Subject: [scim] How to specify core supported attributes?

From: Aleksey Chernoraenko <[email-masked]>
Date: Mon, 5 Feb 2018 09:25:22 -0600

​​
Hello,

We are implementing SCIM Resource Provider for Users, Groups and a couple
of custom resources.
SCIM Core Schema RFC 7643 defines User resource so, that only userName and
core attributes (id, schemas) are required. Plus it defines optional
attributes like name, profileUrl, etc.

Some optional attributes do not make sense in our context (e.g. ims) or are
not supported or very expensive to be supported.
>From the other hand, other optional attributes like name should be
"required" and should be returned "always".

What is the recommended way to express this, so that the clients would know
what attributes should be provided?
As much I understand rfc, we should provide the adjusted, tweaked version
of core User schema on /Schemas endpoint. Is it correct way?
Would it make our Provider "none SCIM compliant"?

---
Thank you,
Alexei

---

From: Phil Hunt <[email-masked]>
Date: Mon, 5 Feb 2018 09:57:46 -0800

Aleksey,

This happens a lot particularly when adapting SCIM protocol on top of applications (e.g. payroll, HCM, CRM, etc). Each app has data they care about that is a sub-set of what is seen in IDM systems. The point of 7643 is really to define standard attribute names, types, syntax, and handling that developers can count on.

IMO, you do not have to implement the schema exactly as published in 7643.  It is quite common practice to omit attributes (e.g. such as an app that doesn’t care about ims). Note that renaming standard attributes or changing their formats will produce interop concerns.

Use the extension mechanism to define your own app specific attributes (see section 3.3 of 7643 and 4.3 for the EnterpriseUser example).

You are free to omit unused attributes from your schema.  You document what your server actually supports in the /Schemas endpoint.

Taken in combination with RFC7644’s “robust approach", when a client sends you an attribute your server does not care about, the server is free to ignore the data  — without throwing an error.  And likewise clients should not expect a server to regurgitate a record exactly as presented. 

Hope this helps clarify.

Phil

Oracle Corporation, Identity Cloud Services Architect
@independentid
www.independentid.com <http://www.independentid.com/>[email-masked] <mailto:[email-masked]>

> On Feb 5, 2018, at 7:25 AM, Aleksey Chernoraenko <[email-masked]> wrote:
> 
> ​​Hello,
> 
> We are implementing SCIM Resource Provider for Users, Groups and a couple of custom resources.
> SCIM Core Schema RFC 7643 defines User resource so, that only userName and core attributes (id, schemas) are required. Plus it defines optional attributes like name, profileUrl, etc.
> 
> Some optional attributes do not make sense in our context (e.g. ims) or are not supported or very expensive to be supported.
> From the other hand, other optional attributes like name should be "required" and should be returned "always".
> 
> What is the recommended way to express this, so that the clients would know what attributes should be provided?
> As much I understand rfc, we should provide the adjusted, tweaked version of core User schema on /Schemas endpoint. Is it correct way?
> _______________________________________________
> scim mailing list
> [email-masked]
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_scim&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=GLhVp9jP_gbDtVJtxohNMMwBzQnt7GFCvPsGsT583vo&s=RMMu2R0XXu75jgdfyFcraH-_VCJ9gqmAoEmo6z9VnPU&e=