Subject: [scim] Membership attributes expressed in a SCIM group

From: David Langenberg <[email-masked]>
Date: Wed, 25 Sep 2013 08:52:25 -0600

Hello All,

I'm presently engaged in adding SCIM support to the Internet2's Grouper
product.  One of the use-cases we're trying to address is to emit group
membership attributes over SCIM.  The more concrete case is decorating who
is the manager of the group within the group's membership list.  I'm trying
to figure out a way to do that within the standard, but it seems that there
is no way to do that at present.  If there is a way, would somebody please
point me in the right direction, else, what would be the process for
getting it added?

Thanks

Dave

-- 
David Langenberg
Identity & Access Management
The University of Chicago

---

From: Patrick Radtke <[email-masked]>
Date: Wed, 25 Sep 2013 09:25:20 -0700

Members is a multi-valued attribute so you could use any of the 
pre-defined attributes listed here

http://tools.ietf.org/html/draft-ietf-scim-core-schema-02#section-3.2

or add your own through an extension.

IMHO, 'type' might be suitable for this. It is defined as "A label 
indicating the attribute's function". So you could do

"members": [
        {
          "value": "2819c223-7f76-453a-919d-413861904646",
          "$ref": 
"https://example.com/v1/Users/2819c223-7f76-453a-919d-413861904646",
          "display": "Babs Jensen",
          "type": "manager"
        },
        {
          "value": "902c246b-6245-4190-8e05-00816be7344a",
          "$ref": 
"https://example.com/v1/Users/902c246b-6245-4190-8e05-00816be7344a",
          "display": "Mandy Pepperidge"
        }
      ]

-Patrick

On 9/25/13 7:52 AM, David Langenberg wrote:
> membership attributes over SCIM.  The more concrete case is decorating
> who is the manager of the group within the group's membership list.  I'm
> trying to figure out a way to do that within the standard, but it seems
> that there is no way to do that at present.  If there is a way, would
> somebody please point me in the right direction, else, what would be the
> process for getting it added?
>
> Thanks
>
> Dave
>
> --
> David Langenberg
> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim
>

---

From: Kiran Ayyagari <[email-masked]>
Date: Wed, 25 Sep 2013 23:00:24 +0530

AFAIK, the only canonical types defined[1] for 'type' in this context are
"User" and "Group".

[1] http://tools.ietf.org/html/draft-ietf-scim-core-schema-02#section-8

On Wed, Sep 25, 2013 at 9:55 PM, Patrick Radtke <[email-masked]>wrote:

> http://tools.ietf.org/html/**draft-ietf-scim-core-schema-**02#section-3.2<http://tools.ietf.org/html/draft-ietf-scim-core-schema-02#section-3.2>
>
>          "value": "2819c223-7f76-453a-919d-**413861904646",
>          "$ref": "https://example.com/v1/Users/**2819c223-7f76-453a-919d-*
> *413861904646<https://example.com/v1/Users/2819c223-7f76-453a-919d-413861904646>
> ",
>          "value": "902c246b-6245-4190-8e05-**00816be7344a",
>          "$ref": "https://example.com/v1/Users/**902c246b-6245-4190-8e05-*
> *00816be7344a<https://example.com/v1/Users/902c246b-6245-4190-8e05-00816be7344a>
> ",
>> ______________________________**_________________
>> scim mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/**listinfo/scim<https://www.ietf.org/mailman/listinfo/scim>
>>
>>
> ______________________________**_________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/**listinfo/scim<https://www.ietf.org/mailman/listinfo/scim>
>

-- 
Kiran Ayyagari
http://keydap.com

---

From: Patrick Radtke <[email-masked]>
Date: Wed, 25 Sep 2013 10:41:59 -0700

I read that section 8 as User and Group members are read only - e.g. you 
can't add or modify a User or Group through the group membership.

Elsewhere in the spec when it refers to canonical values for an 
attribute it says "Canonical Values". Anyhow, 3.1.1 String says

"Additionally, when Canonical Values
    are specified Service Providers SHOULD conform to those values if
    appropriate, but MAY provide alternate String values to represent
    additional values."

which sounds like the service provider is allowed to add additional values.

-Patrick

http://tools.ietf.org/html/draft-ietf-scim-core-schema-02#section-3.1.1

On 9/25/13 10:30 AM, Kiran Ayyagari wrote:
> AFAIK, the only canonical types defined[1] for 'type' in this context
> are "User" and "Group".
>
>
> On Wed, Sep 25, 2013 at 9:55 PM, Patrick Radtke <[email-masked]
> <mailto:[email-masked]>> wrote:
>
>     http://tools.ietf.org/html/__draft-ietf-scim-core-schema-__02#section-3.2
>     <http://tools.ietf.org/html/draft-ietf-scim-core-schema-02#section-3.2>
>
>               "value": "2819c223-7f76-453a-919d-__413861904646",
>               "$ref":
>     "https://example.com/v1/Users/__2819c223-7f76-453a-919d-__413861904646
>     <https://example.com/v1/Users/2819c223-7f76-453a-919d-413861904646>",
>               "value": "902c246b-6245-4190-8e05-__00816be7344a",
>               "$ref":
>     "https://example.com/v1/Users/__902c246b-6245-4190-8e05-__00816be7344a
>     <https://example.com/v1/Users/902c246b-6245-4190-8e05-00816be7344a>",
>         _________________________________________________
>         scim mailing list
>         [email-masked] <mailto:[email-masked]>
>         https://www.ietf.org/mailman/__listinfo/scim
>         <https://www.ietf.org/mailman/listinfo/scim>
>
>
>     _________________________________________________
>     scim mailing list
>     [email-masked] <mailto:[email-masked]>
>     https://www.ietf.org/mailman/__listinfo/scim
>     <https://www.ietf.org/mailman/listinfo/scim>
>
>
>
>
> --
> Kiran Ayyagari
> http://keydap.com

---

From: Kiran Ayyagari <[email-masked]>
Date: Wed, 25 Sep 2013 23:23:46 +0530

On Wed, Sep 25, 2013 at 11:11 PM, Patrick Radtke <[email-masked]>wrote:

> Elsewhere in the spec when it refers to canonical values for an attribute
> it says "Canonical Values". Anyhow, 3.1.1 String says
>
yeap, didn't notice it, thanks for the pointer

>
> -Patrick
>
> http://tools.ietf.org/html/**draft-ietf-scim-core-schema-**
> 02#section-3.1.1<http://tools.ietf.org/html/draft-ietf-scim-core-schema-02#section-3.1.1>
>
>
>> [1] http://tools.ietf.org/html/**draft-ietf-scim-core-schema-**
>> 02#section-8<http://tools.ietf.org/html/draft-ietf-scim-core-schema-02#section-8>
>>
>>
>>     http://tools.ietf.org/html/__**draft-ietf-scim-core-schema-__**
>> 02#section-3.2<http://tools.ietf.org/html/__draft-ietf-scim-core-schema-__02#section-3.2>
>>
>>     <http://tools.ietf.org/html/**draft-ietf-scim-core-schema-**
>> 02#section-3.2<http://tools.ietf.org/html/draft-ietf-scim-core-schema-02#section-3.2>
>> >
>>
>>               "value": "2819c223-7f76-453a-919d-__**413861904646",
>>               "$ref":
>>     "https://example.com/v1/Users/**__2819c223-7f76-453a-919d-__**
>> 413861904646<https://example.com/v1/Users/__2819c223-7f76-453a-919d-__413861904646>
>>
>>     <https://example.com/v1/Users/**2819c223-7f76-453a-919d-**
>> 413861904646<https://example.com/v1/Users/2819c223-7f76-453a-919d-413861904646>
>> >",
>>               "value": "902c246b-6245-4190-8e05-__**00816be7344a",
>>               "$ref":
>>     "https://example.com/v1/Users/**__902c246b-6245-4190-8e05-__**
>> 00816be7344a<https://example.com/v1/Users/__902c246b-6245-4190-8e05-__00816be7344a>
>>
>>     <https://example.com/v1/Users/**902c246b-6245-4190-8e05-**
>> 00816be7344a<https://example.com/v1/Users/902c246b-6245-4190-8e05-00816be7344a>
>> >",
>>         ______________________________**___________________
>>         scim mailing list
>>         https://www.ietf.org/mailman/_**_listinfo/scim<https://www.ietf.org/mailman/__listinfo/scim>
>>         <https://www.ietf.org/mailman/**listinfo/scim<https://www.ietf.org/mailman/listinfo/scim>
>> >
>>
>>
>>     ______________________________**___________________
>>     scim mailing list
>>     https://www.ietf.org/mailman/_**_listinfo/scim<https://www.ietf.org/mailman/__listinfo/scim>
>>
>>     <https://www.ietf.org/mailman/**listinfo/scim<https://www.ietf.org/mailman/listinfo/scim>
>> >
>>
>>
>>
>>
>> --
>> Kiran Ayyagari
>> http://keydap.com
>>
>
>

-- 
Kiran Ayyagari
http://keydap.com

---

From: Kelly Grizzle <[email-masked]>
Date: Wed, 25 Sep 2013 19:33:03 +0000

I think the thought with "MAY provide alternate String values to represent additional values" was geared more toward multi-valued attributes like ims where there are likely to be other types that are currently unknown.  For interoperability, I would not recommend deviating from User and Group as the types for group members.

Have you considered extending group to add a manager attribute?  For example:

   {
     "schemas": ["urn:scim:schemas:core:2.0:Group",

                     "urn:edu:2.0:Group" ],
     "id": "e9e30dba-f08f-4109-8486-d5c6a331660a",
     "displayName": "Tour Guides",
     "members": [
       {

         "$ref": "https://example.com/v1/Users/2819c223-7f76-453a-919d-413861904646",

         "display": "Babs Jensen"

       }

     ],

     "urn:edu:2.0:Group": {

       "manager": {

         "managerId": "26118915-6090-4610-87e4-49d8ca9f808d",

         "$ref": "/Users/26118915-6090-4610-87e4-49d8ca9f808d",

         "displayName": "John Smith"

       }

     },

     "meta": {

       "resourceType": "Group",

       "created": "2010-01-23T04:56:22Z",

       "lastModified": "2011-05-13T04:42:34Z",

       "version": "W\/\"3694e05e9dff592\"",

       "location": "https://example.com/v1/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a"

     }

   }

From: [email-masked] [mailto:[email-masked]] On Behalf Of Kiran Ayyagari
Sent: Wednesday, September 25, 2013 12:54 PM
To: Patrick Radtke
Cc: David Langenberg; Kiran Ayyagari; [email-masked]
Subject: Re: [scim] Membership attributes expressed in a SCIM group

On Wed, Sep 25, 2013 at 11:11 PM, Patrick Radtke <[email-masked]<mailto:[email-masked]>> wrote:
I read that section 8 as User and Group members are read only - e.g. you can't add or modify a User or Group through the group membership.

Elsewhere in the spec when it refers to canonical values for an attribute it says "Canonical Values". Anyhow, 3.1.1 String says

-Patrick

On Wed, Sep 25, 2013 at 9:55 PM, Patrick Radtke <[email-masked]<mailto:[email-masked]>
<mailto:[email-masked]<mailto:[email-masked]>>> wrote:

    "members": [
            {

    -Patrick

        Hello All,

        I'm presently engaged in adding SCIM support to the Internet2's
        Grouper
        product.  One of the use-cases we're trying to address is to
        emit group
        membership attributes over SCIM.  The more concrete case is
        decorating
        who is the manager of the group within the group's membership
        list.  I'm
        trying to figure out a way to do that within the standard, but
        it seems
        that there is no way to do that at present.  If there is a way,
        would
        somebody please point me in the right direction, else, what
        would be the
        process for getting it added?

        Thanks

        Dave

        _________________________________________________
        scim mailing list
        [email-masked]<mailto:[email-masked]> <mailto:[email-masked]<mailto:[email-masked]>>
        https://www.ietf.org/mailman/__listinfo/scim
        <https://www.ietf.org/mailman/listinfo/scim>

    _________________________________________________
    scim mailing list
    [email-masked]<mailto:[email-masked]> <mailto:[email-masked]<mailto:[email-masked]>>
    https://www.ietf.org/mailman/__listinfo/scim

--
Kiran Ayyagari
http://keydap.com

--
Kiran Ayyagari
http://keydap.com