Re: [scim] PATCH Multi-Valued Attribute Value Type

Phillip Hunt <> Thu, 01 October 2020 01:25 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 921F23A0412 for <>; Wed, 30 Sep 2020 18:25:34 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.894
X-Spam-Status: No, score=-1.894 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 7dmIVsWjOnyc for <>; Wed, 30 Sep 2020 18:25:32 -0700 (PDT)
Received: from ( [IPv6:2607:f8b0:4864:20::443]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 9B8193A0414 for <>; Wed, 30 Sep 2020 18:25:32 -0700 (PDT)
Received: by with SMTP id l126so2837877pfd.5 for <>; Wed, 30 Sep 2020 18:25:32 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20150623; h=content-transfer-encoding:from:mime-version:subject:date:message-id :references:cc:in-reply-to:to; bh=24IPwT7+h3wQsQMK6xk3iZO1F/muXVpBTl16qBzHqXI=; b=RMjp3BzGIBX4PwEHLEeo5jeTmJqb+kSEulnwCueNrYDpvi1AbuXt/vtYkJlcsgB/yZ 9bvwCrjrnKPhAF7D1TEHGI0Tc26KRCnR9vsOfnT12DJBeQc4CtHLhPo0/Ry830xg9HTA 3qwVW/qwyD6lA9Blkz6hKk3wNKkq7nIyl4NR1dDoSGRKlpvEnXvWsBrVDPplLPyOmlhr UYgxJkWRouSG6auXNWOdaOirZzg7PA9sIESqKnSxVLLjfm5oRSkgEb2x2IHK/gF5ejN1 SwVh9liB0OkPjeO659rX4fkMJzEtvXiQbgkd7rmaCM6CkdORbtikt4YoizS9Rn1wL5Gz VS9A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:content-transfer-encoding:from:mime-version :subject:date:message-id:references:cc:in-reply-to:to; bh=24IPwT7+h3wQsQMK6xk3iZO1F/muXVpBTl16qBzHqXI=; b=kcQlipgg1npc0pMa2TWBJViBur+7ff4xqO6+Ba3144GvxdL49Mi6bhkBVIWlMl13kQ CV74vd10e0sqdiqlwf65XtmdzaiwA5ivbDP8COiGjKnRKgFdb8JJBIc9PpZ5WG+Qgr+6 IOknOdl2pIvTW7ohl79yM4FVS0oTM5k6bdJs6e/wYq4FRRiEQ3de1sWeLTZQujQIIIeX X7CZoAaTlYMImX1eVSco9hL//ZLcHGCceqQ5+gnmkYT1LHQ3b4uy+UR6RHF4q6fgubMY xnuMs4DeNq7mD+BMDg0Whxpmv0X2v2m9gGCgR8wsgWpGZ8MKw+CfmUucrq9zFJAfeYSN NLKA==
X-Gm-Message-State: AOAM533ScPmRJ8uAVQfQZspmQG3hHzXon+GgeLucfJWWv0T2N7ZdDHkl IO0NB92ThNUyr/fy8MhEHuUWvw==
X-Google-Smtp-Source: ABdhPJxdZsvZ9/xoVF6xQZrmmyykMnYy4baugbhTE4f1Hri+e7YXiztosxDfkIKO0BgtDu64ltU/0A==
X-Received: by 2002:a62:5bc2:0:b029:13e:d13d:a130 with SMTP id p185-20020a625bc20000b029013ed13da130mr5062306pfb.24.1601515531828; Wed, 30 Sep 2020 18:25:31 -0700 (PDT)
Received: from ?IPv6:2001:569:79bc:100:c53e:4fa9:99d3:589e? ( [2001:569:79bc:100:c53e:4fa9:99d3:589e]) by with ESMTPSA id q16sm4276511pfj.117.2020. (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 30 Sep 2020 18:25:31 -0700 (PDT)
Content-Type: multipart/alternative; boundary="Apple-Mail-C662383D-1D09-47EF-8A64-B748BFD78E57"
Content-Transfer-Encoding: 7bit
From: Phillip Hunt <>
Mime-Version: 1.0 (1.0)
Date: Wed, 30 Sep 2020 18:25:30 -0700
Message-Id: <>
References: <>
Cc: Shelley <>, "" <>
In-Reply-To: <>
To: "McAdams, Darin" <>
X-Mailer: iPhone Mail (17H35)
Archived-At: <>
Subject: Re: [scim] PATCH Multi-Valued Attribute Value Type
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Simple Cloud Identity Management BOF <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 01 Oct 2020 01:25:35 -0000

If the path is a simple attribute than the patch value is the actual simple assignment. 

If the path is a complex attribute than Patch value is the set of attributes that constitute a value. 

CMVA then follows that value is an array unless a [value path filter] was specified.

The idea is that path can be either fine-grained or point to a whole object much like in the json patch spec. The big difference is scim uses a filter for multivalue arrays over indexing.  Thus value of “value” depends on what path points to. 


> On Sep 30, 2020, at 3:39 PM, McAdams, Darin <> wrote:
> I’m curious as well. We are proposing a SCIM interop profile in FastFed and now I’m hoping we got it right!
> From: scim <> on behalf of Shelley <>
> Date: Wednesday, September 30, 2020 at 2:23 PM
> To: "" <>
> Subject: [EXTERNAL] [scim] PATCH Multi-Valued Attribute Value Type
> For "add" and "replace" PATCH operations that specify multi-valued attributes, is the content of the "value" attribute supposed to be an array containing the new/replaced element(s) or a single JSON object containing the new/replaced element? The RFC seems to contain examples for both, and I would like to better understand the difference.
> Add Operation "Value" Type for Multi-Valued Attributes
> There is an "add" example on page 37 which specifies an array for a multi-valued attribute:
> {
>   "op": "add",
>   "path": "members",
>   "value": [{
>     "display": "Babs Jensen",
>     "$ref": "",
>     "value": "2819c223-7f76-453a-919d-413861904646"
>   }]
> }
> The description of "add", however, indicates that it contains "a "value" member whose content specifies the value to be added." In the case of "add", the value being added is the individual element, not an array.
> Also, the "add" description indicates that the "value MAY be a quoted value, or it may be a JSON object containing the sub-attributes" but does not seem to allow arrays (nor JSON literals, such as booleans or numbers, which is a separate question...).
> Is the description or the example incorrect? Should the operation "value" here be a JSON object or an array?
> Replace Operation "Value" Type for Multi-Valued Attributes
> For "replace", there is an example on page 44 that specifies an array for the "value" of a multi-valued attribute:
> {
>   "op": "replace",
>   "path": "members",
>   "value": [{
>       "display": "Babs Jensen",
>       "$ref": "",
>       "value": "2819c223...413861904646"
>     },
>     {
>       "display": "James Smith",
>       "$ref": "",
>       "value": "08e1d05d...473d93df9210"
>     }
>   ]
> }
> However, there is also a "replace" example on page 45 that specifies an object (not an array) for the "value" of a multi-valued attribute:
> {
>   "op": "replace",
>   "path": "addresses[type eq \"work\"]",
>   "value": {
>     "type": "work",
>     "streetAddress": "911 Universal City Plaza",
>     "locality": "Hollywood",
>     "region": "CA",
>     "postalCode": "91608",
>     "country": "US",
>     "formatted": "911 Universal City Plaza\nHollywood, CA 91608 US",
>     "primary": true
>   }
> }
> The use of the array for "replace" on "members" seems appropriate since it is replacing the entire attribute with one or more values. For the "addresses" value path, it's a little less clear to me. The use of an object seems to imply that even if multiple addresses are matched by the filter, only one new element may be specified to take it's/their place. Can someone provide clarification on when to use array vs. object here?
> Thank you!
> _______________________________________________
> scim mailing list