Subject: [scim] Ticket 10 - Ability to mark attributes as sensitive (when attrs are returned)

From: Phil Hunt <[email-masked]>
Date: Mon, 28 Oct 2013 11:27:42 -0700

In order to bring Ticket 10 ( http://trac.tools.ietf.org/wg/scim/trac/ticket/10 ) to a close, the following is a new schema attribute (Section 11) definition which defines when an attribute is returned on a query. It defines 4 modes.  

returned - A value that indicates when an attribute's value is returned in a SCIM GET operation or in response to a PUT, POST, or PATCH request. Valid values are:
always - The attribute is always returned regardless of the contents of the "attributes" parameter [API Sec 3.2.3]. For example, "id" is always returned to identify the SCIM record.
never - The attribute is never returned. This is typically used in RESTful operations where the attribute supports only update operations. An attribute with "returned" set to "never" MAY be used in a search filter [[depending on index support]].
default - The attribute is returned in SCIM responses and is returned when the GET "attributes" parameter [API Sec 3.2.3] is not specified.
request - The attribute is returned in response to any SCIM PUT, POST, or PATCH operations if the attribute was specified by the client (for example, the attribute was modified). The attribute is returned in a SCIM GET operation only if specified in the "attributes" parameter [API Sec 3.2.3].

Please let me know if you agree, or if you have concerns.

Note we may need more discussion on the default "returned" values for some attributes.  For now, I'll consult with Kelly and put together a set of proposed defaults (e.g. "id" is "always"). 

Phil

@independentid
www.independentid.com
[email-masked]

---

From: Anthony Nadalin <[email-masked]>
Date: Mon, 28 Oct 2013 20:50:59 +0000

I would like to see the discussion happen on the "default" returned before closing on this text

From: [email-masked] [mailto:[email-masked]] On Behalf Of Phil Hunt
Sent: Monday, October 28, 2013 11:28 AM
To: [email-masked] WG
Subject: [scim] Ticket 10 - Ability to mark attributes as sensitive (when attrs are returned)

*         returned - A value that indicates when an attribute's value is returned in a SCIM GET operation or in response to a PUT, POST, or PATCH request. Valid values are:

o    always - The attribute is always returned regardless of the contents of the "attributes" parameter [API Sec 3.2.3]. For example, "id" is always returned to identify the SCIM record.

o    never - The attribute is never returned. This is typically used in RESTful operations where the attribute supports only update operations. An attribute with "returned" set to "never" MAY be used in a search filter [[depending on index support]].

o    default - The attribute is returned in SCIM responses and is returned when the GET "attributes" parameter [API Sec 3.2.3] is not specified.

o    request - The attribute is returned in response to any SCIM PUT, POST, or PATCH operations if the attribute was specified by the client (for example, the attribute was modified). The attribute is returned in a SCIM GET operation only if specified in the "attributes" parameter [API Sec 3.2.3].

Phil

@independentid
www.independentid.com<http://www.independentid.com>
[email-masked]<mailto:[email-masked]>

---

From: Phil Hunt <[email-masked]>
Date: Mon, 28 Oct 2013 14:00:47 -0700

Tony I recommend we do that right after. 

First do we agree on values for "returned"?

Phil

> On Oct 28, 2013, at 13:50, Anthony Nadalin <[email-masked]> wrote:
> 
> I would like to see the discussion happen on the “default” returned before closing on this text
>  
> ·         returned - A value that indicates when an attribute's value is returned in a SCIM GET operation or in response to a PUT, POST, or PATCH request. Valid values are:
> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim

---

From: Anthony Nadalin <[email-masked]>
Date: Tue, 29 Oct 2013 03:04:49 +0000

+1

From: Phil Hunt [mailto:[email-masked]]
Sent: Monday, October 28, 2013 2:01 PM
To: Anthony Nadalin
Cc: [email-masked] WG
Subject: Re: [scim] Ticket 10 - Ability to mark attributes as sensitive (when attrs are returned)

Phil

On Oct 28, 2013, at 13:50, Anthony Nadalin <[email-masked]<mailto:[email-masked]>> wrote:
I would like to see the discussion happen on the “default” returned before closing on this text

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of Phil Hunt
Sent: Monday, October 28, 2013 11:28 AM
To: [email-masked]<mailto:[email-masked]> WG
Subject: [scim] Ticket 10 - Ability to mark attributes as sensitive (when attrs are returned)

Phil

@independentid

_______________________________________________
scim mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/scim

---

From: Thorsten Roßner <[email-masked]>
Date: Tue, 29 Oct 2013 09:02:41 +0100

Depending on which fields are returned by default an option could be
helpful that returns a complete resource object (except for the fields
that are never returned).

Thanks
Thorsten

---

From: Phil Hunt <[email-masked]>
Date: Tue, 29 Oct 2013 09:03:12 -0700

Thorsten,

Do you agree with the categories?

Phil

> On Oct 29, 2013, at 1:02, Thorsten Roßner <[email-masked]> wrote:
>

---

From: Thorsten Roßner <[email-masked]>
Date: Tue, 29 Oct 2013 18:54:38 +0100

Phil,

yes, I agree. Would it make sense to define a default option when no
"returned" attribute is available? I would prefer "request".

Cheers
Thorsten

---

From: Phil Hunt <[email-masked]>
Date: Tue, 29 Oct 2013 11:02:57 -0700

What I would propose to do is discuss that next week.  We can talk about what the "default" value for index and returned is for each attribute and we can say what the default setting is if unspecified  (e.g. is default the default, or is request the default). 

I think this part is a little more messy and best done with projector and we can quickly mark it up together.  

Phil

@independentid
www.independentid.com
[email-masked]

---

From: Kelly Grizzle <[email-masked]>
Date: Tue, 29 Oct 2013 19:02:12 +0000

+1 for the categories.

For some minor word-smithing, I would remove the word “SCIM” from these definitions.  It can be implied.

--Kelly

From: [email-masked] [mailto:[email-masked]] On Behalf Of Phil Hunt
Sent: Monday, October 28, 2013 4:01 PM
To: Anthony Nadalin
Cc: [email-masked] WG
Subject: Re: [scim] Ticket 10 - Ability to mark attributes as sensitive (when attrs are returned)

Phil

•         returned - A value that indicates when an attribute's value is returned in a SCIM GET operation or in response to a PUT, POST, or PATCH request. Valid values are:

Phil

@independentid