Re: [scim] [EXTERNAL] Re: Feedback and adoption readiness for draft-zollner-scim-roles-entitlements-extension

Thanks for all the work you've done on this draft, Danny! Agree with all of
the `id` commentary in the thread but I think that's been sufficiently
discussed. I did have a few more thoughts to include.

- Taking point 1 of Brian's message a step further, are the `roles` and
`entitlements` attributes the only valid way to communicate
entitlements/access-controlling information? What if we had a common schema
and each implementation could surface that data in whichever attribute
makes the most sense. One application could expose `roles` and
`entitlements` while another might expose `userTypes` and `licenses`.

- Another use-case I've seen in the wild that we may want to support is
distinguishing between entitlement attributes where you can select any
combination of the allowed values (similar to the examples in the draft)
and entitlement attributes where only one of the allowed values may be
chosen at a time. This could allow an identity management product acting as
a SCIM server to make an informed choice to expose a dropdown/radio button
or multi-select as needed in admin interfaces.

On Tue, Nov 8, 2022 at 4:57 PM Brian Demers <brian.demers@gmail.com> wrote:

> *This message originated outside your organization.*
>
> ------------------------------
>
> This caught my eye because Chad mentioned Apache SCIMple, so I took a
> quick pass at hacking up what this would look like in SCIMple.
>
> That generated a few questions, forgive me if these were already covered
> somewhere else:
>
> 1. The Role and Entitlement schemas look identical, except for minor
> changes in the descriptions.  Should both these new resources make use of a
> common schema?
> 2. Section 4.1 calls out a ServiceProviderConfig Extension.  I didn't see
> anything in rfc7643 on how this would work.  Would this be a new 3rd schema
> that is added to the ServiceProviderConfig response? Or is this
> mechanism defined somewhere else?
> 3. Each Role/Entitlement can have an id, value, display, and type.
>   a. What is the difference between `type` and `value`?
>   b. While I probably agree `display` _should_ be unique to the "server",
> is this an actual requirement?  I could potentially see attributes "value"
> and "display" being mapped to some implementation's "name" and
> "description" (respectively), where "description" _may_ not have a unique
> requirement.
> 4. nit: the schema names should use a singular form of the nouns (to be
> consistent with the Core Schemas),
> i.e. urn:ietf:params:scim:schemas:2.0:Entitlement
> and urn:ietf:params:scim:schemas:2.0:Role
>  - Potentially starting with `urn:ietf:params:scim:schemas:extension:` to
> use similar naming pattern as the EnterpriseUser schema (though this
> doesn't seem required rfc7643 section 10)
>
> Thanks!
> -Brian
>
> On Thu, Nov 3, 2022 at 5:32 PM Danny Zollner <Danny.Zollner=
> 40microsoft.com@dmarc.ietf.org> wrote:
>
>> Hi Chad,
>>
>>
>>
>> I recall receiving this same feedback previously and in the next version
>> of the draft (perhaps the first new version post-adoption?) language will
>> be added to explicitly call out the use of common attributes. If I were to
>> split hairs here, I’d argue that even without the draft explicitly calling
>> them out, the text in 7643 3.1 states that those attributes are required to
>> exist on all resource types including new extensions like the ones in this
>> draft. It is a mistake to not explicitly call out the correct usage of
>> those attributes in this draft, though, so it will be fixed.
>>
>>
>>
>> Thanks,
>>
>>
>>
>> *Danny Zollner* (He/Him)
>>
>> *From:* scim <scim-bounces@ietf.org> *On Behalf Of * Chad Vincent
>> *Sent:* Thursday, November 3, 2022 4:09 PM
>> *To:* scim@ietf.org
>> *Subject:* [EXTERNAL] Re: [scim] Feedback and adoption readiness for
>> draft-zollner-scim-roles-entitlements-extension
>>
>>
>>
>> Some people who received this message don't often get email from
>> chad.vincent@crashplan.com. Learn why this is important
>> <https://urldefense.com/v3/__https://aka.ms/LearnAboutSenderIdentification__;!!PwKahg!4fVL2tBJsHfvqmDAANszvEPWLT6MSB_iyOqOQfgBBQf7OnK_3OheLzF8Sv6_yH2lpJFQanuOzg6PDGZnsrPtPA$>
>>
>> I love this - we use roles currently and having a more formal spec and
>> ability for the client to read what's available could come in very handy in
>> the future.  So mark me down as a 5.
>>
>>
>>
>> However, these resources not including the common attributes set mandated
>> by RFC 7643 section 3.1 should be explained/clarified in the RFC.  The
>> Apache SCIMple library will have to handle these resources as special-cases
>> since they won't have the required "id" field, for example.  That seems
>> major enough to justify a paragraph.
>>
>>
>>
>> ---------- Forwarded message ----------
>> From: "Nancy Cam-Winget (ncamwing)" <ncamwing@cisco.com>
>> To: SCIM WG <scim@ietf.org>
>> Cc:
>> Bcc:
>> Date: Wed, 2 Nov 2022 23:40:10 +0000
>> Subject: [scim] Feedback and adoption readiness for
>> draft-zollner-scim-roles-entitlements-extension
>>
>> Hello SCIMers,
>>
>>
>>
>> We need feedback on to gauge support and adoption readiness of:
>>
>> https://datatracker.ietf.org/doc/draft-zollner-scim-roles-entitlements-extension/ <https://urldefense.com/v3/__https://nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Fdatatracker.ietf.org*2Fdoc*2Fdraft-zollner-scim-roles-entitlements-extension*2F&data=05*7C01*7Cdanny.zollner*40microsoft.com*7Ca11aede3fdb54846b08b08dabddfa397*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C638031065521821498*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*7C*7C*7C&sdata=rh2rD2ai4JphkRpxltG1sVgpXPy5ZuOs8xr4FSmvAl0*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJQ!!PwKahg!4fVL2tBJsHfvqmDAANszvEPWLT6MSB_iyOqOQfgBBQf7OnK_3OheLzF8Sv6_yH2lpJFQanuOzg6PDGaYKAbNXQ$>
>>
>> Please respond to this thread on the following:
>>
>>
>>
>>
>>
>>   1.  You have read the draft and believe it is ready to be adopted by the working group. Any other feedback on the content of the draft is welcomed too.
>>
>>   2.  You are willing to be an active contributor or reviewer of the document
>>
>>   4.  You support the draft and plan to implement
>>
>>   5.  You support the draft but have no time or plans to implement now, but can provide feedback
>>
>>   6.  You have no interest in the draft
>>
>>
>>
>> Please provide your feedback by November 28th.
>>
>>
>>
>> Thanks,
>>
>>    Nancy
>>
>>
>>
>>
>>
>>
>> ---------- Forwarded message ----------
>> From: Paul Lanzi <paul@remediant.com>
>> To: SCIM WG <scim@ietf.org>
>> Cc:
>> Bcc:
>> Date: Wed, 2 Nov 2022 16:50:26 -0700
>> Subject: Re: [scim] Feedback and adoption readiness for
>> draft-zollner-scim-roles-entitlements-extension
>>
>> #4 for me.
>>
>> Thanks,
>>
>> --Paul
>>
>> ᐧ
>>
>>
>>
>> On Wed, Nov 2, 2022 at 4:40 PM Nancy Cam-Winget (ncamwing) <ncamwing=
>> 40cisco.com@dmarc.ietf.org> wrote:
>>
>> Hello SCIMers,
>>
>>
>>
>> We need feedback on to gauge support and adoption readiness of:
>>
>> https://datatracker.ietf.org/doc/draft-zollner-scim-roles-entitlements-extension/ <https://urldefense.com/v3/__https://nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Fdatatracker.ietf.org*2Fdoc*2Fdraft-zollner-scim-roles-entitlements-extension*2F&data=05*7C01*7Cdanny.zollner*40microsoft.com*7Ca11aede3fdb54846b08b08dabddfa397*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C638031065521821498*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*7C*7C*7C&sdata=rh2rD2ai4JphkRpxltG1sVgpXPy5ZuOs8xr4FSmvAl0*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJQ!!PwKahg!4fVL2tBJsHfvqmDAANszvEPWLT6MSB_iyOqOQfgBBQf7OnK_3OheLzF8Sv6_yH2lpJFQanuOzg6PDGaYKAbNXQ$>
>>
>> Please respond to this thread on the following:
>>
>>
>>
>>
>>
>>   1.  You have read the draft and believe it is ready to be adopted by the working group. Any other feedback on the content of the draft is welcomed too.
>>
>>   2.  You are willing to be an active contributor or reviewer of the document
>>
>>   4.  You support the draft and plan to implement
>>
>>   5.  You support the draft but have no time or plans to implement now, but can provide feedback
>>
>>   6.  You have no interest in the draft
>>
>>
>>
>> Please provide your feedback by November 28th.
>>
>>
>>
>> Thanks,
>>
>>    Nancy
>>
>>
>>
>> _______________________________________________
>> scim mailing list
>> scim@ietf.org
>> https://www.ietf.org/mailman/listinfo/scim
>> <https://urldefense.com/v3/__https://nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Fwww.ietf.org*2Fmailman*2Flistinfo*2Fscim&data=05*7C01*7Cdanny.zollner*40microsoft.com*7Ca11aede3fdb54846b08b08dabddfa397*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C638031065521821498*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*7C*7C*7C&sdata=4otD1jdaBdQwRKUTMXObgdBmvi*2Fb2dAOQ3n7Zr1HkA0*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSU!!PwKahg!4fVL2tBJsHfvqmDAANszvEPWLT6MSB_iyOqOQfgBBQf7OnK_3OheLzF8Sv6_yH2lpJFQanuOzg6PDGbaaRzFnw$>
>>
>> _______________________________________________
>> scim mailing list
>> scim@ietf.org
>> https://www.ietf.org/mailman/listinfo/scim
>> <https://urldefense.com/v3/__https://nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Fwww.ietf.org*2Fmailman*2Flistinfo*2Fscim&data=05*7C01*7Cdanny.zollner*40microsoft.com*7Ca11aede3fdb54846b08b08dabddfa397*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C638031065521821498*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*7C*7C*7C&sdata=4otD1jdaBdQwRKUTMXObgdBmvi*2Fb2dAOQ3n7Zr1HkA0*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSU!!PwKahg!4fVL2tBJsHfvqmDAANszvEPWLT6MSB_iyOqOQfgBBQf7OnK_3OheLzF8Sv6_yH2lpJFQanuOzg6PDGbaaRzFnw$>
>>
>>
>>
>>
>> --
>>
>> Chad Vincent (he/him) | Software Engineer, Senior - CrashPlan
>>
>> chad.vincent@crashplan.com
>>
>> 400 S 4th St Suite 410 PMB 31083 Minneapolis, MN 55415-1419
>>
>>
>>
>>
>> <https://urldefense.com/v3/__https://nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Fcrashplan.com*2F&data=05*7C01*7Cdanny.zollner*40microsoft.com*7Ca11aede3fdb54846b08b08dabddfa397*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C638031065521821498*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*7C*7C*7C&sdata=5WxnnaHSXPH1DLp87goymJj9*2Flo*2BxVQlUsCUw*2FNJK2s*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSU!!PwKahg!4fVL2tBJsHfvqmDAANszvEPWLT6MSB_iyOqOQfgBBQf7OnK_3OheLzF8Sv6_yH2lpJFQanuOzg6PDGbLCTzl6w$>
>>
>>
>> _______________________________________________
>> scim mailing list
>> scim@ietf.org
>> https://www.ietf.org/mailman/listinfo/scim
>> <https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/scim__;!!PwKahg!4fVL2tBJsHfvqmDAANszvEPWLT6MSB_iyOqOQfgBBQf7OnK_3OheLzF8Sv6_yH2lpJFQanuOzg6PDGbxopDeqA$>
>>
> _______________________________________________
> scim mailing list
> scim@ietf.org
> https://www.ietf.org/mailman/listinfo/scim
>