Subject: [scim] Canonical groups types (SCIM 1.0 cleanup)

From: Samuel Erdtman <[email-masked]>
Date: Tue, 24 Apr 2012 12:40:35 +0200

The Canonical types for groups attribute begins with capital letter,
but all other are lowercase. just a simple change.

//Samuel

---

From: Kelly Grizzle <[email-masked]>
Date: Tue, 24 Apr 2012 13:47:15 +0000

There was recently a discussion about being able to dereference a group member.  Since the members list can contain both groups and users we need some way to distinguish the resource type.  For example:

{
  "members": [
    {
      "value": "2819c223-7f76-453a-919d-413861904646",
      "type": "User"
    },
    {
      "value": "902c246b-6245-4190-8e05-00816be7344a",
      "type": "Group"
    }
]

It would be nice to be able to get the URL for the full representation for each of these members.  Since User and Group are the "name" attribute in the schema, a client could look up the endpoint in the schema and construct a URL (eg - https://www.example.com/scim/v1/Users/2819c223-7f76-453a-919d-413861904646).

There is another proposal to just have each element contain the URL to full representation.  In this case the canonical types could be lowercase, but I still kind of like the symmetry with the schema name.

In any case, this needs some more thought and might be worth adding to the issue tracker so we don't lose it.

--Kelly

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Samuel Erdtman
Sent: Tuesday, April 24, 2012 5:41 AM
To: [email-masked]
Subject: [scim] Canonical groups types (SCIM 1.0 cleanup)

The Canonical types for groups attribute begins with capital letter, but all other are lowercase. just a simple change.

//Samuel
_______________________________________________
scim mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/scim

---

From: Emmanuel Dreux <[email-masked]>
Date: Tue, 24 Apr 2012 20:42:22 +0000

If you need this info, could it simply reference the location instead of the uniqueID? 
{
  "members": [
    {"value": "http://www.company.com/{tenantID}/users/2819c223-7f76-453a-919d-413861904646"},
    {"value": "http://www.company.com/{tenantID}/groups/902c246b-6245-4190-8e05-00816be7344a"}
]
}

If you refer to Active Directory, the member attribute of a Group contains distinguishedNames.
It does not tell if the DN is a user or group object and we do not need this information.

Today, in our implementation, having just the uniqueID as it's currently defined in the spec, is sufficient.
As other meta-directories, we retrieve the entire list of users and groups in each sources and targets to be able to make internal reconciliations.
Therefore we have all objects and we perform lookups in both our user and group table to find the referenced uniqueID.

--
Cordialement,
Emmanuel Dreux
http://www.cloudiway.com
Tel: +33 1 46 15 07 22
Mobile: +33 6 47 81 26 70
skype: Emmanuel.Dreux

-----Message d'origine-----
De : Kelly Grizzle [mailto:[email-masked]] 
Envoyé : mardi 24 avril 2012 15:47
À : Samuel Erdtman; [email-masked]
Objet : Re: [scim] Canonical groups types (SCIM 1.0 cleanup)

{
  "members": [
    {

--Kelly

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Samuel Erdtman
Sent: Tuesday, April 24, 2012 5:41 AM
To: [email-masked]
Subject: [scim] Canonical groups types (SCIM 1.0 cleanup)

//Samuel