Re: [scim] How to patch multi-valued nested attributes?

Phil Hunt <phil.hunt@oracle.com> Mon, 25 February 2019 22:40 UTC

Return-Path: <phil.hunt@oracle.com>
X-Original-To: scim@ietfa.amsl.com
Delivered-To: scim@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 04D3F131136 for <scim@ietfa.amsl.com>; Mon, 25 Feb 2019 14:40:53 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.302
X-Spam-Level:
X-Spam-Status: No, score=-4.302 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=oracle.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jHlwIeJYLmBp for <scim@ietfa.amsl.com>; Mon, 25 Feb 2019 14:40:51 -0800 (PST)
Received: from aserp2130.oracle.com (aserp2130.oracle.com [141.146.126.79]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8834C131133 for <scim@ietf.org>; Mon, 25 Feb 2019 14:40:51 -0800 (PST)
Received: from pps.filterd (aserp2130.oracle.com [127.0.0.1]) by aserp2130.oracle.com (8.16.0.27/8.16.0.27) with SMTP id x1PMdJNO178178; Mon, 25 Feb 2019 22:40:49 GMT
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=content-type : mime-version : subject : from : in-reply-to : date : cc : content-transfer-encoding : message-id : references : to; s=corp-2018-07-02; bh=OzJY127VV//UHmdCLExaGo+jc8K0/C6D7CIVS/qfac4=; b=OqPnfVW3KzhR18JUpwMPFdbkyYGdj5aWxJggcXH7YxnRJbyNFoNM57nkHZxmbcWi2mWg pFLvsRvHPWDikYg/cMVxsjgs8NgfwYFXt6h/21lWV2K66Ale8fDBAcFWqmdlvo/Jmelt le/990M0RPodwNo9N/sGt0lqxvsoU43dfGLoS6PbpqE/aG2Sgf60lcgDxzOwH+xBplXC zW5VG/ZLYhjpQ0eCCId4by8UgL8paf+ws+ApR+ILO24AwhJXWa4E1xyPRZShRm3cDjOR rBffmA0/iomOV5UEYVcCy867owqAHWju2U177Zq0pcF06KnRb9VvzrrdZ4/Lvx6AClXF VQ==
Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by aserp2130.oracle.com with ESMTP id 2qtupe1asd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 25 Feb 2019 22:40:49 +0000
Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by aserv0021.oracle.com (8.14.4/8.14.4) with ESMTP id x1PMemkt028549 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 25 Feb 2019 22:40:49 GMT
Received: from abhmp0020.oracle.com (abhmp0020.oracle.com [141.146.116.26]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id x1PMemeY006918; Mon, 25 Feb 2019 22:40:48 GMT
Received: from [192.168.1.22] (/70.70.142.148) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 25 Feb 2019 14:40:48 -0800
Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (1.0)
From: Phil Hunt <phil.hunt@oracle.com>
X-Mailer: iPhone Mail (16D57)
In-Reply-To: <CAKCnT7yUfhigZ4BZa0Aitnr7c_cG=84U7KP1UW8DtOjsnuJMfw@mail.gmail.com>
Date: Mon, 25 Feb 2019 14:40:46 -0800
Cc: scim@ietf.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <2910C863-6343-451C-934A-FA1CC6DE18B1@oracle.com>
References: <CAKCnT7w5-o7N=TdOLwLD+dWEMCOSzyuQYYpQBKtrZs+CMo22Rw@mail.gmail.com> <96DFFA94-CA40-44F3-9B6B-8267C1CEB069@oracle.com> <CAKCnT7yUfhigZ4BZa0Aitnr7c_cG=84U7KP1UW8DtOjsnuJMfw@mail.gmail.com>
To: Aleksey Chernoraenko <achernoraenko@gmail.com>
X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=9178 signatures=668685
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1902250158
Archived-At: <https://mailarchive.ietf.org/arch/msg/scim/KEDS06L3IVEgvuDZ6S0Qk4XA7Dk>
Subject: Re: [scim] How to patch multi-valued nested attributes?
X-BeenThere: scim@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Simple Cloud Identity Management BOF <scim.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/scim>, <mailto:scim-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/scim/>
List-Post: <mailto:scim@ietf.org>
List-Help: <mailto:scim-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/scim>, <mailto:scim-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 25 Feb 2019 22:40:53 -0000

No it would not be compliant  

Scim as a restful api can only impact one resource at a time. 

To enhnce would require a new draft. 

Phil

> On Feb 25, 2019, at 2:31 PM, Aleksey Chernoraenko <achernoraenko@gmail.com> wrote:
> 
> Thank you for response!
> 
>> On Mon, Feb 25, 2019 at 1:10 PM Phil Hunt <phil.hunt@oracle.com> wrote:
>> 
>> Unfortunately there is no mass-update style function in SCIM. PATCH only impacts one specific resource at a time. By design each transaction impacts only a single resource at a time. Even inside of “bulk” the transaction semantics a per resource.
>> 
>> You really have to do this in two or more steps.
>> 
>> 1. Query for a set of resources that need updating
>> 2. Apply the patch to each resource
>> 
>> For step 2, you can do as multiple calls for each resource, or be as a “bulk” request if supported by the provider.
>> 
> 
> This probably might be "worked around" as a PATCH request to groups
> endpoint with query parameters.
> It would be like a “bulk” request but in more declarative way, I guess.
> 
> PATCH /Groups?groupSet=98ae2a7c-40a5-4fff-b59a-5b922908239e
> {   ...
>    "operations": [ {
>        "op": "add", "path": "members", "value":
> "db81119f-5ee0-464e-b7e3-51573b62b56a"
>        } ]
> }
> 
> Would it be still SCIM compliant?
> 
> ---
> Alexei
> 
>>> 
>>> 
>>> On Feb 25, 2019, at 10:37 AM, Aleksey Chernoraenko <achernoraenko@gmail.com> wrote:
>>> 
>>> Hello,
>>> 
>>> In our SCIM Resource Provider we have resources that have the nested multi-valued attributes. It looks like this:
>>> GET /GroupSets/98ae2a7c-40a5-4fff-b59a-5b922908239e
>>> {    ...
>>>    "name": "collection #1",
>>>    "groups": [ {
>>>        "value": "a0115001-0fd7-4b50-b7b4-ac29d57cc623",
>>>        "$ref": ".../groups/a0115001-0fd7-4b50-b7b4-ac29d57cc623",
>>>        ...
>>>        }, ...
>>>    ], ...
>>> }
>>> 
>>> We use groups endpoint when we update group members, like
>>> PATCH /Groups/a0115001-0fd7-4b50-b7b4-ac29d57cc623
>>> {   ...
>>>    "operations": [ {
>>>        "op": "add", "path": "members", "value": "db81119f-5ee0-464e-b7e3-51573b62b56a"
>>>        } ]
>>> }
>>> 
>>> I understand how the request should look like if I want to update one group members via parent (groupset) endpoint:
>>> PATCH /GroupSets/98ae2a7c-40a5-4fff-b59a-5b922908239e
>>> {   ...
>>>    "operations": [ {
>>>        "op": "add", "path": "groups[value eq \"a0115001-0fd7-4b50-b7b4-ac29d57cc623\"].members", ...
>>>        } ]
>>> }
>>> 
>>> but wonder how I can specify "members" from all or a filtered set of "groups" without enumeration all of them on client side?
>>> 
>>> The path value might look like "groups[].members", or "groups[*].members", or even "groups.members".
>>> 
>>> It seems that the spec leaves this question open. What should or can happen if more than one group would be found?