Subject: Re: [scim] Porposed charter

From: "Morteza Ansari (moransar)" <[email-masked]>
Date: Mon, 12 Mar 2012 00:17:49 -0500

Good suggestion Phil.  I added a new item under the WG consideration
section: "Work done by other standard bodies as input to the process
such as OASIS Provisioning TC" but I didn't add any specific items that
should be considered. I think it would be best to leave that to the WG
to study the work you referenced and decide what items should be
considered.

Do you think that is sufficient?

Cheers,

Morteza

From: Phil Hunt [mailto:[email-masked]] 
Sent: Thursday, February 23, 2012 3:25 PM
To: [email-masked]; Morteza Ansari (moransar)
Subject: Re: [scim] Porposed charter

Morteza, 

Very happy to see the SCIM WG is starting soon!

Regarding the charter, I propose that the working group also adopt the
following OASIS Provisioning TC documents as input material:

* A RESTful Binding to SPML
<http://wiki.oasis-open.org/provision/restpml>  -
http://wiki.oasis-open.org/provision/restpml

* SIMPLEST: A standard schema for Identity and Access Management
<http://wiki.oasis-open.org/provision/simplest>  -
http://wiki.oasis-open.org/provision/simplest

These documents can provide some additional implementation insight into
the final SCIM WG product.

Based on the OASIS Provisioning TC experience, there are some additional
cloud requirements that could be added into SCIM 1.0, hopefully in a
straightforward, backwards compatible way. 

The key items are:

* Support for multiple targets within a SCIM service provider

* A change to schema introducing a Person entity which for example is
associated with one or more User entities.

The first item arises out of some practical deployment architecture
issues, the latter arises from an attestation issue that arises
regarding tracking what user accounts are associated with individuals --
especially when they have more than one User account. For those that
want to read ahead now, I suggest reading:

http://wiki.oasis-open.org/provision/simplest#AccountManagement.3ATarget
andAccount

I propose to present on these two topics at the BoF and then based on
feedback can contribute the content in draft form into the WG for its
consideration.

Regards,

Phil

@independentid

www.independentid.com <http://www.independentid.com/> 

[email-masked]

________________________________

*	From: "Morteza Ansari (moransar)" <moransar at cisco.com
<mailto:[email-masked]> >
*	To: <scim at ietf.org <mailto:[email-masked]> >
*	Date: Wed, 8 Feb 2012 21:32:58 -0600
*	List-id: Simple Cloud Identity Management BOF <scim.ietf.org
<http://scim.ietf.org/> >

________________________________

Hi folks,

Here is the proposed charter as we discussed over the cloud-directory
mailing list. Please review and send your comments.

Cheers,

Morteza

Simplified Cloud Identity Management (SCIM)

--------------------------------------------------------

Charter

Current Status: BOF Request

Chair(s):

     TBD1

     TBD2

Applications Area Director(s):

     Pete Resnick <presnick at qualcomm.com <http://qualcomm.com/> >

     Peter Saint-Andre <stpeter at stpeter.im>

Mailing Lists:

     General Discussion: scim at ietf.org <http://ietf.org/> 

     To Subscribe:     https://www.ietf.org/mailman/listinfo/scim

     Archive:
http://www.ietf.org/mail-archive/web/scim/current/maillist.html

Description of Working Group:

The Simple Cloud Identity Management (SCIM) specification is designed to
make managing user identity lifecycle in cloud based applications and
services easier.

The specification suite seeks to build upon experience with existing
schemas and deployments, placing specific emphasis on simplicity of
development and integration, while applying existing authentication,
authorization, and privacy models. Its intent is to reduce the cost and
complexity of user management operations by providing a common user
schema and extension model, as well as binding documents to provide
patterns for exchanging this schema using standard protocols.

The group will work to adapt the SCIM 1.0 specification produced under
the Open Web Foundation framework (http://www.simplecloud.info
<http://www.simplecloud.info/> ) as an IETF technology for management of
user identities in cloud-based applications.

SCIM 1.0 consists of:

*         Schema definition for identity related objects

*         Protocol definition for accessing and managing the identity
objects

*         Binding of SCIM schema to Security Assertion Markup Language
(SAML) messages and assertions

*         Binding of SCIM schema to Lightweight Directory Access
Protocol (LDAP) schema (RFC4519)

The Working Group will produce one or more documents suitable for
consideration as a Proposed Standard that will:

*         Improve the terminology used

*         Embody good security practices, document gaps in its
capabilities, and propose a path forward for addressing the gaps

*         Promote interoperability

*         Provide guidelines for extensibility

SCIM 1.0 will be used as the starting point. The working group will
strive to retain backward compatibility with the 1.0 specification.
Changes that are not backwards compatible may be accepted if the group
determines changes are required to meet the group's technical objectives
and the group clearly documents the reasons for making them.

The Working Group should consider:

*         Implementer experience

*         The end-user experience, including internationalization

*         Existing uses of SCIM

*         Ability to achieve broad implementation

*         Ability to address broader use cases than those considered by
the original authors

*         Additional functions or extensions that are needed to address
key security concerns, cross-area review, and implementer feedback

The working group will focus on adapting the core technology first but
work on extensions will be considered after the core work is well in
hand.

---

From: Phil Hunt <[email-masked]>
Date: Mon, 12 Mar 2012 15:46:15 -0700

Morteza,

I think that sounds reasonable.

I would like time to present at the BoF so that the WG may consider additional requirements for the charter at that time.

I will also post a blog post outlining the issue in advance of the BoF to help get everyone up to speed.

Cheers,

Phil

@independentid
www.independentid.com
[email-masked]

On 2012-03-11, at 10:17 PM, Morteza Ansari (moransar) wrote:

> Good suggestion Phil.  I added a new item under the WG consideration section: “Work done by other standard bodies as input to the process such as OASIS Provisioning TC” but I didn’t add any specific items that should be considered. I think it would be best to leave that to the WG to study the work you referenced and decide what items should be considered.
>  
> Regarding the charter, I propose that the working group also adopt the following OASIS Provisioning TC documents as input material:
> * A RESTful Binding to SPML - http://wiki.oasis-open.org/provision/restpml
> * SIMPLEST: A standard schema for Identity and Access Management - http://wiki.oasis-open.org/provision/simplest
> These documents can provide some additional implementation insight into the final SCIM WG product.
>  
> Based on the OASIS Provisioning TC experience, there are some additional cloud requirements that could be added into SCIM 1.0, hopefully in a straightforward, backwards compatible way. 
>  
> The key items are:
> * A change to schema introducing a Person entity which for example is associated with one or more User entities.
>  
> The first item arises out of some practical deployment architecture issues, the latter arises from an attestation issue that arises regarding tracking what user accounts are associated with individuals -- especially when they have more than one User account. For those that want to read ahead now, I suggest reading:
> http://wiki.oasis-open.org/provision/simplest#AccountManagement.3ATargetandAccount
>  
> I propose to present on these two topics at the BoF and then based on feedback can contribute the content in draft form into the WG for its consideration.
>  
> Regards,
>  
> Phil
>  
> @independentid
> www.independentid.com
> [email-masked]
> 
>  
> From: "Morteza Ansari (moransar)" <moransar at cisco.com>
> To: <scim at ietf.org>
> Date: Wed, 8 Feb 2012 21:32:58 -0600
> List-id: Simple Cloud Identity Management BOF <scim.ietf.org>
> Hi folks,
>  
> Here is the proposed charter as we discussed over the cloud-directory mailing list. Please review and send your comments.
>  
>  
> Cheers,
> Morteza
>  
>  
>      Pete Resnick <presnick at qualcomm.com>
> 
>      General Discussion: scim at ietf.org
> 
>      Archive:               http://www.ietf.org/mail-archive/web/scim/current/maillist.html
> 
>  
> 
> The Simple Cloud Identity Management (SCIM) specification is designed to make managing user identity lifecycle in cloud based applications and services easier.
> 
>  
> 
> The specification suite seeks to build upon experience with existing schemas and deployments, placing specific emphasis on simplicity of development and integration, while applying existing authentication, authorization, and privacy models. Its intent is to reduce the cost and complexity of user management operations by providing a common user schema and extension model, as well as binding documents to provide patterns for exchanging this schema using standard protocols.
> 
>  
> 
> The group will work to adapt the SCIM 1.0 specification produced under the Open Web Foundation framework (http://www.simplecloud.info) as an IETF technology for management of user identities in cloud-based applications.
> 
>  
> 
> SCIM 1.0 consists of:
> 
> ·         Schema definition for identity related objects
> 
> ·         Protocol definition for accessing and managing the identity objects
> 
> ·         Binding of SCIM schema to Security Assertion Markup Language (SAML) messages and assertions
> 
> ·         Binding of SCIM schema to Lightweight Directory Access Protocol (LDAP) schema (RFC4519)
> 
>  
> 
> The Working Group will produce one or more documents suitable for consideration as a Proposed Standard that will:
> 
> ·         Improve the terminology used
> 
> ·         Embody good security practices, document gaps in its capabilities, and propose a path forward for addressing the gaps
> 
> ·         Promote interoperability
> 
> ·         Provide guidelines for extensibility
> 
>  
> 
> SCIM 1.0 will be used as the starting point. The working group will strive to retain backward compatibility with the 1.0 specification. Changes that are not backwards compatible may be accepted if the group determines changes are required to meet the group's technical objectives and the group clearly documents the reasons for making them.
> 
>  
> 
> ·         Implementer experience
> ·         The end-user experience, including internationalization
> 
> ·         Existing uses of SCIM
> 
> ·         Ability to achieve broad implementation
> 
> ·         Ability to address broader use cases than those considered by the original authors
> 
> ·         Additional functions or extensions that are needed to address key security concerns, cross-area review, and implementer feedback
> 
>  
> 
> The working group will focus on adapting the core technology first but work on extensions will be considered after the core work is well in hand.
> 
>  
>  
>  
> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim

---

From: "Morteza Ansari (moransar)" <[email-masked]>
Date: Mon, 12 Mar 2012 19:41:37 -0500

I think that makes sense.

Eliot, can we carve up some time on the agenda for this?

Cheers,

Morteza

From: Phil Hunt [mailto:[email-masked]] 
Sent: Monday, March 12, 2012 3:46 PM
To: Morteza Ansari (moransar)
Cc: [email-masked]
Subject: Re: [scim] Porposed charter

Morteza,

I would like time to present at the BoF so that the WG may consider
additional requirements for the charter at that time.

I will also post a blog post outlining the issue in advance of the BoF
to help get everyone up to speed.

Cheers,

Phil

@independentid

www.independentid.com

[email-masked]

 

Cheers,

Morteza

Morteza, 

The key items are:

Regards,

Phil

@independentid

[email-masked]

Hi folks,

 

Cheers,

Morteza

Charter

Chair(s):

     TBD1

     TBD2

Mailing Lists:

     Archive:

SCIM 1.0 consists of:

*         Implementer experience

*         Existing uses of SCIM

---

From: Eliot Lear <[email-masked]>
Date: Tue, 13 Mar 2012 10:05:45 +0100

Phil, Morteza,

My first preference would be that the two of you work together to
consolidate such a presentation.  I also think it would be very helpful,
Phil, if you could first articulate those requirements on this list.

Eliot

On 3/12/12 11:46 PM, Phil Hunt wrote:
> www.independentid.com <http://www.independentid.com>
> [email-masked] <mailto:[email-masked]>
>
>
>
>
>
>> section: “Work done by other standard bodies as input to the process
>> such as OASIS Provisioning TC” but I didn’t add any specific items
>> that should be considered. I think it would be best to leave that to
>> the WG to study the work you referenced and decide what items should
>> be considered.
>>  
>> *From:* Phil Hunt [mailto:[email-masked]] 
>> *Sent:* Thursday, February 23, 2012 3:25 PM
>> *To:* [email-masked] <mailto:[email-masked]>; Morteza Ansari (moransar)
>> *Subject:* Re: [scim] Porposed charter
>>  
>> Morteza, 
>>  
>> Regarding the charter, I propose that the working group also adopt
>> the following OASIS Provisioning TC documents as input material:
>> <http://wiki.oasis-open.org/provision/restpml> - http://wiki.oasis-open.org/provision/restpml
>> <http://wiki.oasis-open.org/provision/simplest> - http://wiki.oasis-open.org/provision/simplest
>> Based on the OASIS Provisioning TC experience, there are some
>> additional cloud requirements that could be added into SCIM 1.0,
>> hopefully in a straightforward, backwards compatible way. 
>>  
>> The key items are:
>> regarding tracking what user accounts are associated with individuals
>> -- especially when they have more than one User account. For those
>> that want to read ahead now, I suggest reading:
>> [email-masked] <mailto:[email-masked]>
>>
>>  
>> ------------------------------------------------------------------------
>>
>>   * /From/: "Morteza Ansari (moransar)" <moransar at cisco.com
>>     <mailto:[email-masked]>>
>>   * /To/: <scim at ietf.org <mailto:[email-masked]>>
>>   * /Date/: Wed, 8 Feb 2012 21:32:58 -0600
>>   * /List-id/: Simple Cloud Identity Management BOF <scim.ietf.org
>>     <http://scim.ietf.org/>>
>>
>> ------------------------------------------------------------------------
>> Hi folks,
>>  
>>      Pete Resnick <presnick at qualcomm.com <http://qualcomm.com/>>
>>
>> The Simple Cloud Identity Management (SCIM) specification is designed
>> to make managing user identity lifecycle in cloud based applications
>> and services easier.
>>
>>  
>>
>> authorization, and privacy models. Its intent is to reduce the cost
>> and complexity of user management operations by providing a common
>> user schema and extension model, as well as binding documents to
>> provide patterns for exchanging this schema using standard protocols.
>>
>>  
>>
>> The group will work to adapt the SCIM 1.0 specification produced
>> under the Open Web Foundation framework (http://www.simplecloud.info
>> <http://www.simplecloud.info/>) as an IETF technology for management
>> of user identities in cloud-based applications.
>>
>>  
>>
>> SCIM 1.0 consists of:
>>
>> ·         Embody good security practices, document gaps in its
>> Changes that are not backwards compatible may be accepted if the
>> group determines changes are required to meet the group's technical
>> objectives and the group clearly documents the reasons for making them.
>>
>>  
>>
>> ·         Additional functions or extensions that are needed to
>> address key security concerns, cross-area review, and implementer
>> feedback
>>
>>  
>>
>> The working group will focus on adapting the core technology first
>> but work on extensions will be considered after the core work is well
>> in hand.
>>
>>  
>>  
>>  
>> [email-masked] <mailto:[email-masked]>