[scim] Re: [Technical Errata Reported] RFC7643 (8450)

[Phil Hunt <[e-mail]>]

VERIFIED. 

Phil Hunt
[e-mail]



> On Jun 5, 2025, at 8:10 AM, RFC Errata System <[e-mail]> wrote:
> 
> The following errata report has been submitted for RFC7643,
> "System for Cross-domain Identity Management: Core Schema".
> 
> --------------------------------------
> You may review the report below and at:
> https://www.rfc-editor.org/errata/eid8450
> 
> --------------------------------------
> Type: Technical
> Reported by: Guillaume Winter <[e-mail]>
> 
> Section: 4.1.1.
> 
> Original Text
> -------------
> password
>      This attribute is intended to be used as a means to set, replace,
>      or compare (i.e., filter for equality) a password.  The cleartext
>      value or the hashed value of a password SHALL NOT be returnable by
>      a service provider.  If a service provider holds the value
>      locally, the value SHOULD be hashed.  When a password is set or
>      changed by the client, the cleartext password SHOULD be processed
>      by the service provider as follows:
> 
>      *  Prepare the cleartext value for international language
>         comparison.  See Section 7.8 of [RFC7644].
> 
>      *  Validate the value against server password policy.  Note: The
>         definition and enforcement of password policy are beyond the
>         scope of this document.
> 
>      *  Ensure that the value is encrypted (e.g., hashed).  See
>         Section 9.2 for acceptable hashing and encryption handling when
>         storing or persisting for provisioning workflow reasons.
> 
> Corrected Text
> --------------
> password
>      This attribute is intended to be used as a means to set, replace,
>      or compare (i.e., filter for equality) a password.  The cleartext
>      value or the hashed value of a password SHALL NOT be returnable by
>      a service provider.  If a service provider holds the value
>      locally, the value SHOULD be hashed.  When a password is set or
>      changed by the client, the cleartext password SHOULD be processed
>      by the service provider as follows:
> 
>      *  Prepare the cleartext value for international language
>         comparison.  See Section 7.8 of [RFC7644].
> 
>      *  Validate the value against server password policy.  Note: The
>         definition and enforcement of password policy are beyond the
>         scope of this document.
> 
>      *  Ensure that the value is hashed or encrypted.  See
>         Section 9.2 for acceptable hashing and encryption handling when
>         storing or persisting for provisioning workflow reasons.
> 
> Notes
> -----
> it was confusing that the text stated encrypted (e.g., hashed) .
> 
> Instructions:
> -------------
> This erratum is currently posted as "Reported". (If it is spam, it 
> will be removed shortly by the RFC Production Center.) Please
> use "Reply All" to discuss whether it should be verified or
> rejected. When a decision is reached, the verifying party  
> will log in to change the status and edit the report, if necessary.
> 
> --------------------------------------
> RFC7643 (draft-ietf-scim-core-schema-22)
> --------------------------------------
> Title               : System for Cross-domain Identity Management: Core Schema
> Publication Date    : September 2015
> Author(s)           : P. Hunt, Ed., K. Grizzle, E. Wahlstroem, C. Mortimore
> Category            : PROPOSED STANDARD
> Source              : System for Cross-domain Identity Management
> Stream              : IETF
> Verifying Party     : IESG