Subject: [scim] Filter ambiguity

From: Steve Moyer <[email-masked]>
Date: Tue, 8 Oct 2013 11:17:28 -0400 (EDT)

I've got a working lexer/parser (with a couple minor problems) to convert the SCIM filter syntax into an expression tree, and now that I'm using it to generate queries, I've noticed that there are ambiguities that will affect what's returned by the back-end.  Our back-end is LDAP-based (which includes other problems) but I'll describe the issue I'm seeing using SQL since I think it's a clearer way to describe the problem.  This ambiguity can occur for any multi-valued attribute, but it will be most severe for the address object.

Given a user smoyer with a work e-mail address of [email-masked] and a home e-mail address of [email-masked], the following SCIM filter:

emails.type eq "work" and emails.value eq "[email-masked]"

would return the user smoyer as a result.

If I was writing this filter, it would be my intention that only users with an e-mail address type of work AND with the value [email-masked] should be returned.

An SQL statement that shows what I believe would be a common case is:

select user.* from user u, email e where u.userName = e.userName and e.type = 'work' and e.value = [email-masked]';

would not return the user smoyer.  In fact, the behavior the SCIM filter implies would require an intersection as follows:

(select user.* from user u, email e where u.userName = e.userName and e.type = 'work') intersect (select user.* from user u, email e where u.userName = e.userName and e.value = [email-masked]')

In thinking through solutions to searches including multi-valued attributes, the only reasonable solution I've come up with is that when fields of a multi-valued attribute are specified, we implicitly agree that they're supposed to be ANDed together within the same object.

Am I missing anything?  (And did I explain the problem correctly?).  Please help me clarify how to address these searches.

Steve

---

From: Phil Hunt <[email-masked]>
Date: Tue, 8 Oct 2013 08:26:15 -0700

Yes you are right. 

Another problem is that a filter is for a record match and not a multi value match. 

It seems there are times when you just want the single matched value returned rather than all values (which would be the correct interpretation). 

I wonder if there are any rest examples out there?

Phil

> On Oct 8, 2013, at 8:17, Steve Moyer <[email-masked]> wrote:
> 
> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim

---

From: Kelly Grizzle <[email-masked]>
Date: Tue, 8 Oct 2013 17:45:56 +0000

Steve,

You're actually referring to the exact same problem that ticket #50 is trying to address - http://tools.ietf.org/wg/scim/trac/ticket/50.  I believe that this is going to be discussed on the next concall, but feel free to start a discussion here.

--Kelly

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Phil Hunt
Sent: Tuesday, October 08, 2013 10:26 AM
To: Steve Moyer
Cc: [email-masked]
Subject: Re: [scim] Filter ambiguity

Yes you are right. 

Phil