Re: [scim] Retrieving members of a group

"Jackson Shaw (jshaw)" <> Tue, 04 December 2018 17:27 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id CA379130F19 for <>; Tue, 4 Dec 2018 09:27:41 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -4.298
X-Spam-Status: No, score=-4.298 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id cBA5gv6NQz-1 for <>; Tue, 4 Dec 2018 09:27:38 -0800 (PST)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id E822E130F85 for <>; Tue, 4 Dec 2018 09:27:37 -0800 (PST)
Received: from ( id h0qsgk0171s8 for <>; Tue, 4 Dec 2018 09:27:37 -0800 (envelope-from <>)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=default;; h=Received: Received:Received:From:To:CC:Subject:Thread-Topic:Thread-Index: Date:Message-ID:References:In-Reply-To:Accept-Language: Content-Language:Content-Type:MIME-Version; bh=fDUX1ZaICtJpb9VhD pOS4dYyM3gi0EEEVIcOF5Muj1Q=; b=KlvQZJCZZWV0ARuiNV8COZpU12RcJS18c FNDovI8w4hqDUSpFGgkdU9QEdRZl3DK1JWoNyvDxj0a6mufmaL3CZ9neNrD5n+ZE j2N/S9Fa+m0Xlr5qBN0wNeFERpb5MjXeNK9ijgXlg0ye4xzw9V5vcQeRgS8d1SeK DsUyCyLp7M=
Received: from ([]) by ([]) (SonicWALL ) with ESMTPS (version=TLSv1.2 cipher=AES128-SHA256 bits=128/128) id o201812041727360208832-108; Tue, 04 Dec 2018 09:27:36 -0800
Received: from ( by ( with Microsoft SMTP Server (TLS) id 14.3.408.0; Tue, 4 Dec 2018 09:27:35 -0800
Received: from ([fe80::cc5a:be3d:40e:3012]) by ([::1]) with mapi id 14.03.0279.002; Tue, 4 Dec 2018 09:27:36 -0800
From: "Jackson Shaw (jshaw)" <>
To: Phil Hunt <>, Jaap Francke <>
CC: "" <>
Thread-Topic: [scim] Retrieving members of a group
Thread-Index: AQHUi7i1HSuQH2+yFkGgfz/NvPWml6VvVSGA//+AkFA=
Date: Tue, 4 Dec 2018 17:27:35 +0000
Message-ID: <>
References: <> <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
x-originating-ip: []
x-c2processedorg: 0b7fb32a-9e41-4a01-8d60-ef67dd9ea696
Content-Type: multipart/alternative; boundary="_000_81058E390D0B3847B069D324750FCFF576B17C17ALVMBXW01prodqu_"
MIME-Version: 1.0
X-Mlf-License: BSVKCAPE_
X-Mlf-UniqueId: o201812041727360208832
Archived-At: <>
Subject: Re: [scim] Retrieving members of a group
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Simple Cloud Identity Management BOF <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 04 Dec 2018 17:27:42 -0000

Indeed. We are one of the ones who feel this question is not adequately addressed…

Jackson Shaw
Product Management, One Identity
☎ +1-425-577-1769

From: scim <> On Behalf Of Phil Hunt
Sent: Tuesday, December 4, 2018 9:03 AM
To: Jaap Francke <>
Subject: Re: [scim] Retrieving members of a group

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.


You are correct that the SCIM protocol does not support sub-pagination of group members.

This question has come up several times since, so I’ll pass along my *personal* thoughts...

As group membership grows, the associated confidentiality of that list also grows. As such many service providers do not return member values except to privileged clients. Listing the members of a team is one thing, but listing the employees of a company, or all customers is quite another.

As group size grows, the change rate of a Group resource also grows. Many use cases for pagination assume that consistent results between pages would also be supported. That means the SCIM SP would have to maintain a query results buffer in order to return results while the data may be changing underneath. This impacts SCIM service providers in key ways:
* Scalability costs of providing consistent result sets
* Results consistency and increased shared state costs across clusters.
* Denial-of-Service risks associated as attackers perform seemingly innocent queries that consume undue resources. LDAP has this problem, and it is one of the reasons I never recommend LDAP for open internet use without some form of counter-measures.

Many of the use-cases I have heard are often driven by user-interface designs intended to aid users in scanning through a group. In my experience I’ve found these systems to be particularly tedious with large groups. The UX often ends up requiring a user-agent side search function so you can find names rather than page through hundreds of pages. This is in part why I suggest group management be done using user-centric calls (see below) or relationship basis like we see in large-scale social networks.

One could argue that group membership should never be returned and instead:
* Use queries against User resources to search for groups a User is a member of.
* Use a query filter against Group resources to test if a User is a member.

There are cases where privileged services need to synchronize or reconcile across domains. In these cases, it is important to return the entire group object as of a point in time so that consistency between systems can be periodically compared.

It’s quite possible the group may re-form to tackle this question down the road. After-all the pagination question keeps coming up and is worthy of more discussion IMO.


Phil Hunt

On Dec 4, 2018, at 2:04 AM, Jaap Francke <<>> wrote:

Hi all,

I would like to have my understanding confirmed on usage of the GROUP endpoint.

When I do a GET on the GROUP endpoint, the members attribute of a returned GROUP resoiurce contains a list of all members of that group.
If the group contains only a few members, that’s not a problem.
However, when the group contains a lot of members, the payload gets “too big” and pagination for the members does not apply.

I assume the way to solve this is to return a partial representation of the group resource by setting the schema metadata returned=never (or returned=request) in the group schema definition?
When doing so, a GET on the GROUP endpoint results in a list of groups with common resource attributes (id, externalid, meta) and group displayName.

To retrieve the list of members of a group, one would have to do a GET on the user endpoint using a filter on the groups attribute, right? In this case pagination does apply.

Your responses are appreciated, thanks!

Jaap Francke
scim mailing list<>