Re: [scim] Feedback and adoption readiness for draft-zollner-scim-roles-entitlements-extension

[Phillip Hunt <[e-mail]>]

Danny,

Thanks for putting this forward.

I have not had time to read the draft. That said, having a discussion on this topic seems a priority. Unfortunately I don’t plan to implement it at this time.

I am trying to get some time to take a read from a compatibility (kind of like genart) perspective as I had some concerns from some of the comments. For example, 7643/7644 have some fundamental rules around “id” and other required attributes in order for basic features and discovery to work correctly.  I see Matt has already raised some of the issues.

ID is particularly important as it is THE core required attribute. All resource URIs paths are always  /<ResourceType>/<id> and once created are immutable. I would say this isn’t a “preference” issue but rather a compliance/compatibility issue.  

For “id” values, most implementations use GUID/UUIDs because this works well in most databases (especially NoSQL) and uniqueness doesn’t need to be checked at record creation time.  Some have opted for other formats(counters, MACs, etc) but the main practice seems to be consistency and permanence of the identifier.

I agree with all of Matt’s comments below.

Phillip Hunt
[e-mail]





> On Nov 9, 2022, at 9:02 AM, Matt Peterson (mpeterso) <Matt.Peterson=[e-mail]> wrote:
> 
> Danny,  Chad, 
>  
> I agree with Chad’s feedback about id.   For us it would be best for us if Roles and Entitlements resources had the following attributes that match other SCIM resources (i.e. users, groups):
>  
> id ß this one is particularly important.   I think that the draft uses “value” instead of “id”.   I much prefer “id” as it is already assumed by most developers to be an immutable value that can be queried directly by URL (or referenced by contains/containsBy)
>  
> meta ß described in RFC7644 section 3.1.  meta.created and meta.lastChanged have been useful for us when dealing with users/groups
>  
> displayName – instead of “display” would be consistent with “displayName” on users and groups the name “suitable for display to end-users”.
>  
> description – instead of “type”?   For our Identity Management products, the human readable description of what a Role and Entitlement grants access to are very important.  In most application authorization models, this is the “description” of the role or “description” of the entitlement.
>  
> containsBy / contains – slight wording change to make it clear that this is a list of *ids*.  Consider reusing some of the wording from RFC 7644 that describes Group.member and User.memberOf?
>  
> --
> Matt
>  
> P.S. Sorry for taking so long to read this draft properly. It is important to us and, with the suggestions above, it matches the model we already use in our Identity Management products. 
>  
>  
> From: scim <[e-mail] <mailto:[e-mail]>> On Behalf Of Chad Vincent
> Sent: Thursday, November 3, 2022 3:09 PM
> To: [e-mail] <mailto:[e-mail]>
> Subject: Re: [scim] Feedback and adoption readiness for draft-zollner-scim-roles-entitlements-extension
>  
> CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.
>  
> I love this - we use roles currently and having a more formal spec and ability for the client to read what's available could come in very handy in the future.  So mark me down as a 5.
>  
> However, these resources not including the common attributes set mandated by RFC 7643 section 3.1 should be explained/clarified in the RFC.  The Apache SCIMple library will have to handle these resources as special-cases since they won't have the required "id" field, for example.  That seems major enough to justify a paragraph.
>  
> ---------- Forwarded message ----------
> From: "Nancy Cam-Winget (ncamwing)" <[e-mail] <mailto:[e-mail]>>
> To: SCIM WG <[e-mail] <mailto:[e-mail]>>
> Cc: 
> Bcc: 
> Date: Wed, 2 Nov 2022 23:40:10 +0000
> Subject: [scim] Feedback and adoption readiness for draft-zollner-scim-roles-entitlements-extension
> Hello SCIMers,
>  
> We need feedback on to gauge support and adoption readiness of:
> https://datatracker.ietf.org/doc/draft-zollner-scim-roles-entitlements-extension/ <https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-zollner-scim-roles-entitlements-extension%2F&data=05%7C01%7Cmatt.peterson%40oneidentity.com%7Cb93c1a9df1ce43b1579108dabddfa2fd%7C91c369b51c9e439c989c1867ec606603%7C0%7C1%7C638031065457274469%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000%7C%7C%7C&sdata=tBa11%2Fiu9KqiI09Hj7jMIj1ylO0autjBHncMlTYKuAQ%3D&reserved=0>
> Please respond to this thread on the following:
>  
>  
>   1.  You have read the draft and believe it is ready to be adopted by the working group. Any other feedback on the content of the draft is welcomed too.
>   2.  You are willing to be an active contributor or reviewer of the document
>   4.  You support the draft and plan to implement
>   5.  You support the draft but have no time or plans to implement now, but can provide feedback
>   6.  You have no interest in the draft
>  
> Please provide your feedback by November 28th.
>  
> Thanks,
>    Nancy
>  
> 
> 
> 
> ---------- Forwarded message ----------
> From: Paul Lanzi <[e-mail] <mailto:[e-mail]>>
> To: SCIM WG <[e-mail] <mailto:[e-mail]>>
> Cc: 
> Bcc: 
> Date: Wed, 2 Nov 2022 16:50:26 -0700
> Subject: Re: [scim] Feedback and adoption readiness for draft-zollner-scim-roles-entitlements-extension
> #4 for me. 
> Thanks,
> --Paul
> ᐧ
>  
> On Wed, Nov 2, 2022 at 4:40 PM Nancy Cam-Winget (ncamwing) <ncamwing=[e-mail] <mailto:[e-mail]>> wrote:
> Hello SCIMers,
>  
> We need feedback on to gauge support and adoption readiness of:
> https://datatracker.ietf.org/doc/draft-zollner-scim-roles-entitlements-extension/ <https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-zollner-scim-roles-entitlements-extension%2F&data=05%7C01%7Cmatt.peterson%40oneidentity.com%7Cb93c1a9df1ce43b1579108dabddfa2fd%7C91c369b51c9e439c989c1867ec606603%7C0%7C1%7C638031065457274469%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000%7C%7C%7C&sdata=tBa11%2Fiu9KqiI09Hj7jMIj1ylO0autjBHncMlTYKuAQ%3D&reserved=0>
> Please respond to this thread on the following:
>  
>  
>   1.  You have read the draft and believe it is ready to be adopted by the working group. Any other feedback on the content of the draft is welcomed too.
>   2.  You are willing to be an active contributor or reviewer of the document
>   4.  You support the draft and plan to implement
>   5.  You support the draft but have no time or plans to implement now, but can provide feedback
>   6.  You have no interest in the draft
>  
> Please provide your feedback by November 28th.
>  
> Thanks,
>    Nancy
>  
> _______________________________________________
> scim mailing list
> [e-mail] <mailto:[e-mail]>
> https://www.ietf.org/mailman/listinfo/scim <https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fscim&data=05%7C01%7Cmatt.peterson%40oneidentity.com%7Cb93c1a9df1ce43b1579108dabddfa2fd%7C91c369b51c9e439c989c1867ec606603%7C0%7C1%7C638031065457274469%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000%7C%7C%7C&sdata=f2tiwDDzqDIAc5kxRVv68eML%2BRYKvXVmjsvghNhRqPY%3D&reserved=0>
> _______________________________________________
> scim mailing list
> [e-mail] <mailto:[e-mail]>
> https://www.ietf.org/mailman/listinfo/scim <https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fscim&data=05%7C01%7Cmatt.peterson%40oneidentity.com%7Cb93c1a9df1ce43b1579108dabddfa2fd%7C91c369b51c9e439c989c1867ec606603%7C0%7C1%7C638031065457274469%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000%7C%7C%7C&sdata=f2tiwDDzqDIAc5kxRVv68eML%2BRYKvXVmjsvghNhRqPY%3D&reserved=0>
> 
>  
> -- 
> Chad Vincent (he/him) | Software Engineer, Senior - CrashPlan
> [e-mail] <mailto:[e-mail]>
> 400 S 4th St Suite 410 PMB 31083 Minneapolis, MN 55415-1419
>  
>  <https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcrashplan.com%2F&data=05%7C01%7Cmatt.peterson%40oneidentity.com%7Cb93c1a9df1ce43b1579108dabddfa2fd%7C91c369b51c9e439c989c1867ec606603%7C0%7C1%7C638031065457274469%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000%7C%7C%7C&sdata=E3DXK05Ij39M3yKNiydGKTgd2kDIaBJeE4R%2BLZlefuQ%3D&reserved=0>
>  
> _______________________________________________
> scim mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/scim