Subject: [scim] Resend: How to use SCIM against a multi-username system

From: Duc Thuan Nguy <[email-masked]>
Date: Wed, 2 Oct 2013 10:28:17 +0700

Hi SCIM groups,

(I resend this email because it seems the first one got lost
somewhere. Perhaps it is because I sent it from another email account which wasn't subscribed to the SCIM group. This email aims to correct that mistake) 

Our company wants to implement SCIM 1.1 for our identity
management product. I think SCIM is great yet simple framework and is very
eager to implement it. However, I find one problem when I try to adopt SCIM for
our system: simply speaking, our system supports multiple usernames. In other
words, one user can have more than one usernames, for example:

-         
Username_as_username: bjensen.

-         
Email_as_username: [email-masked]

A user can use any of the “username” to login.

As a consequent, when a create user request needs to specify
not only a username but also the type of that username. Unfortunately, I
couldn’t find any predefined SCIM attribute which can be used for that “type of
username”.

I can think of a few options:

A standard SCIM create user request:

{

"schemas":["urn:scim:schemas:core:1.0"],

"userName":"bjensen",

"externalId":"bjensen",

"name":{

"formatted":"Ms. Barbara J Jensen III",

"familyName":"Jensen",

"givenName":"Barbara"

}

}

Approach 1: extended SCIM create user request:

{

"schemas":["urn:scim:schemas:core:1.0"],

"userName":"bjensen",

"externalId":"bjensen",

"name":{

"formatted":"Ms. Barbara J Jensen III",

"familyName":"Jensen",

"givenName":"Barbara"

}

"urn:scim:schemas:extension:ourproductname:1.0":{

"userNameType":"email_as_username",

  }

}

Approach 2: define separate endpoint for each username type:
an endpoint to create a user will look like: https://example.com/email_as_username/v1/Users

Approach 3: Ask the client developer to append a
“userNameType=…” parameter to the end of the request.

Could you please tell me if any of the approaches above are
SCIM compliant and usable? What alternatives do I have?

Thank you in advance,

Nguy Duc Thuan.

---

From: Bjorn Aannestad <[email-masked]>
Date: Wed, 2 Oct 2013 17:34:51 +0000 (UTC)

You could add a custom attribute for the user name type - those kinds of extensions are supported by the specification.  However, I'm do not think mixing the two attribute types is the right solution. Are both email and a user name required by your system when creating a user?   If so, I would recommend storing each in their respective predefined attributes.    If only an email address is required when creating a user, when that is all you have, I would recommend storing the email in both attributes. If only a user name is required, and the email is optional, then of course store the user name and leave the email blank. In all cases, allowing the user to log in with either name should be done in the authentication logic, not in the provisioning data when the user is created. -Bjorn Aannestad From: Duc Thuan Nguy ([email-masked]) Sent: Tuesday, October 1, 2013 10:28 PM To: [email-masked] Subject: [scim] Resend: How to use SCIM against a multi-username system   Hi SCIM groups, (I resend this email because it seems the first one got lost somewhere. Perhaps it is because I sent it from another email account which wasn't subscribed to the SCIM group. This email aims to correct that mistake) Our company wants to implement SCIM 1.1 for our identity management product. I think SCIM is great yet simple framework and is very eager to implement it. However, I find one problem when I try to adopt SCIM for our system: simply speaking, our system supports multiple usernames. In other words, one user can have more than one usernames, for example: -          Username_as_username: bjensen. -          Email_as_username: [email-masked] A user can use any of the “username” to login.   As a consequent, when a create user request needs to specify not only a username but also the type of that username. Unfortunately, I couldn’t find any predefined SCIM attribute which can be used for that “type of username”.   I can think of a few options:   A standard SCIM create user request:    {      "schemas":["urn:scim:schemas:core:1.0"],      "userName":"bjensen",      "externalId":"bjensen",      "name":{        "formatted":"Ms. Barbara J Jensen III",        "familyName":"Jensen",        "givenName":"Barbara"      }    }   Approach 1: extended SCIM create user request:    {      "schemas":["urn:scim:schemas:core:1.0"],      "userName":"bjensen",      "externalId":"bjensen",      "name":{        "formatted":"Ms. Barbara J Jensen III",        "familyName":"Jensen",        "givenName":"Barbara"      }      "urn:scim:schemas:extension:ourproductname:1.0":{                 "userNameType":"email_as_username",      }    }   Approach 2: define separate endpoint for each username type: an endpoint to create a user will look like: https://example.com/email_as_username/v1/Users   Approach 3: Ask the client developer to append a “userNameType=…” parameter to the end of the request.   Could you please tell me if any of the approaches above are SCIM compliant and usable? What alternatives do I have?   Thank you in advance, Nguy Duc Thuan.

---

From: Duc Thuan Nguy <[email-masked]>
Date: Thu, 3 Oct 2013 14:46:42 +0700

Hi Bjorn,Thank you taking time to reply my question. Please let me explain a little bit about our username system. In fact, normal username and email are only two examples. Other possibilities include social security number, or any user-defined types. There is no limitation with regard to username types. Looking at the problem from the database point of view, we don't have a single column to store username. Instead, a user has a list of claims, e.g.: - http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name - http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress - gov:saml:attribute:SocialSecurityNumber- ...Any of them can be used as username. Our clients can set up a login page for public users to use Name for username, and a login page for corporate users to use email address as username. However, when creating a new user, *one and only one* username type is required. So:Q: Are both email and a user name required by your system when creating a user?     
 A: No, only one is required. Any of the username type is fine.

I agree with you about "In all cases, allowing the user to log in with either name should be done in the authentication logic, not in the provisioning data when the user is created." The point here is that when a user is created, I need to know what username type to map the "username" specified in an SCIM request to.

Am I right that your reply means using a custom attribute likes the following is the best way I should do?
     "urn:scim:schemas:extension:ourproductname:1.0":{       
                "userNameType":"email_as_username",            }  

Best Regards,
Thuan.
 
Date: Wed, 2 Oct 2013 17:34:51 +0000
From: [email-masked]
To: [email-masked]; [email-masked]
Subject: RE: [scim] Resend: How to use SCIM against a multi-username system

 
  You could add a custom attribute for the user name type - those kinds of extensions are supported by the specification.  However, I'm do not think mixing the two attribute types is the right solution.

 Are both email and a user name required by your system when creating a user?  
  
 If so, I would recommend storing each in their respective predefined attributes.   

 If only an email address is required when creating a user, when that is all you have, I would recommend storing the email in both attributes.

 If only a user name is required, and the email is optional, then of course store the user name and leave the email blank.

 In all cases, allowing the user to log in with either name should be done in the authentication logic, not in the provisioning data when the user is created.

 -Bjorn Aannestad

 

  From: 
  Duc Thuan Nguy ([email-masked])

  Sent: Tuesday, October 1, 2013 10:28 PM

  To: 
  [email-masked]

  Subject: [scim] Resend: How to use SCIM against a multi-username system 

    Hi SCIM groups, 
     
    (I resend this email because it seems the first one got lost somewhere. Perhaps it is because I sent it from another email account which wasn't subscribed to the SCIM group. This email aims to correct that mistake) 

    Our company wants to implement SCIM 1.1 for our identity management product. I think SCIM is great yet simple framework and is very eager to implement it. However, I find one problem when I try to adopt SCIM for our system: simply speaking, our system supports multiple usernames. In other words, one user can have more than one usernames, for example: 

    -           

    -           

    

    As a consequent, when a create user request needs to specify not only a username but also the type of that username. Unfortunately, I couldn’t find any predefined SCIM attribute which can be used for that “type of username”. 

    

       { 

         "userName":"bjensen", 
      
         "externalId":"bjensen", 
      
         "name":{ 

           "familyName":"Jensen", 
      
           "givenName":"Barbara" 
      
         } 
      
       } 

     
       { 

         "userName":"bjensen", 
      
         "externalId":"bjensen", 
      
         "name":{ 

           "familyName":"Jensen", 
      
           "givenName":"Barbara" 
      
         } 

      
         } 
      
       } 

    Approach 2: define separate endpoint for each username type: an endpoint to create a user will look like: https://example.com/email_as_username/v1/Users 

    Approach 3: Ask the client developer to append a “userNameType=…” parameter to the end of the request. 

    Could you please tell me if any of the approaches above are SCIM compliant and usable? What alternatives do I have? 

    Thank you in advance, 
     
    Nguy Duc Thuan.

---

From: Bjorn Aannestad <[email-masked]>
Date: Thu, 03 Oct 2013 08:51:21 -0500

Ah, I missed the one-and-only-one aspect.

Yes, the custom attribute solution is most compliant with the specification.

-Bjorn

On 2013-10-03 2:46 AM, Duc Thuan Nguy wrote:
> Hi Bjorn,
>
> Thank you taking time to reply my question. Please let me explain a 
> little bit about our username system. In fact, normal username and 
> email are only two examples. Other possibilities include social 
> security number, or any user-defined types. There is no limitation 
> with regard to username types.
>
> Looking at the problem from the database point of view, we don't have 
> a single column to store username. Instead, a user has a list 
> of claims, e.g.:
>
>  - http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
>
>  - http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
>
>  - gov:saml:attribute:SocialSecurityNumber
>
> - ...
>
> Any of them can be used as username. Our clients can set up a login 
> page for public users to use Name for username, and a login page for 
> corporate users to use email address as username. However, when 
> creating a new user, *one and only one* username type is required.
>
> So:
>
> Q: Are both email and a user name required by your system when 
> creating a user?
> I agree with you about "In all cases, allowing the user to log in with 
> either name should be done in the authentication logic, not in the 
> provisioning data when the user is created." The point here is that 
> when a user is created, I need to know what username type to map the 
> "username" specified in an SCIM request to.
>
> ------------------------------------------------------------------------
> You could add a custom attribute for the user name type - those kinds 
> of extensions are supported by the specification.  However, I'm do not 
> think mixing the two attribute types is the right solution.
>
> If only an email address is required when creating a user, when that 
> is all you have, I would recommend storing the email in both attributes.
>
> If only a user name is required, and the email is optional, then of 
> course store the user name and leave the email blank.
>
> In all cases, allowing the user to log in with either name should be 
> done in the authentication logic, not in the provisioning data when 
> the user is created.
>
> -Bjorn Aannestad
>
>
>
>
> ------------------------------------------------------------------------
> *From:* Duc Thuan Nguy ([email-masked]) 
> <mailto:[email-masked]%29>
> *Sent:* Tuesday, October 1, 2013 10:28 PM
> *To:* [email-masked] <mailto:[email-masked]>
> *Subject*: [scim] Resend: How to use SCIM against a multi-username system
>
> Hi SCIM groups,
>
> somewhere. Perhaps it is because I sent it from another email account 
> which wasn't subscribed to the SCIM group. This email aims to correct 
> that mistake)
>
> Our company wants to implement SCIM 1.1 for our identity management 
> product. I think SCIM is great yet simple framework and is very eager 
> to implement it. However, I find one problem when I try to adopt SCIM 
> for our system: simply speaking, our system supports multiple 
> usernames. In other words, one user can have more than one usernames, 
> for example:
>
> -Username_as_username: bjensen.
>
> -Email_as_username: [email-masked] <mailto:[email-masked]>
>
> A user can use any of the "username" to login.
>
> As a consequent, when a create user request needs to specify not only 
> a username but also the type of that username. Unfortunately, I 
> couldn't find any predefined SCIM attribute which can be used for that 
> "type of username".
>
> Approach 2: define separate endpoint for each username type: an 
> endpoint to create a user will look like: 
> https://example.com/email_as_username/v1/Users
>
> Approach 3: Ask the client developer to append a "userNameType=..." 
> parameter to the end of the request.
>
> Could you please tell me if any of the approaches above are SCIM 
> compliant and usable? What alternatives do I have?
>
> Thank you in advance,
>
> Nguy Duc Thuan.
>
>
>
>
> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim

---

From: Alex Redston <[email-masked]>
Date: Fri, 04 Oct 2013 07:23:23 +0100

Outside of the context of SCIM similar scenarios have come up, like in 
the naming of the "locality" object class in NetWare Directory Services.

The naming issue you are describing is similar to that of NDS where in 
the schema more than one attribute could be a naming attribute for a 
given object.

For example:

Some object class definitions specify multiple naming attributes. For 
example, the Locality object class is named by the L (Locality Name) and 
S (State or Province Name) attributes. Thus, an RDN for locality can 
include just an L (Locality Name) attribute, just an S (State or 
Province Name) attribute, or both attributes. For example, the name for 
the Provo, Utah locality could be

  *

    L=Provo

  *

    S=Utah

  *

    L=Provo + S=Utah

The last example uses both attributes with a plus sign (+) to indicate 
where the second attribute's value begins. When the type specifiers (in 
this case, L and S) are used as shown, the name is referred to as a 
typed name. A typeless name has the following format: "Provo+Utah".

In such a system you might have two locality objects called L=Greater 
London or S=Middlesex they are both localities, the same class but with 
different naming attributes

Alex

Alex Redston

Technical Architect, Managing Director
Switch Identity Governance Limited

+44 1328 838821
+44 7973 320795

Alex Redston

---

From: Duc Thuan Nguy <[email-masked]>
Date: Tue, 8 Oct 2013 14:11:43 +0700

Hi Alex,
Ah yes, we also have another service implementation which we support a few ways of specifying "username type". One of them is to use a similar combination similar to your suggestion. I think it doesn't conflict with any SCIM constraint and thus is a viable solution.

Thanks a bunch,
Thuan.

Date: Fri, 4 Oct 2013 07:16:12 +0100
From: [email-masked]
To: [email-masked]
CC: [email-masked]
Subject: Re: Re: [scim] Resend: How to use SCIM against a multi-username system

  
    Outside of the context of SCIM similar
      scenarios have come up, like in the naming of the "locality"
      object class in NetWare Directory Services.

      Multiple naming attributes in combination

      The naming issue you are describing is similar to that of NDS
      where in the schema more than one attribute could be a naming
      attribute for a given object.

      For example:

      Some object class definitions specify multiple
        naming attributes. For example, the Locality object class is
        named by the L (Locality Name) and S (State or Province Name)
        attributes. Thus, an RDN for locality can include just an L
        (Locality Name) attribute, just an S (State or Province Name)
        attribute, or both attributes. For example, the name for the
        Provo, Utah locality could be

            L=Provo

            S=Utah

            L=Provo + S=Utah

      The last example uses both attributes with a plus
        sign (+) to indicate where the second attribute’s value begins.
        When the type specifiers (in this case, L and S) are used as
        shown, the name is referred to as a typed name. A typeless name
        has the following format: “Provo+Utah”.

      Alex

      Alex Redston

Redston Systems Limited

+44 1328 838821
+44 7973 320795

Registered Office:
6 LANGDALE COURT
WITNEY
OXFORDSHIRE
UNITED KINGDOM
OX28 6FG

Company No. 02916682

      
      Hi Bjorn,
        Thank you taking time to reply my question. Please let me
          explain a little bit about our username system. In fact,
          normal username and email are only two examples. Other
          possibilities include social security number, or any
          user-defined types. There is no limitation with regard to
          username types.

        Looking at the problem from the database point of view, we
          don't have a single column to store username. Instead, a user
          has a list of claims, e.g.:

        - ...

        Any of them can be used as username. Our clients can set up a
          login page for public users to use Name for username, and a
          login page for corporate users to use email address as
          username. However, when creating a new user, *one and only
          one* username type is required.

        So:

        Q: Are both email and a user name required by your system
          when creating a user?   

          I agree with you about "In all cases, allowing the user to log
          in with either name should be done in the authentication
          logic, not in the provisioning data when the user is created."
          The point here is that when a user is created, I need to know
          what username type to map the "username" specified in an SCIM
          request to.

          Am I right that your reply means using a custom attribute
          likes the following is the best way I should do?

                       

        Best Regards,
        Thuan.

          Subject: RE: [scim] Resend: How to use SCIM against a
          multi-username system

          You could add a custom attribute for the user name type -
          those kinds of extensions are supported by the specification.
           However, I'm do not think mixing the two attribute types is
          the right solution. 

          Are both email and a user name required by your system when
          creating a user?   

          If so, I would recommend storing each in their respective
          predefined attributes.    

          If only an email address is required when creating a user,
          when that is all you have, I would recommend storing the email
          in both attributes. 

          If only a user name is required, and the email is optional,
          then of course store the user name and leave the email blank.

          In all cases, allowing the user to log in with either name
          should be done in the authentication logic, not in the
          provisioning data when the user is created. 

          -Bjorn Aannestad 

          

           From: Duc
            Thuan Nguy ([email-masked]) 

          To: [email-masked] 

          Subject: [scim] Resend: How to use SCIM against a
          multi-username system

             Hi SCIM groups, 
             (I resend this email because it
              seems the first one got lost somewhere. Perhaps it is
              because I sent it from another email account which wasn't
              subscribed to the SCIM group. This email aims to correct
              that mistake)
             
             Our company wants to implement SCIM
              1.1 for our identity management product. I think SCIM is
              great yet simple framework and is very eager to implement
              it. However, I find one problem when I try to adopt SCIM
              for our system: simply speaking, our system supports
              multiple usernames. In other words, one user can have more
              than one usernames, for example: 
            
              -          
            
              -          
            
             A user can use any of the
              “username” to login. 
               
             As a consequent, when a create user
              request needs to specify not only a username but also the
              type of that username. Unfortunately, I couldn’t find any
              predefined SCIM attribute which can be used for that “type
              of username”. 

             A standard SCIM create user
              request: 
            
                 { 

                   "userName":"bjensen", 
            
                   "externalId":"bjensen",

                   "name":{ 
            
                     "formatted":"Ms.
                Barbara J Jensen III", 

                "familyName":"Jensen", 
            
                     "givenName":"Barbara"

                   } 
            
                 } 
               
             Approach 1: extended SCIM create
              user request: 
            
                 { 

                   "userName":"bjensen", 
            
                   "externalId":"bjensen",

                   "name":{ 
            
                     "formatted":"Ms.
                Barbara J Jensen III", 

                "familyName":"Jensen", 
            
                     "givenName":"Barbara"

                   } 

            
                   } 
            
                 } 
               
             Approach 2: define separate
              endpoint for each username type: an endpoint to create a
              user will look like: https://example.com/email_as_username/v1/Users

             Approach 3: Ask the client
              developer to append a “userNameType=…” parameter to the
              end of the request. 
               
             Could you please tell me if any of
              the approaches above are SCIM compliant and usable? What
              alternatives do I have? 
               
             Thank you in advance, 
             Nguy Duc Thuan.

---

From: Duc Thuan Nguy <[email-masked]>
Date: Tue, 8 Oct 2013 14:24:46 +0700

Hi Samuel,
Nope, not late yet. I delayed this task for a week and planned to start it tomorrow. Back to topic, in the world of federated access management where we need to manage identities from multiple Identity Providers, I think there are other people who need to deal with similar use cases. I'm eager to see what solutions they come up with they start to adopt SCIM.

Best Regards,Thuan.

Date: Sun, 6 Oct 2013 19:07:27 -0500
Subject: Re: [scim] Resend: How to use SCIM against a multi-username system
From: [email-masked]
To: [email-masked]
CC: [email-masked]

Hi Thuan,
A bit late but anyway.Interesting use-case, I think that you solution with the extension is a good way to go to specify the attribute that the user should use to authenticate with. One comment though, I would create the extension like this:
"urn:scim:schemas:extension:<Aditional login data>:1.0":{
   "userName":"<scim_attribute_name>",

}
If more people has this problem they might want to use you extension if it does not contain you company name. And if there is enough traction it might be possible to include in a future version of SCIM.

Cheers//Samuel

On Thu, Oct 3, 2013 at 2:46 AM, Duc Thuan Nguy <[email-masked]> wrote:

Hi Bjorn,Thank you taking time to reply my question. Please let me explain a little bit about our username system. In fact, normal username and email are only two examples. Other possibilities include social security number, or any user-defined types. There is no limitation with regard to username types.

Looking at the problem from the database point of view, we don't have a single column to store username. Instead, a user has a list of claims, e.g.:
 - http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

- ...
Any of them can be used as username. Our clients can set up a login page for public users to use Name for username, and a login page for corporate users to use email address as username. However, when creating a new user, *one and only one* username type is required.

So:
Q: Are both email and a user name required by your system when creating a user?     
 A: No, only one is required. Any of the username type is fine.

 
Best Regards,
Thuan.

 

  

  

  

 -Bjorn Aannestad

 

  From: 

  To: 
  [email-masked]

   

    Hi SCIM groups, 

    

    
    -           

    -           

    

 

    

    

 

       { 

         "userName":"bjensen", 

         "externalId":"bjensen", 

         "name":{ 

           "familyName":"Jensen", 

           "givenName":"Barbara" 

         } 

       } 

    

       { 

         "userName":"bjensen", 

         "externalId":"bjensen", 

         "name":{ 

           "familyName":"Jensen", 

           "givenName":"Barbara" 

         } 

         } 

       } 

    

    

 

    

    

 
    Thank you in advance, 

    Nguy Duc Thuan. 

scim mailing list

[email-masked]