Subject: Re: [scim] Draft charter - v7

From: "Morteza Ansari (moransar)" <[email-masked]>
Date: Thu, 12 Apr 2012 00:12:25 -0500

Also, if I missed any other comments beyond these two please let me
know.

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Morteza Ansari (moransar)
Sent: Wednesday, April 11, 2012 10:11 PM
To: [email-masked]
Subject: Re: [scim] Draft charter - v7

Lots of interesting discussions on the thread. I am trying to figure out
what edits I should make to the latest charter to address
concerns/issues raised.  Summarizing the thread it seems there were two
major points discussed.

Name of the protocol/WG

I personally think there is significant value in the existing
implementations of 1.0 and traction the whole effort has had and
renaming it would be a poor decision.  With that said, it sounds like
most folks either don't care or interested in keeping the name the same.
If someone strongly objects to this or has concerns please raise it.

Actual scope of work

There were a lot of discussions on whether SCIM is solving a cloud use
case or addressing enterprise provisioning case as well.  The problem I
am having is that the discussion is mainly around high level semantics
of cloud vs. enterprise.

Melinda, I fully agree that overgeneralizing the problem is just as bad
as boiling the ocean, however we need to come up with specific use cases
that we think should be included in the charter and problem statement.
The charter actually says:

"The Simple Cloud Identity Management (SCIM) specification will be
designed to simplify user identity management in services and
applications by defining standard protocols and schemas for creating,
reading/searching, modifying, and deleting user identities and
identity-related objects across administrative domains."

Note that it says "services" and "applications".  In my view enterprise
identity provisioning use cases fall under the application part of this
statement. Does anyone have a specific use case that you think should be
addressed by SCIM that given the current charter wording is excluded?

Cheers,

Morteza

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Morteza Ansari (moransar)
Sent: Monday, April 09, 2012 6:56 PM
To: [email-masked]
Subject: [scim] Draft charter - v7

Hi folks,

Here is the updated charter based on the discussions that took place in
the BoF meeting and some guidance from a hallway conversation with Pete
after the meeting.  Please review the text and send your comments.
Hopefully we can close this soon and hand it over to the ADs.

Phil, I added a note regarding targeting extensions in the updated
charter given the email discussions.

Cheers,

Morteza

---

From: Jaimon Jose <[email-masked]>
Date: Thu, 12 Apr 2012 11:49:47 +0530

I'm joining the discussion a little late.  I searched through the
threads and decided to shoot this mail since I didn't find a
satisfactory answer for rationale behind the current charter.  Please
pardon me if the same has been debated earlier.

The core of the WG seems to be to "design ...<snip>...by defining
standard protocols and schemas for creating, reading/searching,
modifying and deleting user identities and identity-related objects
across administrative domains."  I also noticed that the charter
specifically called out that "defining new authentication and
policy/authorization schemes" is considered outside the scope.

However, I"m wondering if the IDM as a domain is moving towards
consolidation of identity services with a number of identity providers
(social identity providers like google, facebook etc.) in addition to
enterprise identities, isn't it better to address how services or
applications can consume identities rather than expecting identities to
be provisioned for each of those services.   All that an
application/service would require is the 4 A's (attributes,
authentication, authorization and audit) of identities.  This way we
will move away from the notion of "identity provisioning" to identifying
ways and means to "securely" consume identities across enterprise,
private and public cloud entities.  As a side effect, enterprise
identities will be safe within their premise.

Sorry if I'm way off track :-)

Regards
--jaimon

Morteza Ansari (moransar) wrote, On 12-04-2012 10:42 AM:
> Also, if I missed any other comments beyond these two please let me know.

---

From: Kelly Grizzle <[email-masked]>
Date: Mon, 16 Apr 2012 16:35:04 +0000

Jaimon,

I agree that in many cases things tend to be moving toward the consolidation of identities into IdP's, however, I don't think this will be a full reality in the near-term (or maybe even the long-term).  There are other efforts that are addressing some of the four A's (SAML, OAuth, OpenID Connect, etc...), so I don't think that SCIM needs to directly be aimed at the single IdP scenario.  While SCIM's read operations could be used to facilitate attribute exchange, this is not the core competency.

There was a lot of lively debate at the BoF, but I think the biggest point of agreement was that SCIM is addressing an important problem that needs to be solved.

Morteza's slides for the BoF do a good job of explaining the problem and why current solutions don't work for certain scenarios.  Check them out here: http://www.ietf.org/proceedings/83/slides/slides-83-scim-3.pdf.

--Kelly

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Jaimon Jose
Sent: Thursday, April 12, 2012 1:20 AM
To: Morteza Ansari (moransar)
Cc: [email-masked]
Subject: Re: [scim] Draft charter - v7

I'm joining the discussion a little late.  I searched through the threads and decided to shoot this mail since I didn't find a satisfactory answer for rationale behind the current charter.  Please pardon me if the same has been debated earlier.

The core of the WG seems to be to "design ...<snip>...by defining standard protocols and schemas for creating, reading/searching, modifying and deleting user identities and identity-related objects across administrative domains."  I also noticed that the charter specifically called out that "defining new authentication and policy/authorization schemes" is considered outside the scope.

However, I"m wondering if the IDM as a domain is moving towards consolidation of identity services with a number of identity providers (social identity providers like google, facebook etc.) in addition to enterprise identities, isn't it better to address how services or applications can consume identities rather than expecting identities to
be provisioned for each of those services.   All that an
application/service would require is the 4 A's (attributes, authentication, authorization and audit) of identities.  This way we will move away from the notion of "identity provisioning" to identifying ways and means to "securely" consume identities across enterprise, private and public cloud entities.  As a side effect, enterprise identities will be safe within their premise.

Regards
--jaimon

> Also, if I missed any other comments beyond these two please let me know.
_______________________________________________
scim mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/scim