Subject: [scim] extended schema: clarifications on operations

From: Phil Hunt <[email-masked]>
Date: Wed, 11 Sep 2013 10:18:59 -0700

In implementing the new 02 draft, a couple of questions have come up regarding operations against attributes that are part of extended schema (e.g. enterprise User).  This not only impacts search filters and attribute retrieval parameters, but also impacts PATCH and other operations.

My general feeling is that when the attribute is unique, the client MAY use the attribute name alone. However, if the attribute name is not unique, the operation may fail (what error should be indicated?).

Further, 
Clients may fully qualify an address an attribute by prefixing the attribute name with the schema urn + ":".  The right-most colon separates the attribute name from the URN.  [[Should we choose a different separator?]]

For example with an enterpriseUser (part of the core schema), a client may use displayName or urn:scim:schemas:extension:enterprise:2.0:User:displayName to refer to the attribute.  

For PATCH a fully qualified update would look like:

   PATCH /Groups/acbf3ae7-8463-4692-b4fd-9b4da3f908ce
   Host: example.com
   Accept: application/json
   Content-Type: application/json
   Authorization: Bearer h480djs93hd8
   If-Match: W/"a330bc54f0671c9"

   {
     "schemas": ["urn:scim:schemas:core:2.0:Group"],
     "urn:scim:schemas:core:2.0:Group:members": [
       {
         "display": "Babs Jensen",
         "$ref": "https://example.com/v1/Users/2819c223-7f76-453a-919d-413861904646",
         "value": "2819c223-7f76-453a-919d-413861904646"
       }
     ]
   }

Note that in this case, "display", "$ref", and "value" do not have to have the fully qualified name since the context is known from the parent "members" attribute.

I will follow this up with a new ticket.

Phil

@independentid
www.independentid.com
[email-masked]