Subject: [scim] Porposed charter

From: "Morteza Ansari (moransar)" <[email-masked]>
Date: Wed, 8 Feb 2012 21:32:58 -0600

Hi folks,

Here is the proposed charter as we discussed over the cloud-directory
mailing list. Please review and send your comments.

Cheers,

Morteza

Simplified Cloud Identity Management (SCIM)

--------------------------------------------------------

Charter

Current Status: BOF Request

Chair(s):

     TBD1

     TBD2

Applications Area Director(s):

     Pete Resnick <[email-masked]> 

     Peter Saint-Andre <[email-masked]>

Mailing Lists:

     General Discussion: [email-masked]

     To Subscribe:     https://www.ietf.org/mailman/listinfo/scim

     Archive:
http://www.ietf.org/mail-archive/web/scim/current/maillist.html

Description of Working Group:

The Simple Cloud Identity Management (SCIM) specification is designed to
make managing user identity lifecycle in cloud based applications and
services easier.

The specification suite seeks to build upon experience with existing
schemas and deployments, placing specific emphasis on simplicity of
development and integration, while applying existing authentication,
authorization, and privacy models. Its intent is to reduce the cost and
complexity of user management operations by providing a common user
schema and extension model, as well as binding documents to provide
patterns for exchanging this schema using standard protocols.

The group will work to adapt the SCIM 1.0 specification produced under
the Open Web Foundation framework (http://www.simplecloud.info) as an
IETF technology for management of user identities in cloud-based
applications.

SCIM 1.0 consists of:

*         Schema definition for identity related objects

*         Protocol definition for accessing and managing the identity
objects

*         Binding of SCIM schema to Security Assertion Markup Language
(SAML) messages and assertions

*         Binding of SCIM schema to Lightweight Directory Access
Protocol (LDAP) schema (RFC4519)

The Working Group will produce one or more documents suitable for
consideration as a Proposed Standard that will:

*         Improve the terminology used

*         Embody good security practices, document gaps in its
capabilities, and propose a path forward for addressing the gaps

*         Promote interoperability

*         Provide guidelines for extensibility

SCIM 1.0 will be used as the starting point. The working group will
strive to retain backward compatibility with the 1.0 specification.
Changes that are not backwards compatible may be accepted if the group
determines changes are required to meet the group's technical objectives
and the group clearly documents the reasons for making them.

The Working Group should consider:

*         Implementer experience

*         The end-user experience, including internationalization

*         Existing uses of SCIM

*         Ability to achieve broad implementation

*         Ability to address broader use cases than those considered by
the original authors

*         Additional functions or extensions that are needed to address
key security concerns, cross-area review, and implementer feedback

The working group will focus on adapting the core technology first but
work on extensions will be considered after the core work is well in
hand.

---

From: "Lipton, Paul C" <[email-masked]>
Date: Thu, 9 Feb 2012 03:41:00 +0000

Hi all,

I realize that I am not a SCIM-er, but I've done some charters before. In the spirit of being helpful, may I point out that one most important part of a charter is the "Out of Scope" section. This not only helps focus the group and fights "scope creep," but helps protect participants from unanticipated IP obligations. 

Just a thought. 

Regards,
Paul 
 
Paul Lipton
CA Technologies
VP, Industry Standards and Open Source 
Member, CA Council for Technical Excellence 
Office Phone: +1 609 583-9718
Mobile: +1 267 987-6887
Email: [email-masked]

===

From: [email-masked] [mailto:[email-masked]] On Behalf Of Morteza Ansari (moransar)
Sent: Wednesday, February 08, 2012 10:33 PM
To: [email-masked]
Subject: [scim] Porposed charter

Hi folks,

Here is the proposed charter as we discussed over the cloud-directory mailing list. Please review and send your comments.

Cheers,
Morteza

Charter

Chair(s):
     TBD1
     TBD2

Mailing Lists:
     General Discussion: [email-masked]
     To Subscribe:     https://www.ietf.org/mailman/listinfo/scim
     Archive:               http://www.ietf.org/mail-archive/web/scim/current/maillist.html

The Simple Cloud Identity Management (SCIM) specification is designed to make managing user identity lifecycle in cloud based applications and services easier.

The specification suite seeks to build upon experience with existing schemas and deployments, placing specific emphasis on simplicity of development and integration, while applying existing authentication, authorization, and privacy models. Its intent is to reduce the cost and complexity of user management operations by providing a common user schema and extension model, as well as binding documents to provide patterns for exchanging this schema using standard protocols.

The group will work to adapt the SCIM 1.0 specification produced under the Open Web Foundation framework (http://www.simplecloud.info) as an IETF technology for management of user identities in cloud-based applications.

SCIM 1.0 consists of:
. Schema definition for identity related objects
. Protocol definition for accessing and managing the identity objects
. Binding of SCIM schema to Security Assertion Markup Language (SAML) messages and assertions
. Binding of SCIM schema to Lightweight Directory Access Protocol (LDAP) schema (RFC4519)

The Working Group will produce one or more documents suitable for consideration as a Proposed Standard that will:
. Improve the terminology used
. Embody good security practices, document gaps in its capabilities, and propose a path forward for addressing the gaps
. Promote interoperability
. Provide guidelines for extensibility

SCIM 1.0 will be used as the starting point. The working group will strive to retain backward compatibility with the 1.0 specification. Changes that are not backwards compatible may be accepted if the group determines changes are required to meet the group's technical objectives and the group clearly documents the reasons for making them.

The Working Group should consider:
. Implementer experience
. The end-user experience, including internationalization
. Existing uses of SCIM
. Ability to achieve broad implementation
. Ability to address broader use cases than those considered by the original authors
. Additional functions or extensions that are needed to address key security concerns, cross-area review, and implementer feedback

The working group will focus on adapting the core technology first but work on extensions will be considered after the core work is well in hand.

---

From: "Morteza Ansari (moransar)" <[email-masked]>
Date: Wed, 8 Feb 2012 21:58:11 -0600

Thanks Paul, this is exactly why we wanted to discuss the draft charter here. Excellent point, I can take a shot at adding that, but would be great if others throw in suggestions on what should be excluded.

Cheers,
Morteza

-----Original Message-----
From: Lipton, Paul C [mailto:[email-masked]] 
Sent: Wednesday, February 08, 2012 7:41 PM
To: Morteza Ansari (moransar); [email-masked]
Subject: RE: Porposed charter

Hi all,

Just a thought. 

Regards,
Paul 
 
Paul Lipton
CA Technologies
VP, Industry Standards and Open Source
Member, CA Council for Technical Excellence Office Phone: +1 609 583-9718
Mobile: +1 267 987-6887
Email: [email-masked]

===

Hi folks,

Cheers,
Morteza

Charter

Chair(s):
     TBD1
     TBD2

Mailing Lists:

SCIM 1.0 consists of:
. Schema definition for identity related objects . Protocol definition for accessing and managing the identity objects . Binding of SCIM schema to Security Assertion Markup Language (SAML) messages and assertions . Binding of SCIM schema to Lightweight Directory Access Protocol (LDAP) schema (RFC4519)

The Working Group will produce one or more documents suitable for consideration as a Proposed Standard that will:
. Improve the terminology used
. Embody good security practices, document gaps in its capabilities, and propose a path forward for addressing the gaps . Promote interoperability . Provide guidelines for extensibility

The Working Group should consider:
. Implementer experience
. The end-user experience, including internationalization . Existing uses of SCIM . Ability to achieve broad implementation . Ability to address broader use cases than those considered by the original authors . Additional functions or extensions that are needed to address key security concerns, cross-area review, and implementer feedback

---

From: Kelly Grizzle <[email-masked]>
Date: Thu, 9 Feb 2012 14:19:11 +0000

Generally, I think the charter looks good.  As far as what is "out of scope", I would say that things that we explicitly left as opaque in the 1.0 spec should stay that way.  For example, the exact format for entitlements is unspecified - it may be a URN, an XACML string, or something else.  I don't think that SCIM should try to solve the problem of how to format entitlements.  We should leverage existing specs if we go there.

Also, my preference is to keep the core constrained to primarily identity and security-related objects - identities, groups, possibly roles, etc...  Things outside of this (ie - machines, etc...) should probably be an extension, although in some cases we might have an "official" extensions.

--Kelly

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Morteza Ansari (moransar)
Sent: Wednesday, February 08, 2012 9:58 PM
To: Lipton, Paul C; [email-masked]
Subject: Re: [scim] Porposed charter

Cheers,
Morteza

-----Original Message-----
From: Lipton, Paul C [mailto:[email-masked]] 
Sent: Wednesday, February 08, 2012 7:41 PM
To: Morteza Ansari (moransar); [email-masked]
Subject: RE: Porposed charter

Hi all,

Just a thought. 

Regards,
Paul 
 
Paul Lipton
CA Technologies

===

Hi folks,

Cheers,
Morteza

Charter

Chair(s):
     TBD1
     TBD2

Mailing Lists:

SCIM 1.0 consists of:

The working group will focus on adapting the core technology first but work on extensions will be considered after the core work is well in hand.
_______________________________________________
scim mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/scim

---

From: Samuel Erdtman <[email-masked]>
Date: Thu, 9 Feb 2012 21:19:43 +0100

Looks good buy some thoughts, don't know if they are relevant or just
a result of my lack of knowledge.

Feels like there is different abstraction levels in sections "SCIM 1.0
consists of" and "The Working Group will produce one or more documents
suitable for consideration as a Proposed Standard that will". The
section on how to proceed feels very abstract would it bee good to
mention concrete things like a OpenId Connect binding etc.

Further is it SCIM 2.0 that we aim to develop under IETF or is it a
IETF approved version of 1.0?

I like the section on working group should consider stuff.

Regards
//Samuel

On Thu, Feb 9, 2012 at 4:32 AM, Morteza Ansari (moransar)
<[email-masked]> wrote:
> The specification suite seeks to build upon experience with existing schemas
> and deployments, placing specific emphasis on simplicity of development and
> integration, while applying existing authentication, authorization, and
> privacy models. Its intent is to reduce the cost and complexity of user
> management operations by providing a common user schema and extension model,
> as well as binding documents to provide patterns for exchanging this schema
> using standard protocols.
>
>
>
> The group will work to adapt the SCIM 1.0 specification produced under the
> Open Web Foundation framework (http://www.simplecloud.info) as an IETF
> technology for management of user identities in cloud-based applications.
>
>
>
> SCIM 1.0 consists of:
>
> ·         Schema definition for identity related objects
>
> ·         Protocol definition for accessing and managing the identity
> objects
>
> ·         Binding of SCIM schema to Security Assertion Markup Language
> ·         Binding of SCIM schema to Lightweight Directory Access Protocol
> (LDAP) schema (RFC4519)
>
>
>
> ·         Improve the terminology used
>
> ·         Embody good security practices, document gaps in its capabilities,
> and propose a path forward for addressing the gaps
>
> ·         Promote interoperability
>
> ·         Provide guidelines for extensibility
>
>
>
> SCIM 1.0 will be used as the starting point. The working group will strive
> to retain backward compatibility with the 1.0 specification. Changes that
> are not backwards compatible may be accepted if the group determines changes
> are required to meet the group's technical objectives and the group clearly
> documents the reasons for making them.
>
>
>
> ·         Implementer experience
> ·         The end-user experience, including internationalization
>
> ·         Existing uses of SCIM
>
> ·         Ability to achieve broad implementation
>
> ·         Ability to address broader use cases than those considered by the
> original authors
>
> ·         Additional functions or extensions that are needed to address key
> security concerns, cross-area review, and implementer feedback
>
>
>
> The working group will focus on adapting the core technology first but work
> on extensions will be considered after the core work is well in hand.
>
>

---

From: "Morteza Ansari (moransar)" <[email-masked]>
Date: Thu, 9 Feb 2012 18:30:31 -0600

I like the idea of excluding entitlement semantics and in general policy from the charter and I think at least the folks that were involved with SCIM 1.0 also agreed on that. I can add that to the charter.

On the "device" identity I am not so sure. I think there were a lot of interest in "device" identity aspect of things but we decided to exclude it in 1.0 project to get to a final spec sooner. I would like to hear what others think on this front before deciding one way or another.

Personally speaking, I would like to keep that within the scope of the WG charter.

Cheers,
Morteza

-----Original Message-----
From: Kelly Grizzle [mailto:[email-masked]] 
Sent: Thursday, February 09, 2012 6:19 AM
To: Morteza Ansari (moransar); Lipton, Paul C; [email-masked]
Subject: RE: Porposed charter

--Kelly

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Morteza Ansari (moransar)
Sent: Wednesday, February 08, 2012 9:58 PM
To: Lipton, Paul C; [email-masked]
Subject: Re: [scim] Porposed charter

Cheers,
Morteza

-----Original Message-----
From: Lipton, Paul C [mailto:[email-masked]] 
Sent: Wednesday, February 08, 2012 7:41 PM
To: Morteza Ansari (moransar); [email-masked]
Subject: RE: Porposed charter

Hi all,

Just a thought. 

Regards,
Paul 
 
Paul Lipton
CA Technologies

===

Hi folks,

Cheers,
Morteza

Charter

Chair(s):
     TBD1
     TBD2

Mailing Lists:

SCIM 1.0 consists of:

---

From: "Morteza Ansari (moransar)" <[email-masked]>
Date: Thu, 9 Feb 2012 19:35:53 -0600

Samuel,

I wasn't sure how detailed we want to get in the charter. For example, do we want to put in a listing of all the bindings we want to include?  I don't know the answer and am happy to go either way.

Also, I am not sure I fully understand your second question. The IETF work will be based on the work we did on SCIM 1.0 and certainly evolve from that, but it will be work that will be developed following IETF processes and model. The WG will decide if the result is SCIM 2.0 or some other designation.

Cheers,
Morteza 

-----Original Message-----
From: Samuel Erdtman [mailto:[email-masked]] 
Sent: Thursday, February 09, 2012 12:20 PM
To: Morteza Ansari (moransar)
Cc: [email-masked]
Subject: Re: [scim] Porposed charter

Looks good buy some thoughts, don't know if they are relevant or just a result of my lack of knowledge.

Feels like there is different abstraction levels in sections "SCIM 1.0 consists of" and "The Working Group will produce one or more documents suitable for consideration as a Proposed Standard that will". The section on how to proceed feels very abstract would it bee good to mention concrete things like a OpenId Connect binding etc.

Further is it SCIM 2.0 that we aim to develop under IETF or is it a IETF approved version of 1.0?

Regards
//Samuel

On Thu, Feb 9, 2012 at 4:32 AM, Morteza Ansari (moransar) <[email-masked]> wrote:
> The Simple Cloud Identity Management (SCIM) specification is designed 
> to make managing user identity lifecycle in cloud based applications 
> and services easier.
>
>
>
> authorization, and privacy models. Its intent is to reduce the cost 
> and complexity of user management operations by providing a common 
> user schema and extension model, as well as binding documents to 
> provide patterns for exchanging this schema using standard protocols.
>
>
>
> IETF technology for management of user identities in cloud-based applications.
>
>
>
> SCIM 1.0 consists of:
>
> ·         Embody good security practices, document gaps in its 
> determines changes are required to meet the group's technical 
> objectives and the group clearly documents the reasons for making them.
>
>
>
> ·         Ability to address broader use cases than those considered 
> by the original authors
>
> ·         Additional functions or extensions that are needed to 
> address key security concerns, cross-area review, and implementer 
> feedback
>
>
>
> work on extensions will be considered after the core work is well in hand.
>
>

---

From: Tina TSOU <[email-masked]>
Date: Fri, 10 Feb 2012 01:40:49 +0000

Sent from my iPad

> Also, I am not sure I fully understand your second question. The IETF work will be based on the work we did on SCIM 1.0 and certainly evolve from that, but it will be work that will be developed fo…
Agree with Morteza.

---

From: Samuel Erdtman <[email-masked]>
Date: Fri, 10 Feb 2012 08:26:33 +0100

Thanks Morteza, that clearifies

Regards
//Samuel

---

From: Trey Drake <[email-masked]>
Date: Fri, 10 Feb 2012 07:15:29 -0600

I would prefer to leave the schema open ended.  Recall, we consciously kept the API and messaging schema clean to preserve our ability to extend beyond basic constructs like User and Group.  IMO, "Device" and the like are in scope.

---

From: Trey Drake <[email-masked]>
Date: Fri, 10 Feb 2012 07:25:02 -0600

Re-post to the clouddirectory WG mailing list.  It appears we should cross-post to the ietf and clouddirectory (there are > 250 members on the Google Group mailing list and I'm assuming far less on ietf) lists lest we lose community input. 

Thanks,
Trey