Subject: [scim] Searching with POST instead of GET

From: Phil Hunt <[email-masked]>
Date: Wed, 27 Jun 2012 12:34:57 -0700

Has any consideration been given to allowing searching in SCIM with a POST operation? The reason is, that the URL based approach in GET means high-risk filters can be caught up in logs and is generally something to be avoided. We have a security concern about passing parameters in many cases using GET.  

In thinking about how to do this, could we allow/reserve POST for queries and BULK, and expand PUT to support add/replace. Such as with /Users for an add, and /Users/identifier for a replace.  Right now POST is used for replace and for Bulk.

If this was discussed in the consortium, maybe someone could summarize the current position on the IETF list here?

Another alternative is to allow GET parameters to be passed in the header.

Phil

@independentid
www.independentid.com
[email-masked]

---

From: Anthony Nadalin <[email-masked]>
Date: Wed, 27 Jun 2012 23:27:04 +0000

PUT could be a replace object, or create a named object, when applicable
POST  could be create a new object based on data provided, or submit a command

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Phil Hunt
Sent: Wednesday, June 27, 2012 12:35 PM
To: [email-masked]
Subject: [scim] Searching with POST instead of GET

Phil

@independentid
www.independentid.com
[email-masked]

_______________________________________________
scim mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/scim

---

From: Phil Hunt <[email-masked]>
Date: Wed, 27 Jun 2012 16:30:41 -0700

The requirement is to do a search without using GET.  IOW a non-url based search where the URL only shows /Users or /Users/id.

I know what the spec currently says. What I'm trying to do is open the possibility for POST to do a search.  Hopefully that clarifies.

Phil

@independentid
www.independentid.com
[email-masked]

---

From: Igor Faynberg <[email-masked]>
Date: Wed, 27 Jun 2012 20:18:06 -0400

Why not pass the search query parameters in the POST data block?

Igor

|
|

---

From: Anthony Nadalin <[email-masked]>
Date: Wed, 27 Jun 2012 23:40:08 +0000

I would hope that the POST is not limited to SEARCH but is just a COMMAND of which SEARCH is one of the COMMANDS

-----Original Message-----
From: Phil Hunt [mailto:[email-masked]] 
Sent: Wednesday, June 27, 2012 4:31 PM
To: Anthony Nadalin
Cc: [email-masked]
Subject: Re: [scim] Searching with POST instead of GET

Phil

@independentid
www.independentid.com
[email-masked]

On 2012-06-27, at 4:27 PM, Anthony Nadalin wrote:

> PUT could be a replace object, or create a named object, when 
> applicable POST  could be create a new object based on data provided, 
> or submit a command
> 
>

---

From: Phil Hunt <[email-masked]>
Date: Wed, 27 Jun 2012 19:25:33 -0700

agreed.

Phil

@independentid
www.independentid.com
[email-masked]

---

From: Phil Hunt <[email-masked]>
Date: Wed, 27 Jun 2012 19:25:56 -0700

Yes.  That's what I would like to do. The concern is that POST is already used for replace and bulk.

Phil

@independentid
www.independentid.com
[email-masked]

---

From: "Brenner, Michael Ralf (Michael)" <[email-masked]>
Date: Thu, 28 Jun 2012 07:17:59 -0500

That should not be an impediment, and it is RSTful. You can use the POST request body as a container for passing a command (e.g. SEARCH, REPLACE, BULK) and it's respective attributes. It's being done in many other standard RESTful API (e.g. OMA Payment - where you can create different transactions using POST (e.g. reserve amount, charge against reservation, reserve additional amount, release reservation, etc).
An example that emulates a GET is the POST request used in long-polling (see Bayeux protocol or OMA Notification Channel API standard, partially modeled after Bayeux).

Michael

From: [email-masked] [mailto:[email-masked]] On Behalf Of Phil Hunt
Sent: Wednesday, June 27, 2012 10:26 PM
To: Faynberg, Igor (Igor)
Cc: [email-masked]
Subject: Re: [scim] Searching with POST instead of GET

Phil

@independentid
www.independentid.com<http://www.independentid.com>
[email-masked]<mailto:[email-masked]>

Igor

Phil

@independentid

www.independentid.com<http://www.independentid.com/>

[email-masked]<mailto:[email-masked]>

-----Original Message-----

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of Phil Hunt

To: [email-masked]<mailto:[email-masked]>

Phil

@independentid

www.independentid.com<http://www.independentid.com/>

[email-masked]<mailto:[email-masked]>

scim mailing list

[email-masked]<mailto:[email-masked]>

scim mailing list

[email-masked]<mailto:[email-masked]>

scim mailing list

[email-masked]<mailto:[email-masked]>

https://www.ietf.org/mailman/listinfo/scim
_______________________________________________
scim mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/scim

---

From: Kelly Grizzle <[email-masked]>
Date: Fri, 29 Jun 2012 15:35:00 +0000

I don't know how often there will be a security concern over GET parameters, although I can see some of the more security conscious worrying about this.  My vote would be to simply add official support for the GET method in Bulk requests (it is currently the only excluded method).  Clients that are not worried can use a normal GET request and others could use a POST to /Bulk with a GET request in the payload.

--Kelly

From: [email-masked] [mailto:[email-masked]] On Behalf Of Brenner, Michael Ralf (Michael)
Sent: Thursday, June 28, 2012 7:18 AM
To: Phil Hunt; Faynberg, Igor (Igor)
Cc: [email-masked]
Subject: Re: [scim] Searching with POST instead of GET

Michael

Cc: [email-masked]<mailto:[email-masked]>

Phil

@independentid

Igor

Phil

@independentid

-----Original Message-----

Phil

@independentid

scim mailing list

scim mailing list

scim mailing list