Subject: [scim] Globally Unique Resource Identifiers

From: Shelley <[email-masked]>
Date: Wed, 9 Aug 2017 17:07:35 -0500

The SCIM specification indicates that the id [1]:

*MUST be unique across the SCIM service provider's entire set of resources.*

Is this implying that the identifier must be globally unique across *all
types of resources*, or simply that the identifier must be unique across *all
resources of the same type*? Further, how does this statement account for
*tenancy*?

Requiring uniqueness across resource types may incur undue burden on
service providers to maintain. All resources are relative to a type, e.g.
/Users/<id>. Even the global search functionality doesn't require global
uniqueness because the combination of resourceType and id may be used to
uniquely identify resources. Further, the SCIM 1.1 specification did not
have this requirement, so this could make uplifting to SCIM 2.0 more
difficult for some providers.

[1] https://tools.ietf.org/html/rfc7643#section-3.1

---

From: "Phil Hunt (IDM)" <[email-masked]>
Date: Wed, 9 Aug 2017 16:17:30 -0700

Entire set of resources means all present on the server. At least that is how I read it and how the discussion that I recall having occurred. 

There was concern about naming conflicts (causing desire for renames of immutable ids) and referential integrity as factors affecting this decision. 

Phil

> On Aug 9, 2017, at 3:07 PM, Shelley <[email-masked]> wrote:
> 
>> MUST be unique across the SCIM service provider's entire set of resources.
> 
> Is this implying that the identifier must be globally unique across all types of resources, or simply that the identifier must be unique across all resources of the same type? Further, how does this statement account for tenancy?
> 
> Requiring uniqueness across resource types may incur undue burden on service providers to maintain. All resources are relative to a type, e.g. /Users/<id>. Even the global search functionality doesn't require global uniqueness because the combination of resourceType and id may be used to uniquely identify resources. Further, the SCIM 1.1 specification did not have this requirement, so this could make uplifting to SCIM 2.0 more difficult for some providers.
> 
> _______________________________________________
> scim mailing list
> [email-masked]
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_scim&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=GhthQiFLtNDfeeWDzdzah76F9C9b1Z6OivTWsj3UPas&s=S4YVRZEMfzCuzu7pj12Xn5Spd2lfIj03DsMls_2rOVY&e=

---

From: "Phil Hunt (IDM)" <[email-masked]>
Date: Wed, 9 Aug 2017 16:19:28 -0700

Missed the second part. Most people use guids for this purpose to avoid having to check for conflict.  

If you use an id subject to change you are asking for problems. At least that was the lesson of ldap DNs.  Guids bring stability in many forms. 

Phil