Subject: Re: [scim] WG Review: System for Cross-domain Identity Management (SCIM)

From: Alexey Melnikov <[email-masked]>
Date: Mon, 04 Jun 2012 22:03:08 +0100

On 31/05/2012 16:08, IESG Secretary wrote:
> A new IETF working group has been proposed in the Applications
> Area.  The IESG has not made any determination as yet. The following
> draft charter was submitted, and is provided for informational purposes
> only. Please send your comments to the IESG mailing list ([email-masked])
> by June 7, 2012.
Ok, this version is much better than the one I complained about 
privately to some ADs. Either this, or I am getting used to it ;-).

I have 2 comments on the latest Charter text that I would like to see 
addressed:

1). I would like the Charter to be crystally clear that the protocol 
being worked on is going to be HTTP-based. I don't think saying 
"RESTful" makes it unambiguous, because REST is style of software 
architecture. Also, "RESTful" probably needs a reference.

2). I would really like the initial milestone for the LDAP mapping to be 
*before* the scheme document is finished. This will help to make sure 
that the SCIM schema is not reinventing the wheel needlessly. (Of course 
I wish you would have just used the LDAP schema with no changes, then 
the mapping to LDAP becomes Noop. But that is probably a wishful thinking.)
> System for Cross-domain Identity Management (SCIM)
> ----------------------------------------------
> Status: Proposed Working Group
>
> Last updated: 2012-05-29
>
> Chair(s): TBD
>
> Applications Area Director(s):
>    Pete Resnick<[email-masked]>
>    Barry Leiba<[email-masked]>
>
> Mailing Lists:
>    General Discussion:[email-masked]
>    To Subscribe:https://www.ietf.org/mailman/listinfo/scim
>    Archive:http://www.ietf.org/mail-archive/web/scim/
>
> Description of Working Group:
>
> The System for Cross-domain Identity Management (SCIM) working group
> will standardize methods for creating, reading, searching, modifying,
> and deleting user identities and identity-related objects across
> administrative domains, with the goal of simplifying common tasks
> related to user identity management in services and applications.
>
> "Standardize" does not necessarily mean that the working group will
> develop new technologies.  For example, the existing specifications
> for "SCIM 1.0" provide RESTful interfaces on top of HTTP rather than
> defining a new application protocol.
>
> Today, distributed identity management across administrative domains
> is complicated by a lack of protocol and schema standardization
> between consumers and producers of identities.  This has led to a
> number of approaches, including error-prone manual administration and
> bulk file uploads, as well as proprietary protocols and mediation
> devices that must be adapted to each service for each organization.
> While there is existing work in the field, it has not been widely
> adopted for a variety of reasons, including a lack of common artifacts
> such as schema, toolsets, and libraries.
>
> The SCIM working group will develop the core schema and RESTful
> interfaces to address these problems.  Initially, the group will focus
> on
> - a schema definition
> - a set of operations for creation, modification, and deletion of users
> - schema discovery
> - read and search
> - bulk operations
> - mapping between the inetOrgPerson LDAP object class (RFC 2798) and
>    the SCIM schema
>
> It will follow that by considering extensions for client targeting of
> specific SCIM endpoints and SAML binding.  The approach will be
> extensible.
>
> The group will use, as starting points, the following drafts in the
> following ways:
>       draft-scim-use-cases-00 as the initial use cases for SCIM
>       draft-scim-core-schema-00 as the schema specification
>       draft-scim-api-00 as the protocol specification
>
> These drafts are based on existing specifications, which together are
> commonly known as SCIM 1.0.  Because there is existing work with
> existing implementations, some consideration should be given to
> backward compatibility, though getting it right takes priority.  This
> group will consider the operational experience gathered from the
> existing work, as well as experiences with work done by other bodies,
> including the OASIS Provisioning TC.
>
> The use cases document will be a "living document", guiding the
> working group during its development of the standards.  The group may
> take snapshots of that document for Informational publication, to
> serve as documentation of the motivation for the work in progress
> and to similarly guide planning and implementation.
>
> The group will produce Proposed Standards for a schema, a REST-based
> protocol, and a SAML binding, as well as an Informational document
> defining an LDAP mapping. In doing so, the group will make the
> terminology consistent, identify any functional gaps that would be
> useful for future work, address internationalization, and provide
> guidelines and mechanisms for extensibility.
>
> In addition, the working group will ensure that the SCIM protocol
> embodies good security practices. Given both the sensitivity of the
> information being conveyed in SCIM messages and the regulatory
> requirements regarding the privacy of personally identifiable
> information, the working group will pay particular attention to issues
> around authorization, authenticity, and privacy.
>
> The group considers the following out of scope for this group:
>       Defining new authentication schemes
>       Defining new policy/authorization schemes
>
> Milestones
>
> 06/2012    Initial adoption of SCIM use cases, as a living document
> 06/2012    Initial adoption of SCIM core schema
> 08/2012    Initial adoption of SCIM restful interface draft
> 12/2012    Snapshot version of SCIM use cases to IESG as Informational (possibly)
> 12/2012    Proposal for client targeting of SCIM endpoints
> 01/2013    Initial adoption of SCIM LDAP inetOrgPerson mapping draft
> 02/2013    SCIM core schema to IESG as Proposed Standard
> 05/2013    SCIM restful interface to IESG as Proposed Standard
> 06/2013    SCIM LDAP inetOrgPerson mapping to IESG as Informational
> 07/2013    Initial adoption of SCIM SAML bindings draft
> 08/2013    Client targeting of SCIM endpoints to IESG as Proposed Standard
> 09/2013    Snapshot update of SCIM use cases as Informational (possibly)
> 11/2013    SCIM SAML bindings to IESG as Proposed Standard
> 01/2014    Work completed; discuss re-charter

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 04 Jun 2012 15:07:06 -0600

> architecture. Also, "RESTful" probably needs a reference.

<reference anchor="REST">
<front>
<title>Architectural Styles and the Design of Network-based Software
Architectures</title>
<author initials="R." surname="Fielding" fullname="Roy Thomas Fielding">
  <organization>University of California, Irvine</organization>
</author>
</front>
<seriesInfo name="" value="2000" />
<format type="PDF"
target="http://www.ics.uci.edu/~fielding/pubs/dissertation/fielding_dissertation.pdf"/>
</reference>

> the mapping to LDAP becomes Noop. But that is probably a wishful thinking.)

I'd prefer to use vCard4, but we can fight about that later. ;-)

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Alexey Melnikov <[email-masked]>
Date: Mon, 04 Jun 2012 22:24:15 +0100

>> On 31/05/2012 16:08, IESG Secretary wrote:
  [...]
> I'd prefer to use vCard4, but we can fight about that later. ;-)

That would be my second preferred choice as well. (Anything other than 
Yet Another Schema for a User Account will do, really.) But LDAP mapping 
is already on the table...

---

From: Eliot Lear <[email-masked]>
Date: Tue, 05 Jun 2012 05:29:05 +0200

Alexey,

On 6/4/12 11:03 PM, Alexey Melnikov wrote:
>
> 2). I would really like the initial milestone for the LDAP mapping to
> be *before* the scheme document is finished. This will help to make
> sure that the SCIM schema is not reinventing the wheel needlessly. (Of
> course I wish you would have just used the LDAP schema with no
> changes, then the mapping to LDAP becomes Noop. But that is probably a
> wishful thinking.)

I don't understand your concern here- the milestones indicate precisely
that below.

Eliot

> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim
>
>

---

From: Alexey Melnikov <[email-masked]>
Date: Tue, 5 Jun 2012 11:16:31 +0100

Hi Eliot,

> I don't understand your concern here- the milestones indicate precisely

Formally: yes. But the initial version of the LDAP mapping is supposed to be adopted in January 2013 and the schema is going to IESG in February. Would any changes to the schema due to LDAP be accepted at this  point? I think the answer would be "you must be kidding, we are done with the schema".

So move the LDAP milestone earlier by 4-5 months.

---

From: Phil Hunt <[email-masked]>
Date: Tue, 5 Jun 2012 08:55:46 -0700

Fwiw. LDAP does not support complex attributes. Without an extension to ldap schema it seems unlikely that the mapped data will be interoperable when accessing via ldap. 

This only matters if there is need for high fidelity mappings. IOW one where the same scim entry can be written and read back. 

Phil