[scim] Fwd: Escape search filter values

[Mark Dobrinic <[e-mail]>]

Hi guys,

have posted this question a month ago and didn't get a follow up.
Anybody has thoughts on it?

Thanks,

Mark


-------- Forwarded Message --------
Subject: 	Escape search filter values
Date: 	Wed, 3 Oct 2018 17:37:07 +0200
From: 	Mark Dobrinic <[e-mail]>
To: 	[e-mail]



Hi scim,

I've got a question on how to escape values that are part of the search
filter query in scim 2.

For example, when sending out a search request for a user with a
password, we're posting a JSON-message like this to our SCIM server:

{
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:SearchRequest"
    ],
    "filter": "userName eq \"teddie\" and password eq "\secret\""
}

But when the password contains control characters, like a double-quote
(") or backslash (\), what should we send to the other end?

For now, we've been following the JSON approach, and are JSON-escaping
the values inside the filter, such that when the password would be
'sec"ret', the JSON-message as it would be sent over becomes:

{
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:SearchRequest"
    ],
    "filter": "userName eq \"teddie\" and password eq "\sec\\\"ret\""
}

... but I could not find out how to deal with this in the spec.

What do you think is the right thing to do here?


-- 
Regards,

Mark Dobrinic
Software Engineer and Identity Specialist
Curity AB

[e-mail]
www.curity.io