Subject: Re: [scim] New SCIM extension drafts published: roles + entitlements & domains

From: "Nancy Cam-Winget (ncamwing)" <[email-masked]>
Date: Wed, 27 Oct 2021 01:20:52 +0000

Hi Danny,
Thanks for submitting some of the ideas and we can help you with template adherence later.

Do you need time to present these extensions at our IETF 112 session?  And if so, how much time do you think you need?
Thanks, Nancy

From: scim <[email-masked]> on behalf of Danny Zollner <Danny.Zollner=[email-masked]>
Date: Monday, October 25, 2021 at 12:46 PM
To: "[email-masked]" <[email-masked]>
Subject: [scim] New SCIM extension drafts published: roles + entitlements & domains

Hi everyone,

I wanted to share two drafts I’ve worked on recently. This is my first attempt at writing internet drafts. I’m aware that both of these drafts are lacking when it comes to proper internet draft structure, section titles, etc and I’ll be attending any available sessions at IETF 112 to learn more about the process and will fix any identified problems with the drafts in a future revision. Even with the structural problems, I wanted to get these published so that feedback can be generated on the technical concepts in them. Both of these aim to improve SCIM client ability to formulate successful requests to SCIM service providers by identifying what values are acceptable ahead of time, rather than discovering this only via failures on POST/PATCH/PUT operations. In a recent SCIM IG meeting it was also suggested that these changes could potentially be folded into a future version of the core schema RFC (RFC 7643 currently).

https://datatracker.ietf.org/doc/draft-zollner-scim-domain-extension/
https://datatracker.ietf.org/doc/draft-zollner-scim-roles-entitlements-extension/

The first draft aims to introduce a way for SCIM service providers to advertise what domain suffixes are acceptable for emails.value and userName(if following [email-masked]<mailto:[email-masked]> format), as a lot of SaaS/multi-tenant apps have proof of ownership-related restrictions on what domains can be used by a customer.

The second draft aims to introduce a way for SCIM service providers to advertise acceptable values for the user resource’s roles and entitlements attributes. By representing these as resources rather than via /schemas canonicalValues, this allows the complex object to be represented – both the “value” and “display” attributes – allowing the SCIM client to represent these more clearly via the friendly “display” value and incorporate them into other logic to determine what roles/entitlements a user resource is given.

Thanks in advance for any feedback!

Danny Zollner

[email-masked]<mailto:[email-masked]>

---

From: Danny Zollner <[email-masked]>
Date: Wed, 27 Oct 2021 19:54:16 +0000

Hi Nancy,

I'll gladly speak to these if time is available - I think 10 to 15 minutes would be adequate. If appropriate, during this time allotment I would like to also raising a few other topics for drafts quickly as a way to generate awareness and involvement. I'll compile that list from my notes and will send it out to this mailing list as well, but if we've got the audience and the available time, it seems like a good way to get involvement in solving some problems.

Thanks,

Danny

From: Nancy Cam-Winget (ncamwing) <ncamwing=[email-masked]>
Sent: Tuesday, October 26, 2021 8:21 PM
To: Danny Zollner <[email-masked]>; [email-masked]
Subject: [EXTERNAL] Re: [scim] New SCIM extension drafts published: roles + entitlements & domains

Hi Danny,

From: scim <[email-masked]<mailto:[email-masked]>> on behalf of Danny Zollner <Danny.Zollner=[email-masked]<mailto:Danny.Zollner=[email-masked]>>
Date: Monday, October 25, 2021 at 12:46 PM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: [scim] New SCIM extension drafts published: roles + entitlements & domains

Hi everyone,

I wanted to share two drafts I've worked on recently. This is my first attempt at writing internet drafts. I'm aware that both of these drafts are lacking when it comes to proper internet draft structure, section titles, etc and I'll be attending any available sessions at IETF 112 to learn more about the process and will fix any identified problems with the drafts in a future revision. Even with the structural problems, I wanted to get these published so that feedback can be generated on the technical concepts in them. Both of these aim to improve SCIM client ability to formulate successful requests to SCIM service providers by identifying what values are acceptable ahead of time, rather than discovering this only via failures on POST/PATCH/PUT operations. In a recent SCIM IG meeting it was also suggested that these changes could potentially be folded into a future version of the core schema RFC (RFC 7643 currently).

https://datatracker.ietf.org/doc/draft-zollner-scim-domain-extension/<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-zollner-scim-domain-extension%2F&data=04%7C01%7CDanny.Zollner%40microsoft.com%7C216781aa821e453f14b908d998e80a20%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637708944742893037%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=lqvH6Nu9IPMKkEw7g%2Be2fov5WgqjUuC2AQ1kQwy7P4o%3D&reserved=0>
https://datatracker.ietf.org/doc/draft-zollner-scim-roles-entitlements-extension/<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-zollner-scim-roles-entitlements-extension%2F&data=04%7C01%7CDanny.Zollner%40microsoft.com%7C216781aa821e453f14b908d998e80a20%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637708944742893037%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=cOWrNgeNOjcHN8l2D%2BgGPJFvhJ08UY6c2%2FCTOIhkvPQ%3D&reserved=0>

The second draft aims to introduce a way for SCIM service providers to advertise acceptable values for the user resource's roles and entitlements attributes. By representing these as resources rather than via /schemas canonicalValues, this allows the complex object to be represented - both the "value" and "display" attributes - allowing the SCIM client to represent these more clearly via the friendly "display" value and incorporate them into other logic to determine what roles/entitlements a user resource is given.

Danny Zollner