Re: [scim] [Technical Errata Reported] RFC7643 (6011)

[Phil Hunt <[e-mail]>]

Shelley,

The display attribute is usually set by the client creating the record. AFAIK most of the time CMV attributes are immutable (at least that was the discussion).

In some cases it may be an attribute asserted only by the service provider but not always.  For this reason, I would not recommend the example show “readOnly” as this may cause a lot of confusion. Instead I would go with “immutable” per the spec default.

From a historical perspective...

I know that as the SCIM 2 protocol evolved (from SCIM 1), we developed the PATCH operation to be able to do discreet manipulation of CMVAs which enabled updating of attributes in a readwrite fashion.

Phil Hunt
[e-mail]



> On Mar 9, 2020, at 10:21 AM, Shelley <[e-mail]> wrote:
> 
> Thanks.
> 
> The use of "readOnly" for the "display" mutability overlaps a bit with a question posted here:
> https://mailarchive.ietf.org/arch/msg/scim/qI6J6ZwnlowstviRBMox41J_yo4/ <https://mailarchive.ietf.org/arch/msg/scim/qI6J6ZwnlowstviRBMox41J_yo4/>
> 
> Apologies for conflating these two issues.
> 
> On Mon, Mar 9, 2020 at 12:04 PM Phil Hunt <[e-mail] <mailto:[e-mail]>> wrote:
> VERIFIED
> 
> However, the correction needs a correction.  The display attribute is “immutable” not “readOnly”.
> 
>          {
>            "name": "display",
>            "type": "string",
>            "multiValued": false,
>            "description": "A human-readable name for the group member, primarily used for display purposes.",
>            "required": false,
>            "caseExact": false,
>            "mutability": "readOnly”,
> —>. should be: 
>            "mutability": “immutable”,
> 
>            "returned": "default",
>            "uniqueness": "none"
>          }
> 
> Phil Hunt
> [e-mail] <mailto:[e-mail]>
> 
> 
> 
>> On Mar 9, 2020, at 7:47 AM, RFC Errata System <[e-mail] <mailto:[e-mail]>> wrote:
>> 
>> The following errata report has been submitted for RFC7643,
>> "System for Cross-domain Identity Management: Core Schema".
>> 
>> --------------------------------------
>> You may review the report below and at:
>> https://www.rfc-editor.org/errata/eid6011 <https://www.rfc-editor.org/errata/eid6011>
>> 
>> --------------------------------------
>> Type: Technical
>> Reported by: Shelley Baker <[e-mail] <mailto:[e-mail]>>
>> 
>> Section: 8.7.1
>> 
>> Original Text
>> -------------
>>      {
>>        "name" : "members",
>>        "type" : "complex",
>>        "multiValued" : true,
>>        "description" : "A list of members of the Group.",
>>        "required" : false,
>>        "subAttributes" : [
>>          {
>>            "name" : "value",
>>            "type" : "string",
>>            "multiValued" : false,
>>            "description" : "Identifier of the member of this Group.",
>>            "required" : false,
>>            "caseExact" : false,
>>            "mutability" : "immutable",
>>            "returned" : "default",
>>            "uniqueness" : "none"
>>          },
>>          {
>>            "name" : "$ref",
>>            "type" : "reference",
>>            "referenceTypes" : [
>>              "User",
>>              "Group"
>>            ],
>>            "multiValued" : false,
>>            "description" : "The URI corresponding to a SCIM resource
>> that is a member of this Group.",
>>            "required" : false,
>>            "caseExact" : false,
>>            "mutability" : "immutable",
>>            "returned" : "default",
>>            "uniqueness" : "none"
>>          },
>>          {
>>            "name" : "type",
>>            "type" : "string",
>>            "multiValued" : false,
>>            "description" : "A label indicating the type of resource,
>> e.g., 'User' or 'Group'.",
>>            "required" : false,
>>            "caseExact" : false,
>>            "canonicalValues" : [
>>              "User",
>>              "Group"
>>            ],
>>            "mutability" : "immutable",
>>            "returned" : "default",
>>            "uniqueness" : "none"
>>          }
>>        ],
>>        "mutability" : "readWrite",
>>        "returned" : "default"
>>      }
>> 
>> Corrected Text
>> --------------
>>      {
>>        "name" : "members",
>>        "type" : "complex",
>>        "multiValued" : true,
>>        "description" : "A list of members of the Group.",
>>        "required" : false,
>>        "subAttributes" : [
>>          {
>>            "name" : "value",
>>            "type" : "string",
>>            "multiValued" : false,
>>            "description" : "Identifier of the member of this Group.",
>>            "required" : false,
>>            "caseExact" : false,
>>            "mutability" : "immutable",
>>            "returned" : "default",
>>            "uniqueness" : "none"
>>          },
>>          {
>>            "name" : "$ref",
>>            "type" : "reference",
>>            "referenceTypes" : [
>>              "User",
>>              "Group"
>>            ],
>>            "multiValued" : false,
>>            "description" : "The URI corresponding to a SCIM resource
>> that is a member of this Group.",
>>            "required" : false,
>>            "caseExact" : false,
>>            "mutability" : "immutable",
>>            "returned" : "default",
>>            "uniqueness" : "none"
>>          },
>>          {
>>            "name" : "type",
>>            "type" : "string",
>>            "multiValued" : false,
>>            "description" : "A label indicating the type of resource,
>> e.g., 'User' or 'Group'.",
>>            "required" : false,
>>            "caseExact" : false,
>>            "canonicalValues" : [
>>              "User",
>>              "Group"
>>            ],
>>            "mutability" : "immutable",
>>            "returned" : "default",
>>            "uniqueness" : "none"
>>          },
>>          {
>>            "name": "display",
>>            "type": "string",
>>            "multiValued": false,
>>            "description": "A human-readable name for the group member, primarily used for display purposes.",
>>            "required": false,
>>            "caseExact": false,
>>            "mutability": "readOnly",
>>            "returned": "default",
>>            "uniqueness": "none"
>>          }
>>        ],
>>        "mutability" : "readWrite",
>>        "returned" : "default"
>>      }
>> 
>> Notes
>> -----
>> The group "members" attribute should define a "display" sub-attribute.
>> 
>> * Section 2.4 defines a standard multi-valued read-only attribute of "display".
>> * The Group Representation example in Section 8.4 also includes the "members.display" sub-attribute.
>> * This discussion in the SCIM mailing list [1] also indicates that this should be fixed.
>> 
>> [1] https://mailarchive.ietf.org/arch/msg/scim/EH99Gxn-hDluihMNtWLIekuFCs8/ <https://mailarchive.ietf.org/arch/msg/scim/EH99Gxn-hDluihMNtWLIekuFCs8/>
>> 
>> Instructions:
>> -------------
>> This erratum is currently posted as "Reported". If necessary, please
>> use "Reply All" to discuss whether it should be verified or
>> rejected. When a decision is reached, the verifying party  
>> can log in to change the status and edit the report, if necessary. 
>> 
>> --------------------------------------
>> RFC7643 (draft-ietf-scim-core-schema-22)
>> --------------------------------------
>> Title               : System for Cross-domain Identity Management: Core Schema
>> Publication Date    : September 2015
>> Author(s)           : P. Hunt, Ed., K. Grizzle, E. Wahlstroem, C. Mortimore
>> Category            : PROPOSED STANDARD
>> Source              : System for Cross-domain Identity Management
>> Area                : Applications and Real-Time
>> Stream              : IETF
>> Verifying Party     : IESG
> 
> _______________________________________________
> scim mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/scim