Re: [scim] Filtering against Null Attribute Values

Phil Hunt <> Tue, 22 September 2020 20:12 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 102983A1966 for <>; Tue, 22 Sep 2020 13:12:04 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.896
X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id aVNwBh0bPgXK for <>; Tue, 22 Sep 2020 13:12:02 -0700 (PDT)
Received: from ( [IPv6:2607:f8b0:4864:20::102c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 5E7F73A194B for <>; Tue, 22 Sep 2020 13:12:01 -0700 (PDT)
Received: by with SMTP id s14so1666492pju.1 for <>; Tue, 22 Sep 2020 13:12:01 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=qWACZZ9mUN6lnmBy/6pOQxOb8gFND5OhehtLnXn8lzE=; b=ujBK/oyPcY0Hj/6CuM02MKrvfOdARPnIV+msgcqfSGxEsbclxGF1LpUdM2tMIMx8ge 0n6BJIa6VVVgCocQ4UwxfZ9er/bcoLpB4dXiGpL8uiM1grclVlJ7bCYaSWwwnQoMwml3 1kcirgl19QWlGCbRGwxvzuiXxkVnXdLh+zuYZDxzkF/8CAjbVWFVJ05o+CIauqn9Y4xX ni70+hqUUVSDQUFc5p9WxFLs2PLCrEdUChZGCi7xIepEakLvjT1kjimYJoXRY8LfxC2e JtkpUCuC5fVdKn9yvPanJo2NNcZ0Wp5b6fZ3ES4T2p++AFizcXp3pLWGagaEyHyDjpmr E1Kg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=qWACZZ9mUN6lnmBy/6pOQxOb8gFND5OhehtLnXn8lzE=; b=TrSmB1+evwmGcdrDXalPoXWjd1XwH7ruMF+9knmlA+KQXw3BYbrs1RZArUGCGjmoW0 DLv5OiKdQf60tFYepofQzH2GgtDB7qNDbkKWSBKqM85AVcuqqo0F6OiLEg6lPRGpmsJd 1INJXODkKEksGNZdDYFW9/zkKDDq5WlsmEwKGZKsP7OKlHAaonpif7n26PjSNQfAKi7J hyyCDnIW1LHMaVZjSnoP59B82FHlT32DY7dU/SceDaGo8fYmlDx/IbAUrZEAjoTayfkQ wM8cB3htXL5vCEUjV/jv0QjMGR0Y8iyurlnRrRGKmNoCboVQpTbFBBNCr3X4wg4Sosfh Bkxg==
X-Gm-Message-State: AOAM530+DekVy2kJa2GB+C0nqxUYcpUkvVLzPU9AUUEvIzhqB3wSoLgk Y/berfYgd0nbk9jd5NEYgffFmw==
X-Google-Smtp-Source: ABdhPJzKgSnhLLpeWAVJVWcPn6tiMsPGjzfmQyqeEYN/obY3hkGj8jqGA9LTSZksj1QO2UN9VgcodA==
X-Received: by 2002:a17:90b:e01:: with SMTP id ge1mr4987843pjb.187.1600805521380; Tue, 22 Sep 2020 13:12:01 -0700 (PDT)
Received: from ( [2001:569:7a71:1d00:4aa:3a28:6538:e829]) by with ESMTPSA id 143sm15862985pfc.66.2020. (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 22 Sep 2020 13:12:00 -0700 (PDT)
From: Phil Hunt <>
Message-Id: <>
Content-Type: multipart/alternative; boundary="Apple-Mail=_2532898C-172F-4125-92DD-F7A6C57E6F67"
Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.\))
Date: Tue, 22 Sep 2020 13:11:59 -0700
In-Reply-To: <>
To: Shelley <>
References: <>
X-Mailer: Apple Mail (2.3608.
Archived-At: <>
Subject: Re: [scim] Filtering against Null Attribute Values
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Simple Cloud Identity Management BOF <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 22 Sep 2020 20:12:04 -0000


It is indirectly specified in the last paragraph of
   For filtered attributes that are not part of a particular resource
   type, the service provider SHALL treat the attribute as if there is
   no attribute value.  For example, a presence or equality filter for
   an undefined attribute evaluates to false.

In your example below, both conditions would evaluate false as the value is undefined (and neither statement can not be said to lexicographically true) —> leading to a confusing situation where a resource is neither lt 18 or ge 18. A more qualified filter might be:
filter=age pr and age lt 18 
filter=age pr and age gt 18

Phil Hunt

> On Sep 22, 2020, at 11:10 AM, Shelley <> wrote:
> Do the SCIM specifications prescribe any special behavior for filtering and sorting by attributes that are null/unspecified?
> For instance, given an optional user extension attribute for "age" and the following filters:
> filter=age lt 18
> filter=age gt 18
> Would either of these filters return a user resource with no specified age, such that nulls have a prescribed ordering? Or, would both of these filters exclude all users without specified ages? (And, if it's the latter, what effect is negation intended to have on the filter?)
> This question applies to filters, matching resources during PATCH, sorting, and other attribute operators as well (e.g. would not (displayName co "test") match users without display names?).
> Thanks in advance for any clarifications!
> _______________________________________________
> scim mailing list