Re: [scim] User extension for not valid before / after ?

[Yoann Gini <[e-mail]>]

Hello

> Le 7 sept. 2022 à 19:19, Phillip Hunt <[e-mail]> a écrit :
> 
> I think there have been two scenarios discussed at various times:
> 
> 1. Account life cycle schema:  eg the start and end of an account.  Could be new attributes in a new schema extension (like enterprise user works).

That's our target right now, start/end from lifecycle perspective and hold time for long vacation such as maternity leave.

> 2. Attribute metadata. This can be things like verification status, expiry, but for attributes. Was this email verified?  When does a role expire? Etc. 

This one seems to be a complex (but legitimate) one for which I don't have enough data and experience to work on.

> I am talking to a client about this as well, so there does seem to be interest in the issue from several orgs. 

It should be a natural request from all orgs that are moving to HRIS Based Identity Management.

Usual workflow around it allows to be sure that hardware is provisioned in time but account cannot be used before legal start. Some company defines some policies that create for example the mailbox a week before the legal start with mailing inclusion, but the account can logon only when legally allowed. This allows them to onboard people with some context for ongoing discussion, for example.

> Another thing to think about. Specialized schema that is only used in a single environment does not necessarily need to be standardized or registered in IANA. The question is what is the interop requirement? Does this data need to be shared between domains with different implementations?  

That's the key point here. The reason I was looking for a standard or a draft is because this information needs to be exchanged between HRIS and IDP when adopting HRIS Based Identity Management.

So the goal here would be to have a standard representation method that would allow any HRIS system to provide lifecycle and on hold information to org's IDP. Regardless of the brand of each. It seems to be a good use case for SCIM registered schema.

> Le 7 sept. 2022 à 22:26, Danny Mayer <[e-mail]> a écrit :
> 
> This gets into the issue of what's confidential information for HR systems. I did send out a message about some of that but it hasn't really been discussed. I can probably dig it back out. You also really need to understand the privacy requirements of different countries and the EU.

Being French and for 14 years in the field of identity management for organization, I do have some sensibility regarding privacy requirements.

Here for the need of identity lifecycle and hold events, I gave the example of maternity leave.

The goal was to give an example of use. However, the reason why people have their account on hold for X months is not a useful information in SCIM I would say (or at least should be an option field that people will use or not).

Some example of legal reason in France to put an account on hold in France will be, for example
— maternity leave
— military reservists called back to service 
— prison time (FR org are required to keep them in the employees and give them back their job once their time is done)

etc.

An extension for "HRISUser" could be, for example
— notValidBefore
— notValidAfter

— holdPeriods
—— startDate
—— endDate
—— reason (optional)

That's what I see as useful from my own perspective and would be interested to work on something if we are multiple to agree on a need for standardized extension.

Yoann