Re: [scim] Call for support on proposed SCIM/SINS (re)charter

[Craig McClanahan <[e-mail]>]

For a paging use case, imagine you are trying to list the followers (or the
n-th subset of them) in your UI for a very popular person on Twitter.
You'll definitely want paging for something like that.

FWIW, this was the breaking point for the last project I worked on that was
looking at using SCIM -- we were in exactly the same situation when groups
got too large.

Craig McClanahan

On Mon, Sep 13, 2021 at 1:27 PM Danny Mayer <[e-mail]> wrote:

> Matt,
>
> Synchronization and paging are different issues and should be handled
> separately. You may need paging for synchronization but that may not be the
> only case. I don't personally know of other cases but I would like to hear
> other people's experience of this so that the requirements be properly
> included in the draft RFCs.
>
> Danny
> On 9/13/21 11:02 AM, Matt Peterson (mpeterso) wrote:
>
> Danny,
>
>
>
> One of the goals of the workgroup is to understand what the pagination use
> cases are (besides initial loading of object set to be synchronized).
>
>
>
> I’m eager to start keeping track of pagination use cases.  Can you posting
> to the list the use cases that you are thinking of you’d need pagination
> for?   Thanks!
>
>
>
> *From:* scim <[e-mail]> <[e-mail]> *On Behalf
> Of * Danny Mayer
> *Sent:* Friday, September 10, 2021 6:11 PM
> *To:* Nancy Cam-Winget (ncamwing) <ncamwing=[e-mail]>
> <ncamwing=[e-mail]>rg>; Phil Hunt
> <[e-mail]> <[e-mail]>
> *Cc:* [e-mail]
> *Subject:* Re: [scim] Call for support on proposed SCIM/SINS (re)charter
>
>
>
> *CAUTION:* This email originated from outside of the organization. Do not
> follow guidance, click links, or open attachments unless you recognize the
> sender and know the content is safe.
>
>
>
> Pagination and synchronization are really different issues.
> Synchronization MAY need pagination but not necessarily. There are other
> reasons why pagination may be necessary.
>
> Danny
>
> On 9/10/21 8:00 PM, Nancy Cam-Winget (ncamwing) wrote:
>
> Thanks for the feedback Phil.  I’m trying to determine proposed changes to
> the charter text…..I suspect there might have been a translation issue for
> synchronization being more about pagination than paging?
>
>
>
> If you can provide suggested updates, it will be helpful to rally
> agreement for the updates too.
>
>
>
> Best, Nancy
>
>
>
> *From: *Phil Hunt <[e-mail]>
> <[e-mail]>
> *Date: *Wednesday, September 8, 2021 at 6:34 PM
> *To: *ncamwing <[e-mail]> <[e-mail]>
> *Cc: *"[e-mail]" <[e-mail]> <[e-mail]> <[e-mail]>
> *Subject: *Re: [scim] Call for support on proposed SCIM/SINS (re)charter
>
>
>
> Nancy,
>
>
>
> Thanks for putting this together.
>
>
>
> For this go around my interest lies mainly in Events and Synchronization
> and profiles.  I am willing to provide updated drafts for this process
> after some initial agreement on cases.  Drafts already in the archive (they
> may be fairly out of date!):
>
>
>
> * SCIM Events - draft-hunt-idevent-scim
> <https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-hunt-idevent-scim&data=04%7C01%7Cmatt.peterson%40oneidentity.com%7Cf724206102d841ce536508d974b89ea7%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637669158559076639%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=aTbIFVma5fAKXT1IFSNi0VMxhpHgwPxbzLLP8Lyfleg%3D&reserved=0>
> (needs to be updated to reflect the work we did in RFC8417)
>
> * OpenId Connect Profile for SCIM -
> https://openid.net/specs/openid-connect-scim-profile-1_0.html
> <https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fopenid.net%2Fspecs%2Fopenid-connect-scim-profile-1_0.html&data=04%7C01%7Cmatt.peterson%40oneidentity.com%7Cf724206102d841ce536508d974b89ea7%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637669158559086635%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=dpdcId61OuqI2BznbvQYF%2BCM1xr3mDhbNeLra8R%2FFYk%3D&reserved=0>
>
>
>
> Regarding the MV-Paging draft.  This draft has nothing to do with
> synchronization and is intended for clients who need to pull a limited
> number of values in a multi-valued-attribute in situations such as large
> groups. Most typical use would be in building a user interface allowing the
> searching of MVAs.
>
>
>
> As far as exploring using paging as a synchronization approach is not
> something we should explore (ie in the charter). IMHO this appraoch an
> anti-pattern.  If its needed, I am happy to add text in the best practices
> or elsewhere as to why this isn’t a great approach from the perspective of
> security, DoS, timeliness, scale, and cost.
>
>
>
> That said, a couple people indicated they wanted stateful paging.
> Unfortunately they didn’t elaborate on a use case.
>
>
>
> Phil Hunt
>
> @independentid
>
> [e-mail]
>
>
>
>
>
>
>
>
> On Sep 8, 2021, at 5:21 PM, Nancy Cam-Winget (ncamwing) <
> ncamwing=[e-mail]> wrote:
>
>
>
> Hello SCIM participants,
>
>
>
> After some virtual meetings (thank you Pam for hosting these!) and
> discussion, there is a new proposed charter that addresses the points
> raised at the IETF 111 SINS session.
>
> This is a call for support of the charter defined below, please provide
> your response by Sept. 24, 2021.
>
>
>
> As you respond in support for the charter, please also specify if you are
> willing to produce, review and/or implement the resulting documents.
>
> Otherwise, do provide feedback in the time window if there are concerns or
> issues you see with the charter below:
>
>
> Charter
>
> The System for Cross-domain Identity Management (SCIM) specification is an
> HTTP-based protocol that makes managing identities in multi-domain
> scenarios easier. SCIM was last published in 2015 and has seen growing
> adoption.
>
> One goal for this working group is to shepherd SCIM, currently RFC series
> 7642
> <https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Frfc7642&data=04%7C01%7Cmatt.peterson%40oneidentity.com%7Cf724206102d841ce536508d974b89ea7%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637669158559086635%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=oAINKBwQkQ7brNWd9N3RS1L7kclX1ES9%2BXzMXINnMzQ%3D&reserved=0>
> , 7643
> <https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Frfc7643&data=04%7C01%7Cmatt.peterson%40oneidentity.com%7Cf724206102d841ce536508d974b89ea7%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637669158559096631%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=hA9V7rnyX9ueO9RCfWtIea3YUnvA1tXL8zFIbrWZPZ4%3D&reserved=0>
> , 7644
> <https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Frfc7644&data=04%7C01%7Cmatt.peterson%40oneidentity.com%7Cf724206102d841ce536508d974b89ea7%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637669158559106629%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=N129Lu9sJF8uld90ch7n5bznb%2BkT1pq9C5%2B6UBzIHUg%3D&reserved=0>,
> through the Internet Standard process. The group will deliver revised
> specifications for the SCIM requirements as Informational, and for the SCIM
> protocol and base schema suitable for consideration as a Standard. This
> work will be based upon the existing RFCs, errata and interoperabilty
> feedback, and incorporate current security and privacy best practices.
>
> In addition to revising the requirements, protocol and base schema RFCs,
> the group will also consider additional specifications as extensions to
> SCIM that have found broad adoption and are ready for standards track. This
> includes profiles and schemas for interoperability in additional scenarios.
> The working group will develop additional Proposed Standard RFCs based on
> outcomes of the following work:
>
>    1. Revision of the informational RFC 7642 will:
>
>
>    1. Focus on Use cases and implementation patterns
>
>
>    1. Pull vs. Push based use cases
>          2. Events and signals use cases
>          3. Deletion use cases
>
>
>    1. New use cases may be added to the revised RFC
>
>
>    1. Revision of RFC 7643/44 will include:
>
>
>    1. Profiling SCIM relationships with other identity-centric protocols
>       such as OAuth 2.0, OpenID Connect, Shared Signals, and Fastfed
>       2. Updates to the evolution of the externalid usage
>
>
>    1. Document SCIM support for synchronization-related goals between
>    domains focused on:
>
>
>    1. Handling returning large result sets through paging, based on
>       [draft-hunt-scim-mv-paging-00]
>       2. Incremental approaches to synchronization
>
>
>    1. Support for deletion-related goals including:
>
>
>    1. Handling Deletes in SCIM Servers that don’t allow Deletes (Soft
>       Deletes) - based on [draft-ansari-scim-soft-delete-00]
>
>
>    1. Support for advanced automation scenarios such as:
>
>
>    1. Discovery and negotiation of client credentials
>       2. Attribute mapping
>       3. Per-attribute schema negotiation
>
>
>    1. Enhance the existing schema to support exchanging of HR, Enterprise
>    group and privileged access management (using draft-grizzle-scim-pam
>    <https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fid%2Fdraft-grizzle-scim-pam-ext-00.html&data=04%7C01%7Cmatt.peterson%40oneidentity.com%7Cf724206102d841ce536508d974b89ea7%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637669158559106629%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=uP8dDJjH%2FI%2Bhy5AoAOt6imwhj8N7sdC7lUlbDml2DN0%3D&reserved=0> as
>    a base)
>
>
>
> Best, Nancy (as one of the BoF chairs)
>
>
>
> _______________________________________________
> scim mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/scim
> <https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fscim&data=04%7C01%7Cmatt.peterson%40oneidentity.com%7Cf724206102d841ce536508d974b89ea7%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637669158559116621%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=DpSg289QfIVbN1KOPrHy2UzcI0lPpXQ0dGR3NnPtXII%3D&reserved=0>
>
>
>
>
>
> _______________________________________________
>
> scim mailing list
>
> [e-mail]
>
> https://www.ietf.org/mailman/listinfo/scim <https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fscim&data=04%7C01%7Cmatt.peterson%40oneidentity.com%7Cf724206102d841ce536508d974b89ea7%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637669158559126620%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=BkQqK3IdyA2D7Y%2F4OtSTbjlgsBS3U8VPTt3aEJv8gs0%3D&reserved=0>
>
>
> _______________________________________________
> scim mailing [e-mail]://www.ietf.org/mailman/listinfo/scim
>
> _______________________________________________
> scim mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/scim
>