Re: [scim] [EXTERNAL] Re: Feedback and adoption readiness for draft-zollner-scim-roles-entitlements-extension

Correcting myself - I managed to miss the `multiple*Supported` attributes
in the entitlements/roles schema, so my second note is already covered.

On Tue, Jan 17, 2023 at 11:25 AM Connor Rowe <connor.rowe@okta.com> wrote:

> Thanks for all the work you've done on this draft, Danny! Agree with all
> of the `id` commentary in the thread but I think that's been sufficiently
> discussed. I did have a few more thoughts to include.
>
> - Taking point 1 of Brian's message a step further, are the `roles` and
> `entitlements` attributes the only valid way to communicate
> entitlements/access-controlling information? What if we had a common schema
> and each implementation could surface that data in whichever attribute
> makes the most sense. One application could expose `roles` and
> `entitlements` while another might expose `userTypes` and `licenses`.
>
> - Another use-case I've seen in the wild that we may want to support is
> distinguishing between entitlement attributes where you can select any
> combination of the allowed values (similar to the examples in the draft)
> and entitlement attributes where only one of the allowed values may be
> chosen at a time. This could allow an identity management product acting as
> a SCIM server to make an informed choice to expose a dropdown/radio button
> or multi-select as needed in admin interfaces.
>
> On Tue, Nov 8, 2022 at 4:57 PM Brian Demers <brian.demers@gmail.com>
> wrote:
>
>> *This message originated outside your organization.*
>>
>> ------------------------------
>>
>> This caught my eye because Chad mentioned Apache SCIMple, so I took a
>> quick pass at hacking up what this would look like in SCIMple.
>>
>> That generated a few questions, forgive me if these were already covered
>> somewhere else:
>>
>> 1. The Role and Entitlement schemas look identical, except for minor
>> changes in the descriptions.  Should both these new resources make use of a
>> common schema?
>> 2. Section 4.1 calls out a ServiceProviderConfig Extension.  I didn't see
>> anything in rfc7643 on how this would work.  Would this be a new 3rd schema
>> that is added to the ServiceProviderConfig response? Or is this
>> mechanism defined somewhere else?
>> 3. Each Role/Entitlement can have an id, value, display, and type.
>>   a. What is the difference between `type` and `value`?
>>   b. While I probably agree `display` _should_ be unique to the "server",
>> is this an actual requirement?  I could potentially see attributes "value"
>> and "display" being mapped to some implementation's "name" and
>> "description" (respectively), where "description" _may_ not have a unique
>> requirement.
>> 4. nit: the schema names should use a singular form of the nouns (to be
>> consistent with the Core Schemas),
>> i.e. urn:ietf:params:scim:schemas:2.0:Entitlement
>> and urn:ietf:params:scim:schemas:2.0:Role
>>  - Potentially starting with `urn:ietf:params:scim:schemas:extension:`
>> to use similar naming pattern as the EnterpriseUser schema (though this
>> doesn't seem required rfc7643 section 10)
>>
>> Thanks!
>> -Brian
>>
>> On Thu, Nov 3, 2022 at 5:32 PM Danny Zollner <Danny.Zollner=
>> 40microsoft.com@dmarc.ietf.org> wrote:
>>
>>> Hi Chad,
>>>
>>>
>>>
>>> I recall receiving this same feedback previously and in the next version
>>> of the draft (perhaps the first new version post-adoption?) language will
>>> be added to explicitly call out the use of common attributes. If I were to
>>> split hairs here, I’d argue that even without the draft explicitly calling
>>> them out, the text in 7643 3.1 states that those attributes are required to
>>> exist on all resource types including new extensions like the ones in this
>>> draft. It is a mistake to not explicitly call out the correct usage of
>>> those attributes in this draft, though, so it will be fixed.
>>>
>>>
>>>
>>> Thanks,
>>>
>>>
>>>
>>> *Danny Zollner* (He/Him)
>>>
>>> *From:* scim <scim-bounces@ietf.org> *On Behalf Of * Chad Vincent
>>> *Sent:* Thursday, November 3, 2022 4:09 PM
>>> *To:* scim@ietf.org
>>> *Subject:* [EXTERNAL] Re: [scim] Feedback and adoption readiness for
>>> draft-zollner-scim-roles-entitlements-extension
>>>
>>>
>>>
>>> Some people who received this message don't often get email from
>>> chad.vincent@crashplan.com. Learn why this is important
>>> <https://urldefense.com/v3/__https://aka.ms/LearnAboutSenderIdentification__;!!PwKahg!4fVL2tBJsHfvqmDAANszvEPWLT6MSB_iyOqOQfgBBQf7OnK_3OheLzF8Sv6_yH2lpJFQanuOzg6PDGZnsrPtPA$>
>>>
>>> I love this - we use roles currently and having a more formal spec and
>>> ability for the client to read what's available could come in very handy in
>>> the future.  So mark me down as a 5.
>>>
>>>
>>>
>>> However, these resources not including the common attributes set
>>> mandated by RFC 7643 section 3.1 should be explained/clarified in the RFC.
>>> The Apache SCIMple library will have to handle these resources as
>>> special-cases since they won't have the required "id" field, for example.
>>> That seems major enough to justify a paragraph.
>>>
>>>
>>>
>>> ---------- Forwarded message ----------
>>> From: "Nancy Cam-Winget (ncamwing)" <ncamwing@cisco.com>
>>> To: SCIM WG <scim@ietf.org>
>>> Cc:
>>> Bcc:
>>> Date: Wed, 2 Nov 2022 23:40:10 +0000
>>> Subject: [scim] Feedback and adoption readiness for
>>> draft-zollner-scim-roles-entitlements-extension
>>>
>>> Hello SCIMers,
>>>
>>>
>>>
>>> We need feedback on to gauge support and adoption readiness of:
>>>
>>> https://datatracker.ietf.org/doc/draft-zollner-scim-roles-entitlements-extension/ <https://urldefense.com/v3/__https://nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Fdatatracker.ietf.org*2Fdoc*2Fdraft-zollner-scim-roles-entitlements-extension*2F&data=05*7C01*7Cdanny.zollner*40microsoft.com*7Ca11aede3fdb54846b08b08dabddfa397*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C638031065521821498*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*7C*7C*7C&sdata=rh2rD2ai4JphkRpxltG1sVgpXPy5ZuOs8xr4FSmvAl0*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJQ!!PwKahg!4fVL2tBJsHfvqmDAANszvEPWLT6MSB_iyOqOQfgBBQf7OnK_3OheLzF8Sv6_yH2lpJFQanuOzg6PDGaYKAbNXQ$>
>>>
>>> Please respond to this thread on the following:
>>>
>>>
>>>
>>>
>>>
>>>   1.  You have read the draft and believe it is ready to be adopted by the working group. Any other feedback on the content of the draft is welcomed too.
>>>
>>>   2.  You are willing to be an active contributor or reviewer of the document
>>>
>>>   4.  You support the draft and plan to implement
>>>
>>>   5.  You support the draft but have no time or plans to implement now, but can provide feedback
>>>
>>>   6.  You have no interest in the draft
>>>
>>>
>>>
>>> Please provide your feedback by November 28th.
>>>
>>>
>>>
>>> Thanks,
>>>
>>>    Nancy
>>>
>>>
>>>
>>>
>>>
>>>
>>> ---------- Forwarded message ----------
>>> From: Paul Lanzi <paul@remediant.com>
>>> To: SCIM WG <scim@ietf.org>
>>> Cc:
>>> Bcc:
>>> Date: Wed, 2 Nov 2022 16:50:26 -0700
>>> Subject: Re: [scim] Feedback and adoption readiness for
>>> draft-zollner-scim-roles-entitlements-extension
>>>
>>> #4 for me.
>>>
>>> Thanks,
>>>
>>> --Paul
>>>
>>> ᐧ
>>>
>>>
>>>
>>> On Wed, Nov 2, 2022 at 4:40 PM Nancy Cam-Winget (ncamwing) <ncamwing=
>>> 40cisco.com@dmarc.ietf.org> wrote:
>>>
>>> Hello SCIMers,
>>>
>>>
>>>
>>> We need feedback on to gauge support and adoption readiness of:
>>>
>>> https://datatracker.ietf.org/doc/draft-zollner-scim-roles-entitlements-extension/ <https://urldefense.com/v3/__https://nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Fdatatracker.ietf.org*2Fdoc*2Fdraft-zollner-scim-roles-entitlements-extension*2F&data=05*7C01*7Cdanny.zollner*40microsoft.com*7Ca11aede3fdb54846b08b08dabddfa397*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C638031065521821498*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*7C*7C*7C&sdata=rh2rD2ai4JphkRpxltG1sVgpXPy5ZuOs8xr4FSmvAl0*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJQ!!PwKahg!4fVL2tBJsHfvqmDAANszvEPWLT6MSB_iyOqOQfgBBQf7OnK_3OheLzF8Sv6_yH2lpJFQanuOzg6PDGaYKAbNXQ$>
>>>
>>> Please respond to this thread on the following:
>>>
>>>
>>>
>>>
>>>
>>>   1.  You have read the draft and believe it is ready to be adopted by the working group. Any other feedback on the content of the draft is welcomed too.
>>>
>>>   2.  You are willing to be an active contributor or reviewer of the document
>>>
>>>   4.  You support the draft and plan to implement
>>>
>>>   5.  You support the draft but have no time or plans to implement now, but can provide feedback
>>>
>>>   6.  You have no interest in the draft
>>>
>>>
>>>
>>> Please provide your feedback by November 28th.
>>>
>>>
>>>
>>> Thanks,
>>>
>>>    Nancy
>>>
>>>
>>>
>>> _______________________________________________
>>> scim mailing list
>>> scim@ietf.org
>>> https://www.ietf.org/mailman/listinfo/scim
>>> <https://urldefense.com/v3/__https://nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Fwww.ietf.org*2Fmailman*2Flistinfo*2Fscim&data=05*7C01*7Cdanny.zollner*40microsoft.com*7Ca11aede3fdb54846b08b08dabddfa397*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C638031065521821498*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*7C*7C*7C&sdata=4otD1jdaBdQwRKUTMXObgdBmvi*2Fb2dAOQ3n7Zr1HkA0*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSU!!PwKahg!4fVL2tBJsHfvqmDAANszvEPWLT6MSB_iyOqOQfgBBQf7OnK_3OheLzF8Sv6_yH2lpJFQanuOzg6PDGbaaRzFnw$>
>>>
>>> _______________________________________________
>>> scim mailing list
>>> scim@ietf.org
>>> https://www.ietf.org/mailman/listinfo/scim
>>> <https://urldefense.com/v3/__https://nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Fwww.ietf.org*2Fmailman*2Flistinfo*2Fscim&data=05*7C01*7Cdanny.zollner*40microsoft.com*7Ca11aede3fdb54846b08b08dabddfa397*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C638031065521821498*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*7C*7C*7C&sdata=4otD1jdaBdQwRKUTMXObgdBmvi*2Fb2dAOQ3n7Zr1HkA0*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSU!!PwKahg!4fVL2tBJsHfvqmDAANszvEPWLT6MSB_iyOqOQfgBBQf7OnK_3OheLzF8Sv6_yH2lpJFQanuOzg6PDGbaaRzFnw$>
>>>
>>>
>>>
>>>
>>> --
>>>
>>> Chad Vincent (he/him) | Software Engineer, Senior - CrashPlan
>>>
>>> chad.vincent@crashplan.com
>>>
>>> 400 S 4th St Suite 410 PMB 31083 Minneapolis, MN 55415-1419
>>>
>>>
>>>
>>>
>>> <https://urldefense.com/v3/__https://nam06.safelinks.protection.outlook.com/?url=https*3A*2F*2Fcrashplan.com*2F&data=05*7C01*7Cdanny.zollner*40microsoft.com*7Ca11aede3fdb54846b08b08dabddfa397*7C72f988bf86f141af91ab2d7cd011db47*7C1*7C0*7C638031065521821498*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000*7C*7C*7C&sdata=5WxnnaHSXPH1DLp87goymJj9*2Flo*2BxVQlUsCUw*2FNJK2s*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSU!!PwKahg!4fVL2tBJsHfvqmDAANszvEPWLT6MSB_iyOqOQfgBBQf7OnK_3OheLzF8Sv6_yH2lpJFQanuOzg6PDGbLCTzl6w$>
>>>
>>>
>>> _______________________________________________
>>> scim mailing list
>>> scim@ietf.org
>>> https://www.ietf.org/mailman/listinfo/scim
>>> <https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/scim__;!!PwKahg!4fVL2tBJsHfvqmDAANszvEPWLT6MSB_iyOqOQfgBBQf7OnK_3OheLzF8Sv6_yH2lpJFQanuOzg6PDGbxopDeqA$>
>>>
>> _______________________________________________
>> scim mailing list
>> scim@ietf.org
>> https://www.ietf.org/mailman/listinfo/scim
>>
>