Re: [scim] How to patch multi-valued nested attributes?

Aleksey Chernoraenko <achernoraenko@gmail.com> Mon, 25 February 2019 22:32 UTC

Return-Path: <achernoraenko@gmail.com>
X-Original-To: scim@ietfa.amsl.com
Delivered-To: scim@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E5E5A131110 for <scim@ietfa.amsl.com>; Mon, 25 Feb 2019 14:32:09 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QJdRCvHR01lO for <scim@ietfa.amsl.com>; Mon, 25 Feb 2019 14:32:08 -0800 (PST)
Received: from mail-oi1-x243.google.com (mail-oi1-x243.google.com [IPv6:2607:f8b0:4864:20::243]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 313D01310C5 for <scim@ietf.org>; Mon, 25 Feb 2019 14:32:08 -0800 (PST)
Received: by mail-oi1-x243.google.com with SMTP id e7so8699051oia.8 for <scim@ietf.org>; Mon, 25 Feb 2019 14:32:08 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=T7hfm/Qsl7DW52/q7kF4rQS0bG2IOUhsAWAR6w8wAHE=; b=VW3QMIp1PM/WnVl9US7oq656H+GHrQm3lvaDoq2cewEKWQ6a81FhDAyNGRl1MNU7o/ hOF+bmquBm3vxmxESlQMi0h/A/oMQB8JSosk8ifD6A6Xwf3carL4LU9ug6WvxCXvk7M5 7xOyfBlfjThFXtbwGM+JiMtluA8o0xGDaZB+Rc+d0CdxJ/gRWBygWdsiIQLpPcjcsIKJ FfRFjcxHH+V3vD4ZKLE7slPQBE8a6EzeDxJHmoru0FEFbVwScIgKVu9zRUigexnSLQWH ytwq/aiMdnqeW0p3LhCzdKqzXth67mksTpYPxFnwamFydaeynb5c2DaCBrMX6c+W1WJn Bgkw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=T7hfm/Qsl7DW52/q7kF4rQS0bG2IOUhsAWAR6w8wAHE=; b=o7WwpIO8Ra7PkTfxduA/gDEy7mKxe7zN2QxONo0OZ9bTbourtVYoP1iWyB8XJGQ1IA 1T7yW1htwMR0AYBFOgOXAGZitVshF1JCifpTyZT/R5kp1H2MpDdn7g1htjkAmYfsKcZ+ OQtBqMiVD0gn4fawqVzWc1PxQ+TH8/gPjG9w+yaTw0mTQGEdwHyzc69RyHt09TMSCyGd dFHXMiypIwlvo9EHHjTRO/hPSsBNR9KSPcZhuxc2yXJzTLTCNSXF20RgpwtPzmQwFJPx uGRt5HjeB1LHRgSP/UtuUeThYzIWoxEKMGiirE2u3tHg4pr9NNHWD0NKX64kFCCZ2asV Xh7A==
X-Gm-Message-State: AHQUAubdXZa7z3vTqvldjrdJupzrgIE/YWJwex5UU2D9svCPxOaKncnl OTkxoj3wiD5cKsxF0vajjuqGF7X82gLvZEWrRIU=
X-Google-Smtp-Source: AHgI3IbuaJAMY9f06o20/ctN4la02OwryPSlfXMQSq/l4+Ez7qrvNFQo4PsCPGn9ixWj4wHVKSmZ0oMLFPUpVy7WEsw=
X-Received: by 2002:aca:d4d4:: with SMTP id l203mr406255oig.96.1551133927275; Mon, 25 Feb 2019 14:32:07 -0800 (PST)
MIME-Version: 1.0
References: <CAKCnT7w5-o7N=TdOLwLD+dWEMCOSzyuQYYpQBKtrZs+CMo22Rw@mail.gmail.com> <96DFFA94-CA40-44F3-9B6B-8267C1CEB069@oracle.com>
In-Reply-To: <96DFFA94-CA40-44F3-9B6B-8267C1CEB069@oracle.com>
From: Aleksey Chernoraenko <achernoraenko@gmail.com>
Date: Mon, 25 Feb 2019 16:31:56 -0600
Message-ID: <CAKCnT7yUfhigZ4BZa0Aitnr7c_cG=84U7KP1UW8DtOjsnuJMfw@mail.gmail.com>
To: Phil Hunt <phil.hunt@oracle.com>
Cc: scim@ietf.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/scim/m23XOthe3kJLgsee5Q1pKZJugGc>
Subject: Re: [scim] How to patch multi-valued nested attributes?
X-BeenThere: scim@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Simple Cloud Identity Management BOF <scim.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/scim>, <mailto:scim-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/scim/>
List-Post: <mailto:scim@ietf.org>
List-Help: <mailto:scim-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/scim>, <mailto:scim-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 25 Feb 2019 22:32:10 -0000

Thank you for response!

On Mon, Feb 25, 2019 at 1:10 PM Phil Hunt <phil.hunt@oracle.com> wrote:
>
> Unfortunately there is no mass-update style function in SCIM. PATCH only impacts one specific resource at a time. By design each transaction impacts only a single resource at a time. Even inside of “bulk” the transaction semantics a per resource.
>
> You really have to do this in two or more steps.
>
> 1. Query for a set of resources that need updating
> 2. Apply the patch to each resource
>
> For step 2, you can do as multiple calls for each resource, or be as a “bulk” request if supported by the provider.
>

This probably might be "worked around" as a PATCH request to groups
endpoint with query parameters.
It would be like a “bulk” request but in more declarative way, I guess.

PATCH /Groups?groupSet=98ae2a7c-40a5-4fff-b59a-5b922908239e
{   ...
    "operations": [ {
        "op": "add", "path": "members", "value":
"db81119f-5ee0-464e-b7e3-51573b62b56a"
        } ]
}

Would it be still SCIM compliant?

---
Alexei

>>
>>
>> On Feb 25, 2019, at 10:37 AM, Aleksey Chernoraenko <achernoraenko@gmail.com> wrote:
>>
>> Hello,
>>
>> In our SCIM Resource Provider we have resources that have the nested multi-valued attributes. It looks like this:
>> GET /GroupSets/98ae2a7c-40a5-4fff-b59a-5b922908239e
>> {    ...
>>     "name": "collection #1",
>>     "groups": [ {
>>         "value": "a0115001-0fd7-4b50-b7b4-ac29d57cc623",
>>         "$ref": ".../groups/a0115001-0fd7-4b50-b7b4-ac29d57cc623",
>>         ...
>>         }, ...
>>     ], ...
>> }
>>
>> We use groups endpoint when we update group members, like
>> PATCH /Groups/a0115001-0fd7-4b50-b7b4-ac29d57cc623
>> {   ...
>>     "operations": [ {
>>         "op": "add", "path": "members", "value": "db81119f-5ee0-464e-b7e3-51573b62b56a"
>>         } ]
>> }
>>
>> I understand how the request should look like if I want to update one group members via parent (groupset) endpoint:
>> PATCH /GroupSets/98ae2a7c-40a5-4fff-b59a-5b922908239e
>> {   ...
>>     "operations": [ {
>>         "op": "add", "path": "groups[value eq \"a0115001-0fd7-4b50-b7b4-ac29d57cc623\"].members", ...
>>         } ]
>> }
>>
>> but wonder how I can specify "members" from all or a filtered set of "groups" without enumeration all of them on client side?
>>
>> The path value might look like "groups[].members", or "groups[*].members", or even "groups.members".
>>
>> It seems that the spec leaves this question open. What should or can happen if more than one group would be found?