Re: [scim] [EXTERNAL] Query on a specific known resource

[Julien Schneider <[e-mail]>]

Hi Danny, hi Phillip, hi everyone,

Thanks for your answers. I think the confusing part (for me at least) is 
"Queries MAY be made _*against a single resource*_ or a resource type 
endpoint ......." at the beginning of RFC7644 section 3.4.2., followed 
by "Responses MUST be identified using the following URI: 
"urn:ietf:params:scim:api:messages:2.0:ListResponse" ".

My interpretation is that "*GET 
/Users/2819c223-7f76-453a-919d-413861904646?attributes=userName*" is a 
query against a single resource, and should then have a "ListResponse" 
response? Where am I wrong here?

Thanks

Julien Schneider
Tel: [phone]
Fax: [phone]

http://www.audriga.com  |http://www.twitter.com/audriga

--------------------------------------------------------------------------
audriga GmbH |  Alter Schlachthof 57  | 76137 Karlsruhe
Sitz der Gesellschaft: Karlsruhe - Amtsgericht Mannheim - HRB 713034
Geschäftsführer: Dr. Frank Dengler, Dr.-Ing. Hans-Jörg Happel
--------------------------------------------------------------------------

On 07/07/2022 04:51, Danny Zollner wrote:
>
> Hi Julien,
>
> RFC 7644 section 3.4.2 specifically is talking about queries. 
> Retrieving or modifying known resources (i.e.: GET /Users/12345 ) does 
> not require a ListResponse type response. A query of *GET 
> /Users?filter=displayname contains “contoso.com”* or *GET 
> /Users?attributes=userName* would require a ListResponse type 
> response, as it does not identify a specific resource in the query URL 
> via ID value (i.e.: “12345” in the previous example). On the other 
> hand, *GET /Users/12345?attributes=userName *does not require the 
> ListResponse type response as it does identify a specific resource.
>
> To explicitly answer the final question in your email – the expected 
> response to *GET 
> /Users/2819c223-7f76-453a-919d-413861904646?attributes=userName* would 
> be the second example you provided.
>
> Cheers,
>
> Danny Zollner
>
> *From:* scim <[e-mail]> *On Behalf Of * Julien Schneider
> *Sent:* Wednesday, July 6, 2022 3:41 AM
> *To:* [e-mail]
> *Subject:* [EXTERNAL] [scim] Query on a specific known resource
>
>
> 	
>
> Some people who received this message don't often get email from 
> [e-mail]. Learn why this is important 
> <https://aka.ms/LearnAboutSenderIdentification>
>
> 	
>
> Hi all,
>
> I have a question about queries performed against a SCIM resource 
> object (like "/Users/{id}").
>
> The RFC (https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2 
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Frfc7644%23section-3.4.2&data=05%7C01%7Cdanny.zollner%40microsoft.com%7C29270780ce9941a0687808da5f2b53db%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637926937860837552%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=fVtTna44Hr973Z79OsTegu9U9%2FpDwRcBZignfi5Eluk%3D&reserved=0>) 
> states:
>
> Responses MUST be identified using the following URI:
>     "urn:ietf:params:scim:api:messages:2.0:ListResponse"
>
>
> If I understand correctly, that means the "schemas" parameter of the 
> response to those queries must be set to:
>
> "schemas":["urn:ietf:params:scim:api:messages:2.0:ListResponse"]
>
>
> While I understand how that applies to queries on a resource type 
> endpoint (like "/Users") or on the SCIM server root, I don't 
> understand how that applies to queries on a specific resource object.
> If I understand correctly, queries on a specific resource object 
> actually are quite identical to "retrieving a known resource" 
> (https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.1 
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Frfc7644%23section-3.4.1&data=05%7C01%7Cdanny.zollner%40microsoft.com%7C29270780ce9941a0687808da5f2b53db%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637926937860837552%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=DQEZdlY7XBONxFIegf1SCJfpdjpDdWzBvh5%2FzB%2B2EpQ%3D&reserved=0>) 
> which are a GET on a specific resource, like:
>
> GET /Users/2819c223-7f76-453a-919d-413861904646
>
> Responses to those requests should have the "schemas" parameter set to 
> the resource schema(s):
>
> {
>       "schemas":["urn:ietf:params:scim:schemas:core:2.0:User"],
>       "id":"2819c223-7f76-453a-919d-413861904646",
> ...
> }
>
>
> Now, how should the response to the following query should look like? 
> And to what value should the "schemas" parameter of the response be set?
>
> GET /Users/2819c223-7f76-453a-919d-413861904646?attributes=userName
>
>
> Should it be:
>
>     {
>       "schemas":["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
>       "totalResults":1,
>       "Resources":[
>         {
>           "id":"2819c223-7f76-453a-919d-413861904646",
>           "userName":"bjensen"
>         }
>       ]
>     }
>
>
> Or something like:
>
>     {
>       "schemas":["urn:ietf:params:scim:schemas:core:2.0:User"],
>       "id":"2819c223-7f76-453a-919d-413861904646",
>       "meta":{
>         "resourceType":"User",
>         "created":"2011-08-01T18:29:49.793Z",
>         "lastModified":"2011-08-01T18:29:49.793Z",
>         "location":
>     "https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646"  <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fexample.com%2Fv2%2FUsers%2F2819c223-7f76-453a-919d-413861904646&data=05%7C01%7Cdanny.zollner%40microsoft.com%7C29270780ce9941a0687808da5f2b53db%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637926937860837552%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=HRI2UjMUWpVqb0IzoOcpDNA%2FVVDBG3lZ4gU6C60Gr1I%3D&reserved=0>,
>         "version":"W\/\"f250dd84f0671c3\""
>       },
>       "userName":"bjensen"
>     }
>
>
> Thanks a lot in advance
>
> -- 
> Julien Schneider
> Tel: [phone]
> Fax: [phone]
> http://www.audriga.com  <https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.audriga.com%2F&data=05%7C01%7Cdanny.zollner%40microsoft.com%7C29270780ce9941a0687808da5f2b53db%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637926937860837552%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=37nDJF0vyrffA22bld7R3WHNu11PnoLTmWCne%2FGCios%3D&reserved=0>  |http://www.twitter.com/audriga  <https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.twitter.com%2Faudriga&data=05%7C01%7Cdanny.zollner%40microsoft.com%7C29270780ce9941a0687808da5f2b53db%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637926937860837552%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000%7C%7C%7C&sdata=P5As3bPNzRa4zSXSdYj9%2BirwGEkk6%2BYy5jkVKNAQnYw%3D&reserved=0>
> --------------------------------------------------------------------------
> audriga GmbH |  Alter Schlachthof 57  | 76137 Karlsruhe
> Sitz der Gesellschaft: Karlsruhe - Amtsgericht Mannheim - HRB 713034
> Geschäftsführer: Dr. Frank Dengler, Dr.-Ing. Hans-Jörg Happel
> --------------------------------------------------------------------------