[scim] Comments for draft-ietf-scim-cursor-pagination-04

["Nancy Cam-Winget (ncamwing)" <[e-mail]>]

Hi!

I’ve read version -04 of the Cursor Pagination draft and have the following feedback:

General comments
* I do not see any of the “should” as “SHOULD” though in some of the reading
 Perhaps there are instances in which they are perhaps requirements and should be capitalized.
Simli
* Section 2.4 “…method as-is will not impact”,  this statement implies that
   any implementation that adds cursor-based pagination support not impact
   existing clients but that is based on implementation, my recommendation
   is to make the “will” to a “should”.

* Section 4: in trying to be complete with the descriptions,
 It would be good to include descriptions of: what happens if the pagination
configuration omits the one of the two values e.g. “cursor” or “index”, should
That result in an error?  And obviously (but better to make explicit) that it
Is a misconfiguration to have both be false.  Lastly, the absence of this
Configuration setting means only index is supported.
What does it mean for both to be supported?  How could a client use
Both index and cursor pagination? Is it, that the cursor is “reset” from cursor
By the use of startIndex (for example?) or is the intent that a client only use
One or the other?

* Section 5: it would be good to mention that this draft is under the same
Security and privacy considerations of those described in RFC 7644.

* Section 5.1 is a nice overview, however guidance to this document’s affects
Should be described.  That is….I am not sure this document has in scope to
Provide guarantees of the authenticity nor the entitlements of the entities
Acting as either clients or Service Providers.  My suggestion is to either remove
This or provide a note that implementers but provide guards against source
Depletion or DOS attacks.

Section 5.2/5.3: why should this be different than what is called/described in RFC 7644?

Editorial Nits
* Section 2.1 “…other error condition” should read “….other error conditions”

Let me know if you have any questions on the above.  Otherwise, I would like to see
Another revision as well as feedback from Barry, Roni and Julien to ensure their comments
Are also addressed.

Thanks, Nancy