarded Message --------
>> Subject: 	Escape search filter values
>> Date: 	Wed, 3 Oct 2018 17:37:07 +0200
>> From: 	Mark Dobrinic <mark.dobrinic@curity.io>
>> To: 	scim@ietf.org
>>
>>
>>
>> Hi scim,
>>
>> I've got a question on how to escape values that are part of the search
>> filter query in scim 2.
>>
>> For example, when sending out a search request for a user with a
>> password, we're posting a JSON-message like this to our SCIM server:
>>
>> {
>>     "schemas": [
>>         "urn:ietf:params:scim:api:messages:2.0:SearchRequest"
>>     ],
>>     "filter": "userName eq \"teddie\" and password eq "\secret\""
>> }
>>
>> But when the password contains control characters, like a double-quote
>> (") or backslash (\), what should we send to the other end?
>>
>> For now, we've been following the JSON approach, and are JSON-escaping
>> the values inside the filter, such that when the password would be
>> 'sec"ret', the JSON-message as it would be sent over becomes:
>>
>> {
>>     "schemas": [
>>         "urn:ietf:params:scim:api:messages:2.0:SearchRequest"
>>     ],
>>     "filter": "userName eq \"teddie\" and password eq "\sec\\\"ret\""
>> }
>>
>> .... but I could not find out how to deal with this in the spec.
>>
>> What do you think is the right thing to do here?
>>
>>
>> -- 
>> Regards,
>>
>> Mark Dobrinic
>> Software Engineer and Identity Specialist
>> Curity AB
>>
>> mark.dobrinic@curity.io
>> www.curity.io
>>
>> _______________________________________________
>> scim mailing list
>> scim@ietf.org <mailto:scim@ietf.org>
>> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_scim&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=yuuDrNYVFRE1h4L9M7aHG0iY0D9sKoCorF5SKqb_du0&s=QOewzWBRy4HUgd1QL4mtSXaUd_2SaGPHnZxOuwpIl1I&e=


-- 
Regards,

Mark Dobrinic
Software Engineer and Identity Specialist
Curity AB

mark.dobrinic@curity.io
www.curity.io

[scim] Escape search filter values Mark Dobrinic
[scim] Fwd: Escape search filter values Mark Dobrinic
Re: [scim] Fwd: Escape search filter values Phil Hunt
Re: [scim] Fwd: Escape search filter values Mark Dobrinic