Subject: [scim] Updated draft charter

From: "Morteza Ansari (moransar)" <[email-masked]>
Date: Mon, 12 Mar 2012 00:16:44 -0500

Attached is the updated charter based on the discussion so far. I
believe I have addressed all comments with the exception of part of Phil
Hunt's comment which I just sent a reply to.

Also I started another thread to discuss deliverables section of the
charter. Once we discuss that, I will add that section.

Please review and send any suggestion/correction.

Cheers,

Morteza

Simple Cloud Identity Management (SCIM)

---------------------------------------

Charter

Current Status: BOF Approved

BoF Chair(s):

     Steve Bellovi

     Eliot Lear

Applications Area Director(s):

     Pete Resnick <[email-masked]> 

     Peter Saint-Andre <[email-masked]>

Mailing Lists:

     General Discussion: [email-masked]

     To Subscribe: https://www.ietf.org/mailman/listinfo/scim

     Archive:
http://www.ietf.org/mail-archive/web/scim/current/maillist.html

Description of Working Group:

The Simple Cloud Identity Management (SCIM) specification is designed to
make managing user identity lifecycle in cloud based applications and
services easier.

The specification suite seeks to build upon experience with existing
schemas and deployments, placing specific emphasis on simplicity of
development and integration, while applying existing authentication,
authorization, and privacy models. Its intent is to reduce the cost and
complexity of user management operations by providing a common user
schema and extension model, as well as binding documents to provide
patterns for exchanging this schema using standard protocols. In
addition the working group may consider including managing device
identities as part of the work adopted by the working group.

The group will work to create an IETF technology for management of user
identities in cloud-based applications using SCIM 1.0 specification
produced under the Open Web Foundation framework
(http://www.simplecloud.info) as starting work.

User, device, and service authentication and authorization
(policy/entitlement) are out of scope of this working group charter.

SCIM 1.0 consists of:

*         Schema definition for identity related objects

*         Protocol definition for accessing and managing the identity
objects

*         Binding of SCIM schema to Security Assertion Markup Language
(SAML) messages and assertions

*         Binding of SCIM schema to Lightweight Directory Access
Protocol (LDAP) schema (RFC4519)

The Working Group will produce one or more documents suitable for
consideration as a Proposed Standard that will evolve and enhance the
SCIM 1.0 work by:

*         Extending the specification per the working group charter

*         Improving the terminology used

*         Embodying good security practices, documenting gaps in its
capabilities, and proposing a path forward for addressing the gaps

*         Promoting interoperability

*         Providing guidelines for extensibility

SCIM 1.0 will be used as the starting point. The working group will
strive to retain backward compatibility with the 1.0 specification.
Changes that are not backwards compatible may be accepted if the group
determines changes are required to meet the group's technical objectives
and the group clearly documents the reasons for making them.

The Working Group should consider:

*         Implementer experience

*         The end-user experience, including internationalization

*         Existing uses of SCIM

*         Ability to achieve broad implementation

*         Ability to address broader use cases than those considered by
the original authors

*         Additional functions or extensions that are needed to address
key security concerns, cross-area review, and implementer feedback

*         Work done by other standard bodies as input to the process
such as OASIS Provisioning TC

The working group will focus on adapting the core technology first but
work on extensions will be considered after the core work is well in
hand.

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 12 Mar 2012 17:57:58 +0000

So its not clear to me from that charter how security is
viewed here. To be clear: I don't think scim should be
defining any new security primitives, but I'd also hope
it'd not create horrible new vulnerabilities (e.g. "hi,
I'm a service provider, honest, please shoot over user
100's stuff including her private key/passwords"). So
there is I would assume some security work to do?

S

On 03/12/2012 05:16 AM, Morteza Ansari (moransar) wrote:
>       Pete Resnick<[email-masked]>
>
>       Peter Saint-Andre<[email-masked]>
>
>
>
> Mailing Lists:
>
> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim

---

From: "Hofer, Larry D. (Larry)" <[email-masked]>
Date: Mon, 12 Mar 2012 12:08:29 -0600

It would make sense to me to make sure the charter encompasses
roles/users and trust model clarifications if not captured.

My 2 cents,
Larry H, CISSP, PE
Avaya Sr. Security Architect

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Stephen Farrell
Sent: Monday, March 12, 2012 11:58 AM
To: Morteza Ansari (moransar)
Cc: [email-masked]
Subject: Re: [scim] Updated draft charter

S