Subject: Re: [scim] PLEASE REVIEW: I-D Action: draft-ietf-scim-api-01.txt

From: Alex Redston <[email-masked]>
Date: Wed, 17 Apr 2013 09:02:33 +0100

Hello SCIM list

I am new to this list so please forgive me as I just finding my way. I 
am not yet sure how these matters get discussed.

Issue 25 seems to be an extremely sensible change.

I am unclear on issue 28 - Multi tenancy is one of the defining factors 
that distinguishes a cloud based solution from a hosted solution, is the 
intention to further explore the security considerations or instead just 
not give any specification in this area, my concern would be that there 
will be multi tenant solutions and unless the specification is at least 
prescriptive to some degree this will be an area which will pose greater 
risks to security if implementers go ahead and muddle on to create their 
own solution.

An example of a multi tennant solution imagine a solution where a cloud 
based identity server presents a SCIM interface to some other cloud 
based service which does not have a readily accessible API.

Alex Redston

On issue
On 16/04/2013 20:00, [email-masked] wrote:
> If you have received this digest without all the individual message
> attachments you will need to update your digest options in your list
> subscription.  To do so, go to
>
> https://www.ietf.org/mailman/listinfo/scim
>
> Click the 'Unsubscribe or edit options' button, log in, and set "Get
> MIME or Plain Text Digests?" to MIME.  You can set this option
> globally for all the list digests you receive at this point.
>
>
>
> Send scim mailing list submissions to
> 	[email-masked]
>
> To subscribe or unsubscribe via the World Wide Web, visit
> 	https://www.ietf.org/mailman/listinfo/scim
> or, via email, send a message with subject or body 'help' to
> 	[email-masked]
>
> You can reach the person managing the list at
> 	[email-masked]
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of scim digest..."
>
>
> Today's Topics:
>
>     1. PLEASE REVIEW: I-D Action: draft-ietf-scim-api-01.txt
>        (Kelly Grizzle)
>
>
> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim

-- 
Alex Redston

Technical Architect, Managing Director
Switch Research Limited

+44 1328 838821
+44 7973 320795

---

From: Kelly Grizzle <[email-masked]>
Date: Fri, 19 Apr 2013 19:54:12 +0000

Hi Alex ... thanks for the feedback.

> is the intention to further explore the security considerations or instead just not give any specification in this area

The idea is to just give some alternatives for service providers to consider when implementing multi-tenancy.  This section is really more informative than it is prescriptive.  Service providers may choose to implement multi-tenancy in other ways as well.

> my concern would be that there will be multi tenant solutions and unless the specification is at least prescriptive to some degree this will be an area which will pose greater risks to security if implementers go ahead and muddle on to create their own solution.

When we first started discussing multi-tenancy, it became apparent that many of the service providers have different ways that they want to implement this.  Instead of SCIM dictating a method (and all of the implications that come with that particular method), we chose to leave it out of the spec and just provide some general guidance.  We've actually discussed creating another document (outside of SCIM) that addresses multi-tenancy for many of the IETF I-Ds that have to deal with this.

Do you have suggestions for text that we can add to address some of the security considerations that you foresee?

--Kelly

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of Alex Redston
Sent: Wednesday, April 17, 2013 3:03 AM
To: [email-masked]<mailto:[email-masked]>
Subject: Re: [scim] PLEASE REVIEW: I-D Action: draft-ietf-scim-api-01.txt

Hello SCIM list

I am new to this list so please forgive me as I just finding my way. I am not yet sure how these matters get discussed.

I am unclear on issue 28 - Multi tenancy is one of the defining factors that distinguishes a cloud based solution from a hosted solution, is the intention to further explore the security considerations or instead just not give any specification in this area, my concern would be that there will be multi tenant solutions and unless the specification is at least prescriptive to some degree this will be an area which will pose greater risks to security if implementers go ahead and muddle on to create their own solution.

An example of a multi tennant solution imagine a solution where a cloud based identity server presents a SCIM interface to some other cloud based service which does not have a readily accessible API.

Alex Redston

On issue
On 16/04/2013 20:00, [email-masked]<mailto:[email-masked]> wrote:

  [email-masked]<mailto:[email-masked]>

  [email-masked]<mailto:[email-masked]>

  [email-masked]<mailto:[email-masked]>

Today's Topics:

      (Kelly Grizzle)

scim mailing list

[email-masked]<mailto:[email-masked]>

--

Alex Redston

Switch Research Limited

+44 1328 838821

+44 7973 320795