[scim] Notes and action items from the 6/25 interest group call

[Darran Rolls <[e-mail]>]

Folks,
Thanks for attending last week’s call, here are the attendees, notes and action items.  At one point we had 23 folks on the line however I only managed to capture the attendees listed below.  If I missed your name or (more likely) mistyped its spelling,  please let me know.  By way of notes, rather than trying to capture individual comments, I have distilled a summary of the conversation instead, so if I missed anything you feel is important, please respond to this thread.
Attendees

  *   Karl McGuinness - Okta
  *   Matt Domsch - SailPoint
  *   Anthony Nadalin - Microsoft
  *   Jeremny Palenchar - Orcas Consulting
  *   Paul Logston - 15five
  *   Unni  Sarath - Staples
  *   Ryann Bradley - Okta
  *   Quint Daenen - Elimity
  *   Chris Harm — Penn State University
  *   Shawn Smith - Penn State University
  *   Brian Hanarhan - (not recorded)
  *   Paul Lantz – (not recorded)
  *   Matt Peterson - One Identity
  *   Kim McFinn - Microsoft
  *   Darin McAdmans - AWS
  *   Sam Rosin - Salesforce
  *   Phil Hunt - Independent Identity
  *   David Brossard - Salesforce
  *   Justin China- Forgerock
Summary of the Conversation

  *   There was good support for re chartering the WG, but recognition that most of the actual work would need to be done on the list beforehand.  In essence, re-chartering would be a post-work activity to ratify / formalize the resulting specification work rather than the other way around.
  *   There was lot of conversation around various operational improvements to the model and how to facilitate this new work without affecting existing implementations.  Overall the conversation leaned towards a “2.1” – an effort to deliver extensions and enhancements that would be backwards comparable.  It was duly noted that any normative change to the existing published RFC’s (outside of errata), would constitute a new draft regardless.
  *   There was good support for anything that would improve testing compliance and overall interoperability.  It was however duly noted that the IETF would likely not be the place to deliver any form of “test suite”.  That said, there was no real conclusion on where and how that would happen.
  *   There was agreement that a likely next step towards a charter would be to facilitate a SCIM BOF during IETF #108.  Attendance at this BOF would be critical in demonstrating support for re-opening the WG.
  *   As a next step, we agreed to catalog areas of potential work and try to understand who is interested to work on what.  Darran committed to start a separate list thread on “potential work items” and try to come up with a method of tracking that interest.
Action Items

  1.  Darran to reach out to the AD’s to confirm the approach (work then charter and formal WG, not the other way around) and report back to the list.
  2.  Darran to begin discussion with AD’s about holding a SCIM BOF at IETF #108 in July
  3.  Darran to start a separate thread to catalog the main buckets of work and facilitate a process such that we can gauge support for each.
Char Recording
11:22:30     From Anthony Nadalin (USA) : Here are some of my concerns
11:22:37     From Anthony Nadalin (USA) : 1.    SCIM becoming a directory protocol2.    Adding features that don’t have interoperability 3.    Bloating SCIM more that what it is already 4.    I have concerns over the Privileged management cases as there are security issues the we never took on in SCIM , like authentication
11:46:15     From Paul Logston - Principal Engineer - NYC : Agreed.
11:49:59     From Tim Cappalli : How do we generalize identity to handle users, devices, workloads, etc?
11:50:34     From Anthony Nadalin (USA) : That's a big change and a schema change
11:51:04     From Tim Cappalli : That specific example would be a 3.0 vs a 2.1
11:51:07     From Anthony Nadalin (USA) : the schema is extensible
11:55:09     From djob : I've seen SCIM as a means to query user data (similar to LDAP) so from that PoV it's not just provisioning
11:55:17     From djob : It's useful in XACML architectures
12:03:47     From Pamela Dingle : I'm really looking forward to the detailed notes here and next steps, and so glad we are moving forward!  I have to drop but very excited.
12:15:07     From Anthony Nadalin (USA) : suggest that folks looka at the SCIM drafts that have been published already
12:15:26     From Jeremy Palenchar - Orcas Consulting : Agreed Tony, II need to get up to speed on what's been done
12:16:58     From Matt : We can dramatically reduce the need for paging of multi-valued attributes by simply providing a collection that can be used instead of a multi-valued "members" attribute.  Querying group/role membership as a separate collection could make  lots or problems go away.   Not just for pagination of results, but for filtering the query.

Thanks
--
Darran Rolls
https://www.darranrolls.com
LinkedIn<https://www.linkedin.com/in/darran-rolls-068b84> @djrolls<https://twitter.com/djrolls>