Subject: [scim] Scope change request

From: Phil Hunt <[email-masked]>
Date: Thu, 29 Mar 2012 13:56:53 +0200

I would like to request that the Targeting proposal presented today at the BoF be added to the charter for consideration.

A draft proposal has been submitted (new this week --> draft-hunt-scim-targeting) which shows how targeting could be done.

A brief summary:  When provisioning to a service provider that has multiple applications that may be provisioned, there are 3 alternatives:

1.  Use schema extensions to objects (e.g. entitlements) to infer app requests
2.  Use separate domains and implement app specific endpoints (or combined multi-homed service)
3.  Use targeting for a RESTful explicit approach.

Item 1 IMHO leads to complexity and future inter-op problems.  Instead it is better to keep SCIM requests simple and app-specific.

As far as 2 and 3 goes, the proposal difference is:

app-tennantid.scim.cloud.com/Users/xxxxxx
vs.
scim.cloud.com/Targets/app-tennantid/Users/xxxxxx

The first one requires many more certificates to be issued and leads to complexity for things like proxies and load-balancers.  Putting the app target in the path is going to be logistically much easier to manage. It also means the semantics of the transaction are simplified because the operation is now focused on a specific application target.

I submitted the draft only to get the ball rolling and am very open to other ideas. I do however feel that this requirement is a deliverable that the IETF SCIM WG should address in the first round of specifications.

Phil

@independentid
www.independentid.com
[email-masked]