Subject: [scim] Propose reshape of charter

From: Eliot Lear <[email-masked]>
Date: Tue, 13 Mar 2012 20:37:55 +0100

Hi Everyone,

Having read inputs from this list, I am proposing some changes to the
charter.  Most of this is form and not substance,  but there are some
substantial changes.  The purpose of these changes is to bring the
charter in line with most of the others.  Absent these sort of changes,
I am not confident we would get a WG.  Even with these changes, more
work is needed. because what is below is not complete.

What is missing – *and it's important – * are a few additional words
about why we need SCIM.  Why are we holding the darn BoF?  This is not
something that can wait, IMHO, for an Informational document.  Rather,
if there is no clear statement of the problem, I don't see how the IESG
would approve a WG.  So that's what the big XXXXXXX is below.  I've put
some words in, but they are there to demonstrate the point.  PLEASE
propose text.

In addition, my rewording is, in some places, generic.  I would suggest
that more time be spent on what we will – and as importantly –  WON'T
do.  A good charter will scope out more.  What are the critical
functions that need to be done *now*?  If we leave it wide open, then we
run the risk of people shoveling too much in, or blocking on how to
decide where to hold the line and wait til the next round.  So, for
instance, how will we keep the schema from bloating?  Rinse and repeat
with protocol operations.

In addition, it is my anticipation that shortly before – or very quickly
after – our BoF, Internet-Drafts will be posted of the initial
specifications.  Thus you see draft-XXX below.  While the charter need
not – and cannot – be completely finished before the BoF, we should have
it as close as possible.

Please comment now on these changes and any additional changes you would
like to see.

Simple Cloud Identity Management (SCIM)

Chair(s): TBD

Applications Area Director(s):

     Pete Resnick <[email-masked] <mailto:[email-masked]>> 
     Barry Lieba <???> 

Mailing Lists:
     General Discussion: [email-masked] <mailto:[email-masked]>
     To Subscribe: https://www.ietf.org/mailman/listinfo/scim
     Archive:      http://www.ietf.org/mail-archive/web/scim/current/maillist.html

Description of Working Group:

The Simple Cloud Identity Management (SCIM) specification is designed to 
make managing user identity lifecycle in cloud based applications and 
services easier.

XXXXXXX

So-called CReate Update Delete (CRUD) provisioning operations are often
necessary to ease adoption of new services.  This work builds on tools
such as ldap and SAML 2.0, which are used to provide up-to-date information.
SCIM focuses on the case where an enterprise's ldap service may not be
available to the provider, and SAML cannot provide sufficient context for the
service.  An example would be the provisioning of an of an EMail account so
that it can receive mail before the person has first logged in.

XXXXXXXX

The specification suite seeks to build upon experience with existing 
schemas and deployments, placing specific emphasis on simplicity of 
development and integration, while applying existing authentication, 
authorization, and privacy models. Its intent is to reduce the cost and 
complexity of user management operations by providing a common user 
schema and extension model, as well as binding documents to provide 
patterns for exchanging this schema using standard protocols. In 
addition the working group may consider including managing device 
identities as part of the work adopted by the working group.

The group will use as starting points the following drafts in
the following ways:

	draft-XXX-scim-schema-00 as the a schema specification,
	draft-XXX-scim-protocol-definition-00 as the protocol specification,
	draft-XXX-scim-saml-binding-00 for binding the SCIM schema to SAML, and
	draft-XXX-scim-ldap-binding-00 for binding the SCIM schema to LDAP.

These drafts are based on existing specifications. which together are commonly
known as SCIM 1.0.  As such, some consideration should be given for backward
compatibility, as the group evolves the work.  This group will consider,
for and foremost, the operational experience gathered from the existing work.
The group will also consider experiences with work done by other bodies, including
the OASIS Provisioning TC.

The group will produce Proposed Standards for a schema, a protocol,
a SAML binding, and an LDAP binding.  In doing so, the group will make
consistent the terminology, review and improve security of the overall system,
identify any functional gaps that would be useful future work, address
internationalization, and provide guidelines for extensibility (either through
IANA registries or other means).

In its work, the group will decide what additional capabilities should be
included in the initial specification, and what can be addressed at a later time.

However, user, device, and service authentication and authorization
(policy/entitlement) are out of scope for this working group.

Milestones

5/2012    Initial adoption of SCIM core schema
5/2012    Initial adoption of SCIM restful interface draft
5/2012    Initial adoption of SCIM SAML bindings draft
5/2012    Initial adoption of SCIM LDAP mapping draft
9/2012    WGLC SCIM core schema
9/2012    WGLC SCIM restful interface
9/2012    WGLC SCIM SAML bindings
9/2012    WGLC SCIM LDAP mapping
3/2013    Re-charter discussion

---

From: Phil Hunt <[email-masked]>
Date: Tue, 13 Mar 2012 12:56:13 -0700

Eliot,

I propose the following change to the WG Description:

To:
> make managing user identity lifecycle in one or more applications and 
> services easier between client organizations and cloud based service providers.

The change above is subtle but of critical importance to cloud providers (many who are not yet active in the group) who host many services.

It is probably important to site the location of the SCIM 1.0 specification which is published externally to IETF as well as the re-published drafts under IETF.

Phil

@independentid
www.independentid.com
[email-masked]

On 2012-03-13, at 12:37 PM, Eliot Lear wrote:

> Hi Everyone,
> 
> Having read inputs from this list, I am proposing some changes to the charter.  Most of this is form and not substance,  but there are some substantial changes.  The purpose of these changes is to bring the charter in line with most of the others.  Absent these sort of changes, I am not confident we would get a WG.  Even with these changes, more work is needed. because what is below is not complete.
> 
> What is missing – and it's important –  are a few additional words about why we need SCIM.  Why are we holding the darn BoF?  This is not something that can wait, IMHO, for an Informational document.  Rather, if there is no clear statement of the problem, I don't see how the IESG would approve a WG.  So that's what the big XXXXXXX is below.  I've put some words in, but they are there to demonstrate the point.  PLEASE propose text.
> 
> In addition, my rewording is, in some places, generic.  I would suggest that more time be spent on what we will – and as importantly –  WON'T do.  A good charter will scope out more.  What are the critical functions that need to be done now?  If we leave it wide open, then we run the risk of people shoveling too much in, or blocking on how to decide where to hold the line and wait til the next round.  So, for instance, how will we keep the schema from bloating?  Rinse and repeat with protocol operations.
> 
> In addition, it is my anticipation that shortly before – or very quickly after – our BoF, Internet-Drafts will be posted of the initial specifications.  Thus you see draft-XXX below.  While the charter need not – and cannot – be completely finished before the BoF, we should have it as close as possible.
> 
> 
> Please comment now on these changes and any additional changes you would like to see.
> 
>      Pete Resnick <[email-masked]> 
>      Barry Lieba <???> 
> Mailing Lists:
>      General Discussion: [email-masked]
> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim

---

From: Michael Hammer <[email-masked]>
Date: Tue, 13 Mar 2012 16:06:28 -0400

Phil,

So, this manages identities of cloud customers who may want to push a SaaS
application into the cloud,
AND allows management of the users of the SaaS application which are
customers of the enterprise versus the cloud provider?

Mike

On Tue, Mar 13, 2012 at 3:56 PM, Phil Hunt <[email-masked]> wrote:

> The change above is subtle but of critical importance to cloud providers
> (many who are not yet active in the group) who host many services.
>
> It is probably important to site the location of the SCIM 1.0
> specification which is published externally to IETF as well as the
> re-published drafts under IETF.
>
> Phil
>
> @independentid
> www.independentid.com
> [email-masked]
>
>
>
>
>
> substantial changes.  The purpose of these changes is to bring the charter
> in line with most of the others.  Absent these sort of changes, I am not
> confident we would get a WG.  Even with these changes, more work is needed.
> because what is below is not complete.
>
> something that can wait, IMHO, for an Informational document.  Rather, if
> there is no clear statement of the problem, I don't see how the IESG would
> approve a WG.  So that's what the big XXXXXXX is below.  I've put some
> words in, but they are there to demonstrate the point.  PLEASE propose text.
>
> that more time be spent on what we will – and as importantly –  WON'T do.
> A good charter will scope out more.  What are the critical functions that
> need to be done *now*?  If we leave it wide open, then we run the risk of
> people shoveling too much in, or blocking on how to decide where to hold
> the line and wait til the next round.  So, for instance, how will we keep
> the schema from bloating?  Rinse and repeat with protocol operations.
>
> specifications.  Thus you see draft-XXX below.  While the charter need not
> – and cannot – be completely finished before the BoF, we should have it as
> close as possible.
>
>
> Simple Cloud Identity Management (SCIM)****
>
> ****Chair(s): TBD********
>
> ****Applications Area Director(s):****
>
>      Pete Resnick <[email-masked]> ****
>      Barry Lieba <???>** **
>
> Mailing Lists:****
>      General Discussion: [email-masked]****
>      To Subscribe: https://www.ietf.org/mailman/listinfo/scim****
>      Archive:      http://www.ietf.org/mail-archive/web/scim/current/maillist.html****
>
> ** **
>
> Description of Working Group:****
>
> XXXXXXXX****
> identities as part of the work adopted by the working group.****
>
> included in the initial specification, and what can be addressed at a later time.**
> However, **user, device, and service authentication and authorization

---

From: Phil Hunt <[email-masked]>
Date: Tue, 13 Mar 2012 13:18:45 -0700

Sure.  I was more thinking about how an enterprise provisions employees, customers, etc to places like AOL, Amazon, Google, Oracle Cloud, etc etc who run one or more services. 

As a totally hypothetical example, how would I provision 'Ann' to be set up on Google Docs, Calendar, and e-mail?  Is this done through a SCIM call to a Google Directory endpoint, or is this done directly to specific app endpoints? 

Phil

@independentid
www.independentid.com
[email-masked]

On 2012-03-13, at 1:06 PM, Michael Hammer wrote:

> Phil,
> 
> So, this manages identities of cloud customers who may want to push a SaaS application into the cloud,
> AND allows management of the users of the SaaS application which are customers of the enterprise versus the cloud provider?
> 
> Mike
> 
>

---

From: "Diodati,Mark" <[email-masked]>
Date: Tue, 13 Mar 2012 20:25:48 +0000

It seems to me that Phil's proposed change to the description are in line with his request to add support for multiple targets a la SPML. The latter request has not been accepted (AFAIK) by the BoF. Before accepting changes to the description, should the BoF first decide about the multi-target functionality?

Mark

From: Michael Hammer [mailto:[email-masked]]
Sent: Tuesday, March 13, 2012 3:06 PM
To: Phil Hunt
Cc: [email-masked]; Peter Saint-Andre; Eliot Lear; Steven M. Bellovin
Subject: Re: [scim] Propose reshape of charter

Phil,

Mike

On Tue, Mar 13, 2012 at 3:56 PM, Phil Hunt <[email-masked]<mailto:[email-masked]>> wrote:
Eliot,

From:

services easier.
To:

Phil

@independentid
www.independentid.com<http://www.independentid.com>
[email-masked]<mailto:[email-masked]>

Hi Everyone,

What is missing - and it's important -  are a few additional words about why we need SCIM.  Why are we holding the darn BoF?  This is not something that can wait, IMHO, for an Informational document.  Rather, if there is no clear statement of the problem, I don't see how the IESG would approve a WG.  So that's what the big XXXXXXX is below.  I've put some words in, but they are there to demonstrate the point.  PLEASE propose text.

In addition, my rewording is, in some places, generic.  I would suggest that more time be spent on what we will - and as importantly -  WON'T do.  A good charter will scope out more.  What are the critical functions that need to be done now?  If we leave it wide open, then we run the risk of people shoveling too much in, or blocking on how to decide where to hold the line and wait til the next round.  So, for instance, how will we keep the schema from bloating?  Rinse and repeat with protocol operations.

In addition, it is my anticipation that shortly before - or very quickly after - our BoF, Internet-Drafts will be posted of the initial specifications.  Thus you see draft-XXX below.  While the charter need not - and cannot - be completely finished before the BoF, we should have it as close as possible.

     Pete Resnick <[email-masked]<mailto:[email-masked]>>

     Barry Lieba <???>

Mailing Lists:

     General Discussion: [email-masked]<mailto:[email-masked]>

services easier.

XXXXXXX

XXXXXXXX

the following ways:

Milestones

_______________________________________________
scim mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/scim

_______________________________________________
scim mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/scim

________________________________

This e-mail message, including any attachments, is for the sole use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Gartner makes no warranty that this e-mail is error or virus free.

---

From: Phil Hunt <[email-masked]>
Date: Tue, 13 Mar 2012 13:58:03 -0700

My understanding is that it has been accepted for the BoF.  Can someone clarify?

Phil

@independentid
www.independentid.com
[email-masked]

On 2012-03-13, at 1:25 PM, Diodati,Mark wrote:

> It seems to me that Phil’s proposed change to the description are in line with his request to add support for multiple targets a la SPML. The latter request has not been accepted (AFAIK) by the BoF. Before accepting changes to the description, should the BoF first decide about the multi-target functionality?
>  
> Mark
>

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 13 Mar 2012 14:59:47 -0600

> My understanding is that it has been accepted for the BoF.  Can someone

The BoF has been accepted. We're using this list to work out the
specific topics to be discussed, among other things, and the charter is
a big part of that.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: "Diodati,Mark" <[email-masked]>
Date: Tue, 13 Mar 2012 21:01:41 +0000

The BoF has been accepted by IETF. The question is, have the BoF members accepted the request to add multi-target support?

-----Original Message-----
From: Peter Saint-Andre [mailto:[email-masked]]
Sent: Tuesday, March 13, 2012 4:00 PM
To: Phil Hunt
Cc: Diodati,Mark; [email-masked]
Subject: Re: [scim] FW: Propose reshape of charter

> My understanding is that it has been accepted for the BoF.  Can

The BoF has been accepted. We're using this list to work out the specific topics to be discussed, among other things, and the charter is a big part of that.

Peter

--
Peter Saint-Andre
https://stpeter.im/

---

From: Eliot Lear <[email-masked]>
Date: Tue, 13 Mar 2012 22:22:57 +0100

Everyone:

Please voice your support or opposition to the proposed change below
(and any other proposed change) that comes through.  Stating WHY helps
advance the debate.

Thanks,

Eliot

On 3/13/12 8:56 PM, Phil Hunt wrote:
> The change above is subtle but of critical importance to cloud
> providers (many who are not yet active in the group) who host many
> services.
>
> www.independentid.com <http://www.independentid.com>
> [email-masked] <mailto:[email-masked]>
>
>
>
>
>
>> charter in line with most of the others.  Absent these sort of
>> changes, I am not confident we would get a WG.  Even with these
>> changes, more work is needed. because what is below is not complete.
>>
>> about why we need SCIM.  Why are we holding the darn BoF?  This is
>> not something that can wait, IMHO, for an Informational document. 
>> Rather, if there is no clear statement of the problem, I don't see
>> how the IESG would approve a WG.  So that's what the big XXXXXXX is
>> below.  I've put some words in, but they are there to demonstrate the
>> point.  PLEASE propose text.
>>
>> In addition, my rewording is, in some places, generic.  I would
>> suggest that more time be spent on what we will – and as importantly
>> –  WON'T do.  A good charter will scope out more.  What are the
>> critical functions that need to be done *now*?  If we leave it wide
>> open, then we run the risk of people shoveling too much in, or
>> blocking on how to decide where to hold the line and wait til the
>> next round.  So, for instance, how will we keep the schema from
>> bloating?  Rinse and repeat with protocol operations.
>>
>> In addition, it is my anticipation that shortly before – or very
>> quickly after – our BoF, Internet-Drafts will be posted of the
>> initial specifications.  Thus you see draft-XXX below.  While the
>> charter need not – and cannot – be completely finished before the
>> BoF, we should have it as close as possible.
>>
>>
>> [email-masked] <mailto:[email-masked]>

---

From: Eliot Lear <[email-masked]>
Date: Tue, 13 Mar 2012 23:19:48 +0100

Hi Phil,

I failed to address a point you made below:

> re-published drafts under IETF.

I believe it is important to both cite and acknowledge the earlier work,
but I don't know that the charter is the right place to do it.  This
having been said, the charter is one place where we have prominent
static content.  Pete, what would the IESG want, here?

Eliot

---

From: Phil Hunt <[email-masked]>
Date: Tue, 13 Mar 2012 15:39:23 -0700

I believe the JOSE WG recently did it this way.

Phil

@independentid
www.independentid.com
[email-masked]

On 2012-03-13, at 3:19 PM, Eliot Lear wrote:

> I believe it is important to both cite and acknowledge the earlier work, but I don't know that the charter is the right place to do it.  This having been said, the charter is one place where we have prominent static content.  Pete, what would the IESG want, here?
> 
> Eliot

---

From: "Morteza Ansari (moransar)" <[email-masked]>
Date: Tue, 13 Mar 2012 23:31:40 -0500

I personally don't think I know enough about the multi-target (and use
cases behind it) to decide one way or another. This is why I suggested
Phil to be on the agenda at the BoF and provide use cases and background
info so the WG can decide whether this addition to the charter make
sense or not.

Cheers,
Morteza

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Diodati,Mark
Sent: Tuesday, March 13, 2012 2:02 PM
To: [email-masked]
Subject: Re: [scim] FW: Propose reshape of charter

The BoF has been accepted by IETF. The question is, have the BoF members
accepted the request to add multi-target support?

-----Original Message-----
From: Peter Saint-Andre [mailto:[email-masked]]
Sent: Tuesday, March 13, 2012 4:00 PM
To: Phil Hunt
Cc: Diodati,Mark; [email-masked]
Subject: Re: [scim] FW: Propose reshape of charter

Peter

--
Peter Saint-Andre
https://stpeter.im/

This e-mail message, including any attachments, is for the sole use of
the person to whom it has been sent, and may contain information that is
confidential or legally protected. If you are not the intended recipient
or have received this message in error, you are not authorized to copy,
distribute, or otherwise use this message or its attachments. Please
notify the sender immediately by return e-mail and permanently delete
this message and any attachments. Gartner makes no warranty that this
e-mail is error or virus free.
_______________________________________________
scim mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/scim

---

From: Anthony Nadalin <[email-masked]>
Date: Wed, 14 Mar 2012 13:08:30 +0000

“managing user identity lifecycle”

This is a little too vague as there are many different views on what the identity lifecycle consists of, enrollment, proofing, credentialing, usage, monitoring, etc. and I don’t believe that SCIM covers all these areas now or ever will

From: [email-masked] [mailto:[email-masked]] On Behalf Of Eliot Lear
Sent: Tuesday, March 13, 2012 2:23 PM
To: Phil Hunt
Cc: [email-masked]; Peter Saint-Andre; Steven M. Bellovin
Subject: Re: [scim] Propose reshape of charter

Everyone:

Please voice your support or opposition to the proposed change below (and any other proposed change) that comes through.  Stating WHY helps advance the debate.

Thanks,

Eliot

From:

services easier.
To:

Phil

@independentid

Hi Everyone,

     Barry Lieba <???>

Mailing Lists:

services easier.

XXXXXXX

XXXXXXXX

the following ways:

Milestones

---

From: "Brenner, Michael Ralf (Michael)" <[email-masked]>
Date: Wed, 14 Mar 2012 08:12:31 -0500

… and what about others – are those included or excluded from “identity lifecycle”:

-          Profiles/preferences

-          Privacy settings

-          Access control to all identity-related information
Thanks,
Michael

From: [email-masked] [mailto:[email-masked]] On Behalf Of Anthony Nadalin
Sent: Wednesday, March 14, 2012 9:09 AM
To: Eliot Lear; Phil Hunt
Cc: [email-masked]; Peter Saint-Andre; Steven M. Bellovin
Subject: Re: [scim] Propose reshape of charter

Everyone:

Thanks,

Eliot

From:

services easier.
To:

Phil

@independentid

Hi Everyone,

     Barry Lieba <???>

Mailing Lists:

services easier.

XXXXXXX

XXXXXXXX

the following ways:

Milestones

---

From: "Diodati,Mark" <[email-masked]>
Date: Wed, 14 Mar 2012 13:33:57 +0000

I understand the concern regarding the vagueness of “managing user identity lifecycle”, but I think that it is sufficient. The clients I have spoken to do not associate identity proofing, privacy settings, etc. with identity lifecycle management.

Then again, I’ve been in the identity business for some time now, so perhaps I am too close to it. Whatever works for everyone else is fine with me.

Mark

From: Brenner, Michael Ralf (Michael) [mailto:[email-masked]]
Sent: Wednesday, March 14, 2012 8:13 AM
To: Anthony Nadalin; Eliot Lear; Phil Hunt
Cc: [email-masked]; Peter Saint-Andre; Steven M. Bellovin
Subject: Re: [scim] Propose reshape of charter

-          Profiles/preferences

-          Privacy settings

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]]<mailto:[mailto:[email-masked]]> On Behalf Of Anthony Nadalin
Sent: Wednesday, March 14, 2012 9:09 AM
To: Eliot Lear; Phil Hunt
Cc: [email-masked]<mailto:[email-masked]>; Peter Saint-Andre; Steven M. Bellovin
Subject: Re: [scim] Propose reshape of charter

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]]<mailto:[mailto:[email-masked]]> On Behalf Of Eliot Lear
Sent: Tuesday, March 13, 2012 2:23 PM
To: Phil Hunt
Cc: [email-masked]<mailto:[email-masked]>; Peter Saint-Andre; Steven M. Bellovin
Subject: Re: [scim] Propose reshape of charter

Everyone:

Thanks,

Eliot

From:

services easier.
To:

Phil

@independentid

Hi Everyone,

     Barry Lieba <???>

Mailing Lists:

services easier.

XXXXXXX

XXXXXXXX

the following ways:

Milestones

---

From: Anthony Nadalin <[email-masked]>
Date: Wed, 14 Mar 2012 13:37:36 +0000

That’s my point, the term identity life-cycle is too subjective, suggest that this be limited to the actual identity management functions that SCIM will cover

From: [email-masked] [mailto:[email-masked]] On Behalf Of Diodati,Mark
Sent: Wednesday, March 14, 2012 6:34 AM
To: [email-masked]
Subject: [scim] FW: Propose reshape of charter

Mark

From: Brenner, Michael Ralf (Michael) [mailto:[email-masked]]<mailto:[mailto:[email-masked]]>

-          Profiles/preferences

-          Privacy settings

Everyone:

Thanks,

Eliot

From:

services easier.
To:

Phil

@independentid

Hi Everyone,

     Barry Lieba <???>

Mailing Lists:

services easier.

XXXXXXX

XXXXXXXX

the following ways:

Milestones

---

From: Eliot Lear <[email-masked]>
Date: Wed, 14 Mar 2012 15:01:39 +0100

On 3/14/12 2:37 PM, Anthony Nadalin wrote:
>
> That’s my point, the term identity life-cycle is too subjective,
> suggest that this be limited to the actual identity management
> functions that SCIM will cover
>
>  
>

I think this is a really good point.  The more we scope the better off
we'll be.

Eliot

---

From: Eliot Lear <[email-masked]>
Date: Wed, 14 Mar 2012 15:00:55 +0100

Eliot

---

From: Kelly Grizzle <[email-masked]>
Date: Wed, 14 Mar 2012 15:01:32 +0000

I agree.  The term “identity life-cycle” is nice as a high-level markety mission statement, but should probably be made more specific for an IETF working group description.  Up to this point, SCIM has been geared towards CRUD operations for identities and identity-related objects, and I don’t see it venturing much outside of this realm.  Perhaps something along the lines of:

make creating, reading, updating, and deleting user identities and identity-

related objects easier in cloud based applications.

Easier is also a bit vague.  This could be changed to address how things will become easier.  For example:

make managing user identity lifecycle easier in cloud based applications

by defining standard protocols and schemas for creating, reading, updating,

and deleting user identities and identity-related objects.

--Kelly

From: [email-masked] [mailto:[email-masked]] On Behalf Of Eliot Lear
Sent: Wednesday, March 14, 2012 9:01 AM
To: Anthony Nadalin
Cc: Diodati, Mark; [email-masked]
Subject: Re: [scim] FW: Propose reshape of charter

I think this is a really good point.  The more we scope the better off we'll be.

Eliot

---

From: Tony Rutkowski <[email-masked]>
Date: Wed, 14 Mar 2012 11:12:03 -0400

Might this include the use of CybOX to structure
and exchange identity related object observables?

--tony

On 3/14/2012 11:01 AM, Kelly Grizzle wrote:
>
> I agree.  The term "identity life-cycle" is nice as a high-level 
> markety mission statement, but should probably be made more specific 
> for an IETF working group description.  Up to this point, SCIM has 
> been geared towards CRUD operations for identities and 
> identity-related objects, and I don't see it venturing much outside of 
> this realm.  Perhaps something along the lines of:
>

---

From: Kelly Grizzle <[email-masked]>
Date: Wed, 14 Mar 2012 17:04:26 +0000

CybOX is new to me, so I can't say for sure.  There has been discussion about utilizing other languages for the payload of some attributes on users (eg - XACML in the entitlements attribute).  This is not part of the spec, though, and is left as a decision to the client and server implementers.  Maybe CybOX could similarly fit into a user or object extension?  I wouldn't foresee this becoming part of the core spec, though.

--Kelly

From: Tony Rutkowski [mailto:[email-masked]]
Sent: Wednesday, March 14, 2012 10:12 AM
To: Kelly Grizzle
Cc: [email-masked]; [email-masked]; [email-masked]; [email-masked]
Subject: Re: [scim] FW: Propose reshape of charter

--tony

On 3/14/2012 11:01 AM, Kelly Grizzle wrote:
I agree.  The term "identity life-cycle" is nice as a high-level markety mission statement, but should probably be made more specific for an IETF working group description.  Up to this point, SCIM has been geared towards CRUD operations for identities and identity-related objects, and I don't see it venturing much outside of this realm.  Perhaps something along the lines of:

---

From: prateek mishra <[email-masked]>
Date: Wed, 14 Mar 2012 13:42:12 -0400

So any form of query or search is excluded from the scope of this work?
> *From:[email-masked] [mailto:[email-masked]] *On Behalf 
> Of *Eliot Lear
> *Sent:* Wednesday, March 14, 2012 9:01 AM
> *To:* Anthony Nadalin
> *Cc:* Diodati, Mark; [email-masked]
> *Subject:* Re: [scim] FW: Propose reshape of charter
>
>
>
> That's my point, the term identity life-cycle is too subjective,

---

From: Kelly Grizzle <[email-masked]>
Date: Wed, 14 Mar 2012 17:44:23 +0000

No - listing with optional filtering and sorting is supported.  In my mind this fits under the "read" of CRUD, but it may make sense to be more explicit about it.

--Kelly

From: [email-masked] [mailto:[email-masked]] On Behalf Of prateek mishra
Sent: Wednesday, March 14, 2012 12:42 PM
To: [email-masked]
Subject: Re: [scim] FW: Propose reshape of charter

--Kelly

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of Eliot Lear
Sent: Wednesday, March 14, 2012 9:01 AM
To: Anthony Nadalin
Cc: Diodati, Mark; [email-masked]<mailto:[email-masked]>
Subject: Re: [scim] FW: Propose reshape of charter

On 3/14/12 2:37 PM, Anthony Nadalin wrote:
That's my point, the term identity life-cycle is too subjective, suggest that this be limited to the actual identity management functions that SCIM will cover

Eliot

scim mailing list

---

From: Trey Drake <[email-masked]>
Date: Wed, 14 Mar 2012 13:14:04 -0500

How about "retrieval" as opposed to "reading"?

Thanks,
Trey 

On Mar 14, 2012, at 12:44 PM, Kelly Grizzle wrote:

> No – listing with optional filtering and sorting is supported.  In my mind this fits under the “read” of CRUD, but it may make sense to be more explicit about it.
>  
> --Kelly
>

---

From: Kelly Grizzle <[email-masked]>
Date: Wed, 14 Mar 2012 19:11:05 +0000

I like that.

From: Trey Drake [mailto:[email-masked]]
Sent: Wednesday, March 14, 2012 1:14 PM
To: Kelly Grizzle
Cc: prateek mishra; [email-masked]
Subject: Re: [scim] Propose reshape of charter

Thanks,
Trey

--Kelly

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of prateek mishra
Sent: Wednesday, March 14, 2012 12:42 PM
To: [email-masked]<mailto:[email-masked]>
Subject: Re: [scim] FW: Propose reshape of charter

--Kelly

Eliot

scim mailing list

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 14 Mar 2012 13:37:41 -0600

> static content.  Pete, what would the IESG want, here?

Assuming you meant Peter, I'll answer. :)

Consider, say, the original OAuth WG charter:

http://tools.ietf.org/wg/oauth/charters?item=charter-oauth-2009-05-13.txt

It didn't mention oauth.net. However, I see no great harm in mentioning
simplecloud.info in the charter, along these lines:

   These drafts are based on existing specifications originally
   developed outside the IETF (see http://simplecloud.info/ for further
   information).

Thanks!

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Tony Rutkowski <[email-masked]>
Date: Wed, 14 Mar 2012 15:48:18 -0400

The CybOZ URL is
http://cybox.mitre.org/about/index.html

Just as CybOX is envisioned as a core
component of SCAP and incident response
data models, it can be used for identity
observables to the extent that there is
a need to exchange this information.

The charter at present seems sufficiently
broad to allow for such sub-components,
if nothing else as extensions.

--tony

On 3/14/2012 1:04 PM, Kelly Grizzle wrote:
>
> CybOX is new to me, so I can't say for sure.  There has been 
> discussion about utilizing other languages for the payload of some 
> attributes on users (eg -- XACML in the entitlements attribute).  This 
> is not part of the spec, though, and is left as a decision to the 
> client and server implementers.  Maybe CybOX could similarly fit into 
> a user or object extension?  I wouldn't foresee this becoming part of 
> the core spec, though.
>