Re: [scim] Contributors needed for HR schema

Michael Ströder <> Fri, 16 September 2022 11:25 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 6CDAFC15C507 for <>; Fri, 16 Sep 2022 04:25:49 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -4.411
X-Spam-Status: No, score=-4.411 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, NICE_REPLY_A=-0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1536-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 8Q_bWIkrUDFf for <>; Fri, 16 Sep 2022 04:25:44 -0700 (PDT)
Received: from ( []) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by (Postfix) with ESMTPS id 76CEAC152589 for <>; Fri, 16 Sep 2022 04:25:43 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;; s=stroeder-com-20201114; t=1663327539; bh=xUdIlJleUVANUOtpQTFrQc9O8Zx7U31IFUH62SduSHY=; h=Date:Subject:To:References:From:In-Reply-To:From; b=tJlrqJR/rBh7LE0T5lw8LDVMFgUgA5wUap5exM/rkfL4L5zha4l3y8MaFvEGYJ688 yK+LEHdXnOuK2L+bkxvkKZwpvyAOO23MO00X+c92qXSBiMZNLut8Zt7pAvbfscU2l6 TW+aPwhLosrB1LI4ASy6W8XyveW9GmK2oQfd0qLJWzbGiAPNOhSvG+TgKGUDDJFQZB 0Im8jHk4LAfMo2/6n4ycmSdk6ojMdfscTY+oDZ5vCDHunDFj9T9kXKaJZku
Message-ID: <>
Date: Fri, 16 Sep 2022 13:25:39 +0200
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.2.2
Content-Language: en-US
To: "" <>
References: <> <> <> <> <>
From: Michael Ströder <>
In-Reply-To: <>
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: 8bit
Archived-At: <>
Subject: Re: [scim] Contributors needed for HR schema
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Simple Cloud Identity Management BOF <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 16 Sep 2022 11:25:49 -0000

Disclaimer: I don't consider myself a HR system expert.

On 9/16/22 06:54, Danny Zollner wrote:
> Creating a set of schemas for those that consume HR data would help
> with the problem of sending HR-related data to other systems
IMHO this is feasible.

> but doesn’t solve the problem I described.
You're aiming at defining a SCIM schema for exchanging full HR data 
between HR systems of different vendors? I'm pretty sure none of the 
vendors are interested in that.

> I took the name “Worker” from the implementations of some of the most 
> prominent HR systems. A worker is typically a higher-level 
> classification that represents full-time employees, contractors, 
> interns, and other types of workers.

This still sounds quite person-centric.

> The status of the employment is 
> defined in an attribute on the object.
 > [..]
> Specific to data security concerns regarding an HR schema, I think input 
> is needed from players in the HR/HCM industry on if it would be wise to 
> include extremely sensitive information such as salaries and social 
> security numbers in a worker resource.

While AFAIK social security numbers are assigned to natural persons 
other HR data is bound to contracts. And in a HR system a natural person 
can have multiple contracts. So you would also have to model that.

Coming from the IAM world I often consume HR data and the "person" 
objects I derive from that have attributes which indeed rather represent 
a contract (employee number, status, time-span). And then I bind the 
user accounts to these person contract objects.

Ciao, Michael.