Subject: [scim] Draft charter - v7

From: "Morteza Ansari (moransar)" <[email-masked]>
Date: Mon, 9 Apr 2012 20:55:33 -0500

Hi folks,

Here is the updated charter based on the discussions that took place in
the BoF meeting and some guidance from a hallway conversation with Pete
after the meeting.  Please review the text and send your comments.
Hopefully we can close this soon and hand it over to the ADs.

Phil, I added a note regarding targeting extensions in the updated
charter given the email discussions.

Cheers,

Morteza

---

From: "Lipton, Paul C" <[email-masked]>
Date: Tue, 10 Apr 2012 01:58:31 +0000

Hi all,

Could somebody please provide a brief summary of where SCIM now stands and the proposed next steps / timeline? I think it would be very helpful to those who could not attend the BoF.

Thanks,
Paul

Paul Lipton
CA Technologies
VP, Industry Standards and Open Source
Member, CA Council for Technical Excellence
Office Phone: +1 609 583-9718
Mobile: +1 267 987-6887
Email: [email-masked]<mailto:[email-masked]>

From: [email-masked] [mailto:[email-masked]] On Behalf Of Morteza Ansari (moransar)
Sent: Monday, April 09, 2012 9:56 PM
To: [email-masked]
Subject: [scim] Draft charter - v7

Hi folks,

Here is the updated charter based on the discussions that took place in the BoF meeting and some guidance from a hallway conversation with Pete after the meeting.  Please review the text and send your comments. Hopefully we can close this soon and hand it over to the ADs.

Phil, I added a note regarding targeting extensions in the updated charter given the email discussions.

Cheers,
Morteza

---

From: Melinda Shore <[email-masked]>
Date: Mon, 09 Apr 2012 18:13:35 -0800

> Hopefully we can close this soon and hand it over to the ADs.

I'd like to see the whole "cloud" thing go away, for several reasons:

1) The architecture as it currently stands is actually more general than
    that, and is applicable other use cases.  For example, it's now
    reasonably common to provision enterprise accounts out of an ERP
    application and it's often done in a batch mode through generated
    LDIF or even SQL.

2) This is really not your fault but the whole "cloud" thing has been
    poisoned at the IETF and I would not to see cycles wasted dealing
    with that.

I'd be happy to write up a non-cloud use case.  I think there's a
compelling argument to be made that this is a more generally useful
mechanism/architecture than you may fully realize, and that it can be
leveraged without much change to what you've already got.

Melinda

---

From: "Morteza Ansari (moransar)" <[email-masked]>
Date: Mon, 9 Apr 2012 21:24:47 -0500

Other than the working group name, there is no mention of cloud in the
charter anymore. 

Cheers,
Morteza

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Melinda Shore
Sent: Monday, April 09, 2012 7:14 PM
To: [email-masked]
Subject: Re: [scim] Draft charter - v7

On 4/9/12 5:55 PM, Morteza Ansari (moransar) wrote:
> Here is the updated charter based on the discussions that took place 
> in the BoF meeting and some guidance from a hallway conversation with 
> Pete after the meeting. Please review the text and send your comments.

Melinda
_______________________________________________
scim mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/scim

---

From: "Morteza Ansari (moransar)" <[email-masked]>
Date: Mon, 9 Apr 2012 21:28:53 -0500

We had a BoF in Paris and are revising the proposed charter based on the
discussions in the meeting. Once we settle on the text of the charter in
the mailing list we will ask the AD's/IESG to review and discuss it. If
IESG decides to form a WG, then we are set and we move forward.

Cheers,

Morteza

From: Lipton, Paul C [mailto:[email-masked]] 
Sent: Monday, April 09, 2012 6:59 PM
To: Morteza Ansari (moransar); [email-masked]
Subject: RE: Draft charter - v7

Hi all,

Could somebody please provide a brief summary of where SCIM now stands
and the proposed next steps / timeline? I think it would be very helpful
to those who could not attend the BoF. 

Thanks,

Paul 

Paul Lipton

CA Technologies

Mobile: +1 267 987-6887

Email: [email-masked] <mailto:[email-masked]> 

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Morteza Ansari (moransar)
Sent: Monday, April 09, 2012 9:56 PM
To: [email-masked]
Subject: [scim] Draft charter - v7

Hi folks,

 

Cheers,

Morteza

---

From: "Lipton, Paul C" <[email-masked]>
Date: Tue, 10 Apr 2012 02:30:29 +0000

Thanks, Morteza. That was helpful. Any timeline at all to this, if I may ask?

Thanks again,
Paul

From: Morteza Ansari (moransar) [mailto:[email-masked]]
Sent: Monday, April 09, 2012 10:29 PM
To: Lipton, Paul C; [email-masked]
Subject: RE: Draft charter - v7

We had a BoF in Paris and are revising the proposed charter based on the discussions in the meeting. Once we settle on the text of the charter in the mailing list we will ask the AD's/IESG to review and discuss it. If IESG decides to form a WG, then we are set and we move forward.

Cheers,
Morteza

From: Lipton, Paul C [mailto:[email-masked]]<mailto:[mailto:[email-masked]]>
Sent: Monday, April 09, 2012 6:59 PM
To: Morteza Ansari (moransar); [email-masked]<mailto:[email-masked]>
Subject: RE: Draft charter - v7

Hi all,

Thanks,
Paul

Paul Lipton
CA Technologies

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]]<mailto:[mailto:[email-masked]]> On Behalf Of Morteza Ansari (moransar)
Sent: Monday, April 09, 2012 9:56 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [scim] Draft charter - v7

Hi folks,

Cheers,
Morteza

---

From: Phil Hunt <[email-masked]>
Date: Mon, 9 Apr 2012 19:38:46 -0700

The charter is currently very service provider oriented. In fact it currently looks very much like a RESTful (direcotry) access protocol - RAP. As Melinda suggests there is definitely more than just cloud scenarios and that suggests to me that client requirements and other provisioning concepts need to be considered in the charter.

However, I do think Cloud is a key point to keep within the charter (not necessarily the name). Unlike previous provisioning standardization efforts, the key motivation for standardization and inter-operability are cloud scenarios since it is MUCH MORE likely different implementations will need to work with each other -- whereas with SPML and other provisioning systems, it didn't really matter the implementations inter-operated since it was likely the same implementation. There was a similar story behind the evolution of LDAP and why replication was never standardized.

Phil

@independentid
www.independentid.com
[email-masked]

---

From: Igor Faynberg <[email-masked]>
Date: Mon, 09 Apr 2012 22:49:01 -0400

I tend to disagree with Melinda  here (I mean on the name), as I don't 
see any actual evidence of the cloud thing in the IETF being 
"poisoned."  It certainly has been discussed for a long while; it is 
also true that previous proposals had been criticized for being too 
broad. But the SCIM proposal  is *very focused.*

We had a very constructive discussion in Paris, and the relation of the 
project to Cloud has been made clear; in addition, the protocol is 
actually being implemented, and it is known by its name. Changing it at 
this time means dropping continuity, which in my opinion is wrong.

I think though that the decision on the name belongs to the community 
that has created SCIM 1.0 and then decided to bring it to us.  To this 
end, I only state an opinion that is different from the one stated before.

Igor

---

From: Melinda Shore <[email-masked]>
Date: Mon, 09 Apr 2012 18:55:24 -0800

On 4/9/12 6:49 PM, Igor Faynberg wrote:
> see any actual evidence of the cloud thing in the IETF being "poisoned."
> It certainly has been discussed for a long while; it is also true that
> previous proposals had been criticized for being too broad. But the SCIM
> proposal is *very focused.*

I think the strongest argument for getting rid of the cloud reference
is one you didn't address, which is that there are use cases which are
substantially similar architecturally to what's been proposed but take
place inside an enterprise or other local-to-local environments.

I'm not proposing any substantial changes to the architecture or
protocols to accommodate other use cases.  I'm saying that there are
some already and that the current scope is narrower than it needs
to be.  If there's a technical argument that "scim" has no applicability
to local provisioning, I think that's the argument to make.

Melinda

---

From: Igor Faynberg <[email-masked]>
Date: Tue, 10 Apr 2012 01:05:26 -0400

Yes, I agree that there are other use cases (and, yes, I agree that I 
did not adress that argument).

Since  "Cloud," at least in a narrow interpretation, is about enterprise 
outsourcing, a lot of things that relate to Cloud in general relate to 
enterprise, too.  Yet, the very character of SCIM, its RESTful intention 
including , does  point to the Cloud environment specifically.   I think 
Phil in his previous message (which crossed with mine) implied just that.

And while on the subject of use cases... One danger in considering all 
applicable use cases early in the game--and I do not necessarily mean 
the specific case you brought up--is potential loss of focus.   I 
believe  you and I share the same experience as former WG chairs: early 
attempts at generalization bring feature crip, backward incompatibility, 
and a score of other problems.  I always tried to resist it.   I really 
think that it is better to complete something and then re-charter to 
move one to considering larger problems.

Well, just as HTTP was being standardized, its many (unfortunate) uses 
beyond hyper-text transfer had already been considered. /Everything/ 
could be transferred (and beyond firewalls, too!)--and everyone tried to 
transfer something new, ignoring the very nature of the protocol.  But 
then  one could argue that HTTP should have been renamed into ETP...

In any event, as I said, I  believe that the decision on changing the 
name rests with the SCIM original authors; my opinion here is nothing 
more than an opinion (wrong perhaps).

Igor

---

From: "Brenner, Michael Ralf (Michael)" <[email-masked]>
Date: Tue, 10 Apr 2012 07:57:15 -0500

Maybe we are getting too hung up on the name?
Let's put it this way, what's better: a generic name, that no specific domain identifies with, or a targeted name that at least clearly identifies a domain? I am inclined to go with the latter. I have been involved in too many grandiose crash-and-burn projects, and in most cases when it happened it was because we were trying too hard to please everybody and kept accepting more and more requirements.

Looking back at technologies that were successful in more than 1 domain, I tend to doubt that what made them successful in multiple domains was the selection of a generic name - especially in the case of technologies that are higher layer than transport of any kind. Personally, I'd rather focus on creating a successful technology than making sure that it covers multiple domains ... when we go the latter way, the tendency is to either not optimize for anything or to take too long to complete.

My preference would be to focus on a few scenarios and optimize the technology for those. Those that have other scenario in mind should  of course pay attention and point out undesirable solutions, lack of extensibility to other scenarios. Starting SIMPLE implies starting and completing sooner, and gives a better rate of success for achieving the few stated goals. If the goals are sufficient to cover well 1 domain, and the technology is adopted for that domain, this is success. Does anybody wonder WHY after so many years we still do not have any reasonable level of adoption of any set of specs related to IdM?

Michael

From: [email-masked] [mailto:[email-masked]] On Behalf Of Igor Faynberg
Sent: Tuesday, April 10, 2012 1:05 AM
To: [email-masked]
Subject: Re: [scim] Draft charter - v7

Yes, I agree that there are other use cases (and, yes, I agree that I did not adress that argument).

Since  "Cloud," at least in a narrow interpretation, is about enterprise outsourcing, a lot of things that relate to Cloud in general relate to enterprise, too.  Yet, the very character of SCIM, its RESTful intention including , does  point to the Cloud environment specifically.   I think Phil in his previous message (which crossed with mine) implied just that.

And while on the subject of use cases... One danger in considering all applicable use cases early in the game--and I do not necessarily mean the specific case you brought up--is potential loss of focus.   I believe  you and I share the same experience as former WG chairs: early attempts at generalization bring feature crip, backward incompatibility, and a score of other problems.  I always tried to resist it.   I really think that it is better to complete something and then re-charter to move one to considering larger problems.

Well, just as HTTP was being standardized, its many (unfortunate) uses beyond hyper-text transfer had already been considered.  Everything could be transferred (and beyond firewalls, too!)--and everyone tried to transfer something new, ignoring the very nature of the protocol.  But then  one could argue that HTTP should have been renamed into ETP...

In any event, as I said, I  believe that the decision on changing the name rests with the SCIM original authors; my opinion here is nothing more than an opinion (wrong perhaps).

Igor

Melinda
_______________________________________________
scim mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/scim

---

From: Kelly Grizzle <[email-masked]>
Date: Tue, 10 Apr 2012 13:39:44 +0000

The hope is to nail down the charter in the very near term and discuss any objections on the mailing list.  Ideally a decision on the WG would happen sometime around the beginning of June so a WG meeting can get on the schedule for IETF 84 at the end of July.  I'm new to the IETF, but my understanding is that the final charter with all issues addressed needs to be submitted to the ADs 3-4 weeks before the final date that we need a decision.  This gives us about a month to work through any issues.  Morteza, let me know if I am way off here.

--Kelly

From: [email-masked] [mailto:[email-masked]] On Behalf Of Lipton, Paul C
Sent: Monday, April 09, 2012 9:30 PM
To: Morteza Ansari (moransar); [email-masked]
Subject: Re: [scim] Draft charter - v7

Thanks again,
Paul

From: Morteza Ansari (moransar) [mailto:[email-masked]]
Sent: Monday, April 09, 2012 10:29 PM
To: Lipton, Paul C; [email-masked]<mailto:[email-masked]>
Subject: RE: Draft charter - v7

Cheers,
Morteza

Hi all,

Thanks,
Paul

Paul Lipton
CA Technologies

Hi folks,

Cheers,
Morteza

---

From: Phil Hunt <[email-masked]>
Date: Tue, 10 Apr 2012 07:41:53 -0700

I think if SCIM only handles case of enterprise outsourcing, there will end up being a succeeding solution that covers all cases.

Phil

---

From: Michael Hammer <[email-masked]>
Date: Tue, 10 Apr 2012 12:13:50 -0400

My understanding is that private Clouds are in Enterprises, so don't see
the Cloud moniker limiting anyone.
What it does do though is to give a hint that if you don't have
interoperability, then you fall short of a key goal.
How about less much ado about the name and get on with the work.

Mike

On Tue, Apr 10, 2012 at 10:41 AM, Phil Hunt <[email-masked]> wrote:

> I think if SCIM only handles case of enterprise outsourcing, there will
> end up being a succeeding solution that covers all cases.
>
> Phil
>
> applicable use cases early in the game--and I do not necessarily mean the
> specific case you brought up--is potential loss of focus.   I believe  you
> and I share the same experience as former WG chairs: early attempts at
> generalization bring feature crip, backward incompatibility, and a score of
> other problems.  I always tried to resist it.   I really think that it is
> better to complete something and then re-charter to move one to considering
> larger problems.
>
>
> beyond hyper-text transfer had already been considered.  *Everything*could be transferred (and beyond firewalls, too!)--and everyone tried to
> In any event, as I said, I  believe that the decision on changing the name
> rests with the SCIM original authors; my opinion here is nothing more than
> an opinion (wrong perhaps).
>
> Igor
>
>
>
>

---

From: "Brenner, Michael Ralf (Michael)" <[email-masked]>
Date: Tue, 10 Apr 2012 11:21:22 -0500

+1

From: [email-masked] [mailto:[email-masked]] On Behalf Of Michael Hammer
Sent: Tuesday, April 10, 2012 12:14 PM
To: Phil Hunt
Cc: Faynberg, Igor (Igor); [email-masked]
Subject: Re: [scim] Draft charter - v7

My understanding is that private Clouds are in Enterprises, so don't see the Cloud moniker limiting anyone.
What it does do though is to give a hint that if you don't have interoperability, then you fall short of a key goal.
How about less much ado about the name and get on with the work.

Mike

On Tue, Apr 10, 2012 at 10:41 AM, Phil Hunt <[email-masked]<mailto:[email-masked]>> wrote:
I think if SCIM only handles case of enterprise outsourcing, there will end up being a succeeding solution that covers all cases.

Phil

On 2012-04-09, at 22:05, Igor Faynberg <[email-masked]<mailto:[email-masked]>> wrote:
Yes, I agree that there are other use cases (and, yes, I agree that I did not adress that argument).

Igor

Melinda

---

From: Gene Golovinsky <[email-masked]>
Date: Tue, 10 Apr 2012 09:22:17 -0700

+1

*From:* [email-masked] [mailto:[email-masked]] *On
Behalf Of *Brenner,
Michael Ralf (Michael)
*Sent:* Tuesday, April 10, 2012 09:21 AM
*To:* Michael Hammer; Phil Hunt
*Cc:* Faynberg, Igor (Igor); [email-masked]
*Subject:* Re: [scim] Draft charter - v7

+1

*From:* [email-masked] [mailto:[email-masked]] *On
Behalf Of *Michael
Hammer
*Sent:* Tuesday, April 10, 2012 12:14 PM
*To:* Phil Hunt
*Cc:* Faynberg, Igor (Igor); [email-masked]
*Subject:* Re: [scim] Draft charter - v7

Mike

I think if SCIM only handles case of enterprise outsourcing, there will end
up being a succeeding solution that covers all cases.

Phil

On 2012-04-09, at 22:05, Igor Faynberg <[email-masked]>
wrote:

Yes, I agree that there are other use cases (and, yes, I agree that I did
not adress that argument).

Well, just as HTTP was being standardized, its many (unfortunate) uses
beyond hyper-text transfer had already been considered.  *Everything* could
be transferred (and beyond firewalls, too!)--and everyone tried to transfer
something new, ignoring the very nature of the protocol.  But then  one
could argue that HTTP should have been renamed into ETP...

Igor

Melinda

---

From: Phil Hunt <[email-masked]>
Date: Tue, 10 Apr 2012 09:22:57 -0700

I haven't commented about name - and have no opinion. 

My issue is whether SCIM is to be a provisioning protocol or restful dap which can be used by provisioning systems.  

Phil

---

From: Melinda Shore <[email-masked]>
Date: Tue, 10 Apr 2012 08:56:17 -0800

On 4/10/12 8:13 AM, Michael Hammer wrote:
> My understanding is that private Clouds are in Enterprises,

Now I *truly* regret having said anything.

My primary concern is that the design not be overly constraining.
I chaired a working group that made some poor decisions and
ended up overgeneralizing the result so I'm certainly sensitive
to the question of making something overly broad.  However, what
I'm saying here is that what's already written down covers more
use cases than you think, including the *common* use case of
provisioning local accounts out of an ERP, and my concern is with
protecting that.  [Do people really think there aren't RESTful
services running inside large enterprises?]

Melinda

---

From: Hasini Gunasinghe <[email-masked]>
Date: Wed, 11 Apr 2012 02:56:19 +0530

On Tue, Apr 10, 2012 at 9:52 PM, Phil Hunt <[email-masked]> wrote:

> My issue is whether SCIM is to be a provisioning protocol or restful dap
> which can be used by provisioning systems.
>

SCIM is a provisioning protocol which defines a RESTful API - for
user/identity management operations - that is exposed by the SCIM service
provider and consumed by the SCIM consumer. Both SCIM service provider and
SCIM consumer can be parts of an identity provisioning system.

This is my understanding on SCIM - in the point of view of one who
implements it in an identity management solution.

> +1. Usage of SCIM is not limited only to enterprise - public cloud
provisioning use cases. IMHO, It can be used as the standard protocol in
any identity provisioning use case as long as both parties understand SCIM.

Thanks,
Hasini.

>> name rests with the SCIM original authors; my opinion here is nothing more
>> than an opinion (wrong perhaps).
>>
>> Igor
>>
>>
>>
>>

---

From: Kelly Grizzle <[email-masked]>
Date: Wed, 11 Apr 2012 17:54:53 +0000

Looks great, Morteza!  I found one extraneous comma:

This group will consider, the operational experience gathered from the existing work...
                        ^ Here

Other than that I wouldn't change a thing.

--Kelly

From: [email-masked] [mailto:[email-masked]] On Behalf Of Morteza Ansari (moransar)
Sent: Monday, April 09, 2012 8:56 PM
To: [email-masked]
Subject: [scim] Draft charter - v7

Hi folks,

Cheers,
Morteza

---

From: "Morteza Ansari (moransar)" <[email-masked]>
Date: Thu, 12 Apr 2012 00:11:15 -0500

Thanks Kelly, I fixed this.

Cheers,

Morteza

From: Kelly Grizzle [mailto:[email-masked]] 
Sent: Wednesday, April 11, 2012 10:55 AM
To: Morteza Ansari (moransar); [email-masked]
Subject: RE: Draft charter - v7

This group will consider, the operational experience gathered from the
existing work...

                        ^ Here

--Kelly

Hi folks,

 

Cheers,

Morteza