[scim] Relationship between draft-ietf-scim-roles-entitlements and RFC 9068
Éloi Rivard <eloi@yaal.coop> Thu, 27 November 2025 16:12 UTC
Return-Path: <eloi@yaal.coop>
X-Original-To: scim@mail2.ietf.org
Delivered-To: scim@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id B414B91BDC7A for <scim@mail2.ietf.org>; Thu, 27 Nov 2025 08:12:12 -0800 (PST)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.1
X-Spam-Level:
X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (1024-bit key) header.d=yaal.coop
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o99XqauQbbSS for <scim@mail2.ietf.org>; Thu, 27 Nov 2025 08:12:11 -0800 (PST)
Received: from mercure.yaal.coop (mercure.yaal.coop [IPv6:2a09:7340::1001]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 4326E91BDC40 for <scim@ietf.org>; Thu, 27 Nov 2025 08:12:10 -0800 (PST)
Received: from reptincel.lan (unknown [IPv6:2a0c:e303:0:b00::f9e]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (prime256v1) server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mercure.yaal.coop (Postfix) with ESMTPSA id 136BC15BC85 for <scim@ietf.org>; Thu, 27 Nov 2025 17:12:02 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yaal.coop; s=default; t=1764259922; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding:autocrypt:autocrypt; bh=WVKhzLi6S0MCz0lNuIkFoA9rDwGHXAiQwNGKMBE+884=; b=L+TAIjtEG8kzkpBGqGRXrIU5+Rh9Mxhz+fuEDRLefEsd5lRKa3f7jhe/3p7Ps6WpoMTOuI MsUxrFkSu7jPFa+ja3sA166BnQ3+T+J+5zieSfHSgbdbYHWGbHWmz5MpukJ5QxWHfYbG1+ G3uqvlKZ2FxwEdBZWymsCvGh7YtREeU=
Message-ID: <ad0c812c0f2ab8ac1f99bb4639e15fb8fc347fae.camel@yaal.coop>
From: Éloi Rivard <eloi@yaal.coop>
To: scim@ietf.org
Date: Thu, 27 Nov 2025 17:12:00 +0100
Autocrypt: addr=eloi@yaal.coop; prefer-encrypt=mutual; keydata=mQINBFzsWokBEADSsaqMciTNZkb6CQClBp/0UTbRU+npb0RVOiOq53N4aRjKyCTnPtFtW yaSPOyYGnbqTUZp0zvdelPMnspQ+hsUkMA8rj4QEujMmCknbPAtYuM/OKfLQmsH4KHocP1wET5Gol EoDFkCuvozjSnYVKvJ6s77jcD+gjX4WpwGjLeJSCccRsrqnhTUov5AiwRMujt8K+/vAHtR2yksMw9 qtPVoTDQlXrIIdiWVhfPmOC2AZWU97uObD8BiRoEATBtZ2OdJWgsDGncT3/hjKU5+9Tc9WQAmshfQ cYtN2Yo0z5O7A7Pu9TFb9WLB671AXhV/b9INgRYKSUmhLdoTmZs3bL7E82k7JAfR4cM5UF3MYnaiM Kvz+fIRdbrR3VaCCuRtfFxQ4v2tmZ82v0WdH7wk5Yyo5NfS64KC7TznMUynLIJq4iniCt+ESv6Pmj 1ELa6sd58mx/1kodzdYF3J/jfu5V70M6mJero/+7TjBkbtOi0CtGrb6VYpEeVIupJ/WJaZ0giituq bSyDa3RHJ1VVX0LDr4JsW54uFbrBwA5g7ayFp7+xevq0lNr0PpY6wKsMeekvPU5e5KPy9zrJw0z8y J3+TSrflph0fjsEMXsY92W14F/2oGYBLPNkjcvy8T7sbfoujmNzG6Szat5RMmwLEtFhWLPZVsCgOL ZqExrXF8XsUDQARAQABtB/DiWxvaSBSaXZhcmQgPGF6bWV1a0BnbWFpbC5jb20+iQJOBBMBCAA4Fi EE2Wj0HnZ0+zXcd6qgftogTqV90YQFAlzsWs4CGwMFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgk QftogTqV90YSd/A//ZiygL/5Cr0wKzz55WOC36UO+7spWKt2T99kaIufD2Gxb5fGpNy4bBoeEJrLN AtjC+2kbqZKsPEY8MdCBkb/Qel1Y+3iFnoB4GyJk9Zvsr1H2myHveDowytG4zlAt3gEYHOpzATV9W ouFoZgWywmflyX5y4QIo8CqDQRwI4KziRaOucPMbuVFw88zFDlw4KQ201jcWy/sTDPHGquSYx3fDb i3m++QA1BGC9WnPs+dOWhNlywA3KCB9aZQT7P6BjhbRBStDddzbAfRGQ8haiMFoK45UqLz5jsLM9S Id/ieN8lxhH5TfhnHcvqFzg1La6rSW/xxmB2Kt46EkLRNjxA3FyvwMfSYqYunhZeZqtRbOQ1Pe9hL ue3ytadqhXSWWbyYsHjtSdg7cBablPMJm0ruKC932bLL3D79G0PFchCQNiQpHFcdrnWOM4wPvDWlv PtjRhNNIE400v2m6ZiBAaGt41zU5zxxRDLnuHupV6mRn4gGMFvSh4WLP1wWWnlqOr0RKoMamtkzTc +HzNHL3+s6GDO/BI5RD3OpRaOlHUIRJL6g2SgUOQGeSyIMbjA9jZcjJmxTQenr7FjIpGEzGmlts/b xKu8eHinOz0CHk1YOhxckyV8Xr9djrgXjUBHFkSiIAUtJyA9Dl+MwHRAEZG3STxmYCPK5rq1qF4JO 01Jg0a+0JMOJbG9pIFJpdmFyZCA8ZWxvaS5yaXZhcmRAZ21haWwuY29tPokCTgQTAQgAOBYhBNlo9 B52dPs13HeqoH7aIE6lfdGEBQJc7FqJAhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEH7aIE 6lfdGEEGwP/1+W9AV7Hc2fKPIs5BPalKnhk4Ba3qrHkBKqdoOYccR4cMQk5bjp0OTirctekWF+Kcq 5cO8qZdGf3PWpk+dzLaHu2mtmI/PBuZijC9s5Jto6i7hLygUwEFJldC38SDkpEEvEgE9GOkhCHBzV F+J1L27MsM3CGIk01pdBjqJoDqZJhW1QCF/kQhwwDVSbgK5zY9IKP0K0pZ2rt00lhP6YYNza0kVcc sXS3UDf0lJn8qXOXFaVyp2CC9/U+k7bogECjhP3kSq9q/2wZs5yDs36HT0uhht0eU+aazKSwCChHC upCWwnWgmZUNpr4k2fj3YEVVTIMqUSEPVfDwgnk6PAxUdkiJq/rMkD9alNB29gl1ZAtHfbr62AAvr uhAXxl2Pe8N6tXAViLc1DdbZAIxhWpyCZploOZz1nQCjGK8CNKkCCUM3997rLWK83BkyPEHDjZ+S7 nSS89v6RWIFdq0C/Z5rlv/PvhiE/gFonhh4xWVfBRldAP7kmUWRPeEpsMCEXSIW3jlDzuTHNBkPlT XKkusA5N62iFZe2kU0hsNeeAgQdVNsbCeXpwwS9fcnW+839ObcYXI03aKIplEiJcvX4rkaoCLAjDI 24Xy6or8gSjJOiah5zxHe+wg/PFxGGmzAqQ2bdkmCZOoQnBTSxhcuAukfqAFtlFuAwcNkq68O9QJs ktCLDiWxvaSBSaXZhcmQgPGVsb2lAeWFhbC5mcj4gKFlhYWwpiQJOBBMBCAA4FiEE2Wj0HnZ0+zXc d6qgftogTqV90YQFAlzsWroCGwMFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQftogTqV90YTPm Q/7BRWpycHgjYfn7cRGTc8rfVOnCqzZxwqr1zTIy+rUi3sgXky117JmV175wdyGESSN8sT4IoX3TO Buq4Oj8L5EoH1P7Wo8KOXcjRpbrPG54jD+EwdeVW5nsIsgOQazTDacT8Osds9c3TaGvinRV/DDyTA Mj2DOkHUk5/hO3EwqShHww/QYEYoVZVRpKDo6SR/yq33M1QYKwfcdNHNOpaPqrFOlo5FPWLIa8r9j NgeT0mJabaCbZJfYa3W5mDtK4NLQfRL9jWMFGrupVsAPNQHzQOMByHu41kue3WZnJ+oXPbEdr1fW4 wHx8goYTelTvFgrfF9chGa7pl8AQIB6Ph+6QD40Swh4DPS/SQdzOprcS8kvk3TxchE0GOJuLTVRdd Bm/elwy92THE1gaKanB7JcTqpmr6XXGjz3uvLslhpEmS4N7yjJ6ws+PgceLLcRCIaFn1I5wx8crMJ 4IiCMkZcL3aLy33gsfAi7c5YywQ1tpxV1ED0lrwXCpBFR4UrbBom6VOOCZCsiDWn38cGOYzb+sStb yV64ZrDEKiM80Yl5csQ9ei7GNVOXQ5X0IIL0qPugwK7DHlekdtg801dRTTN8/PWQ0NwA87YciCp+N pc28HA6ys8S2rza4NItZQuS4uHA3F1XjwF9ev7Du3TbfrURvqsAxp6jQ4Df5pG2F7vVWAC0HcOJbG 9pIFJpdmFyZCA8ZWxvaUB5YWFsLmNvb3A+iQJOBBMBCAA4FiEE2Wj0HnZ0+zXcd6qgftogTqV90YQ FAmSv6eUCGwMFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQftogTqV90YRVlxAAj+vCBoaHLbOu Dt0lA03k5Egs61yFlx7qAXk548u5x7i+HcXJeScvnZepS/+yYZ06jwOTvUXcptSGHeoj0QtYFzFp0 5UztNJsqNW9YMl9hrdTx7IMRfFrMdqjr7CjZ5KBDb49EwueRxu/lVa7WbOu0EAfXqSn3Hdq3Wvl7B H26JjG0SoIupC3HHdUMAn/zDyw5e7LIq8tFC1tFrcQVEfiS2BzslppgTViTCqsd6LmAVJ1M+oPRYu FsgftxFUaho1mRFNDWVCx27fsprN2NnLSDadLdOR8YiSp6t6huHR45MViIGxtth4kiJ5LzDcHn6iV v4gov2rgbJvFQ+RFS0xGhJX0GpJMhPadW4gUjt7mSOi8gmFm/fX1k5MdUYD4bRjI48e74d4TWSxJU CSZ7JsHOW8X5MR1s4puq5ZSXFD2ZzyTI6YFEN41cHl91cvn3Xrer6QN7veyxZNFUfIShZLhSDkf46 qUFpiU6yDV8lh86lJMzCOyAaZmLtfcFCg1Su0CAxY1CTCzbNGavrsyWmSIe6ndELXj5ENKaXS0rJ8 ysGvn/w20SdjIJSbnPHKIZC4vqrrw7j7lyv9+lb3JZ8LLVTTULDKFkZ57Z3djz58QNdTvPMncZNUH u/Z17oocQZSGf2j0Rf7snCIOnDGxHSXSwyLc8ztB76XLOKWbV9s8u1K0I8OJbG9pIFJpdmFyZCA8Z WxvaS5yaXZhcmRAbnVibGEuZnI+iQJOBBMBCAA4FiEE2Wj0HnZ0+zXcd6qgftogTqV90YQFAmSv6e wCGwMFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQftogTqV90YTW8w//ajwA/rHmb5JE4C/heFA XPoHKIOMQH07FPvT21F2JgKAGjlK26yQ5c+ppqH/yJK4YinzDboJZ1yE0CormPBXgF+TuCbxfMg4G miT8OCTp7jeMuXfNvm/6dwi0Yv53T7OL3id3n1i4BiK64sDfe5puCOxylVR+k992e6qnCGl/aQge9 ik+Ow7ZH4kgmN2frRVzYeF1XV/F7oq3xRoOSLWxrHkrGTWNQ02luQdfc9pbMcjO6I13t7KrALIx7F II5bqEtC91hnOalgL9QU9NdDLKhOdzozsT59qiClNIri9w7sUN8l2d036cYb9cy2kvy2gvzjBJOik R+5c1FLKHUyLux7IQaVPM/6WiUw/zn1+s/w3vPp+Pe4sk1wyp7wYNrIIovGwc3OzBET37UFX3fhKu oX+DgVWWwUUpJoCW6kxl8UVqJbj0tePfhbuAgLnI0/rbC2wTJvQoCRVQ+Lmn/S9JgoxXu8BbgPJcT HOOQA3jGMzaGoK5LnlTaSSxrPbHCGwCyJJKTRLJyZOggAobJC/Qqy3sDqBNFSuZto/pwPuTJiT4ba s+34fmICKJAMvcPK9JAUEOQ145XB12y08KLYousA2BQ6HhRF8SQLyM9Ss2W+rTtbC7DzWs9unybb0 mUMiS5aqa4/8J+Q+7oYYlA0m53BmkubjpjJKlQhIdKV4nQqk=
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.58.2
MIME-Version: 1.0
Message-ID-Hash: 7KQAO7ZMSH4OWAO23HSY5XBVYZNRFMTI
X-Message-ID-Hash: 7KQAO7ZMSH4OWAO23HSY5XBVYZNRFMTI
X-MailFrom: eloi@yaal.coop
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-scim.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [scim] Relationship between draft-ietf-scim-roles-entitlements and RFC 9068
List-Id: Simple Cloud Identity Management BOF <scim.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/scim/ze7e4hX6Ayd3rwrU_qW2sRJzgzU>
List-Archive: <https://mailarchive.ietf.org/arch/browse/scim>
List-Help: <mailto:scim-request@ietf.org?subject=help>
List-Owner: <mailto:scim-owner@ietf.org>
List-Post: <mailto:scim@ietf.org>
List-Subscribe: <mailto:scim-join@ietf.org>
List-Unsubscribe: <mailto:scim-leave@ietf.org>
Hi,
The RFC 9068 JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens
explicitly refers to the roles and entitlements definitions from RFC
7643:
An authorization server wanting to include such attributes in a JWT
access token SHOULD use the "groups", "roles", and "entitlements"
attributes of the "User" resource schema defined by Section 4.1.2 of
[RFC7643]) as claim types. Authorization servers SHOULD encode the
corresponding claim values according to the guidance defined in
[RFC7643]. [...] No specific vocabulary is provided for "roles" and
"entitlements".
With this draft giving a more precise definition of roles and
entitlements, I wondered what would be the impact for RFC 9068. Should
the access tokens hold the whole SCIM complex attribute representation?
Regards,
Éloi Rivard