Re: [scim] Contributors needed for HR schema

Michael Ströder <michael@stroeder.com> Fri, 16 September 2022 11:25 UTC

Return-Path: <michael@stroeder.com>
X-Original-To: scim@ietfa.amsl.com
Delivered-To: scim@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6CDAFC15C507 for <scim@ietfa.amsl.com>; Fri, 16 Sep 2022 04:25:49 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.411
X-Spam-Level:
X-Spam-Status: No, score=-4.411 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, NICE_REPLY_A=-0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=stroeder.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8Q_bWIkrUDFf for <scim@ietfa.amsl.com>; Fri, 16 Sep 2022 04:25:44 -0700 (PDT)
Received: from srv1.stroeder.com (srv1.stroeder.com [213.240.180.113]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 76CEAC152589 for <scim@ietf.org>; Fri, 16 Sep 2022 04:25:43 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=stroeder.com; s=stroeder-com-20201114; t=1663327539; bh=xUdIlJleUVANUOtpQTFrQc9O8Zx7U31IFUH62SduSHY=; h=Date:Subject:To:References:From:In-Reply-To:From; b=tJlrqJR/rBh7LE0T5lw8LDVMFgUgA5wUap5exM/rkfL4L5zha4l3y8MaFvEGYJ688 yK+LEHdXnOuK2L+bkxvkKZwpvyAOO23MO00X+c92qXSBiMZNLut8Zt7pAvbfscU2l6 TW+aPwhLosrB1LI4ASy6W8XyveW9GmK2oQfd0qLJWzbGiAPNOhSvG+TgKGUDDJFQZB 0Im8jHk4LAfMo2/6n4ycmSdk6ojMdfscTY+oDZ5vCDHunDFj9T9kXKaJZku
Message-ID: <5503e6a3-d70f-bcd4-4250-5a8bf6829ea9@stroeder.com>
Date: Fri, 16 Sep 2022 13:25:39 +0200
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.2.2
Content-Language: en-US
To: "scim@ietf.org" <scim@ietf.org>
References: <MN2PR00MB0720A50B2E5EB355A07E5714FFAF9@MN2PR00MB0720.namprd00.prod.outlook.com> <76b2c137-9ae4-74ab-0482-80328a7db032@pdmconsulting.net> <MN2PR00MB0720CC2B7346ED47A504BC42FFB09@MN2PR00MB0720.namprd00.prod.outlook.com> <d4e9bdf7-8530-ad12-cced-892a5fd59307@pdmconsulting.net> <MN2PR00MB0720AD8F7BE8A39BD62AA190FF489@MN2PR00MB0720.namprd00.prod.outlook.com>
From: Michael Ströder <michael@stroeder.com>
In-Reply-To: <MN2PR00MB0720AD8F7BE8A39BD62AA190FF489@MN2PR00MB0720.namprd00.prod.outlook.com>
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: 8bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/scim/j-rxjae-t__fNTaC1CP89iVhUcE>
Subject: Re: [scim] Contributors needed for HR schema
X-BeenThere: scim@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Simple Cloud Identity Management BOF <scim.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/scim>, <mailto:scim-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/scim/>
List-Post: <mailto:scim@ietf.org>
List-Help: <mailto:scim-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/scim>, <mailto:scim-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 16 Sep 2022 11:25:49 -0000

Disclaimer: I don't consider myself a HR system expert.

On 9/16/22 06:54, Danny Zollner wrote:
> Creating a set of schemas for those that consume HR data would help
> with the problem of sending HR-related data to other systems
IMHO this is feasible.

> but doesn’t solve the problem I described.
You're aiming at defining a SCIM schema for exchanging full HR data 
between HR systems of different vendors? I'm pretty sure none of the 
vendors are interested in that.

> I took the name “Worker” from the implementations of some of the most 
> prominent HR systems. A worker is typically a higher-level 
> classification that represents full-time employees, contractors, 
> interns, and other types of workers.

This still sounds quite person-centric.

> The status of the employment is 
> defined in an attribute on the object.
 > [..]
> Specific to data security concerns regarding an HR schema, I think input 
> is needed from players in the HR/HCM industry on if it would be wise to 
> include extremely sensitive information such as salaries and social 
> security numbers in a worker resource.

While AFAIK social security numbers are assigned to natural persons 
other HR data is bound to contracts. And in a HR system a natural person 
can have multiple contracts. So you would also have to model that.

Coming from the IAM world I often consume HR data and the "person" 
objects I derive from that have attributes which indeed rather represent 
a contract (employee number, status, time-span). And then I bind the 
user accounts to these person contract objects.

Ciao, Michael.