Subject: Re: [scim] Group Display Name Uniqueness

From: Shelley <[email-masked]>
Date: Tue, 10 Dec 2013 17:25:48 -0600

The lack of a unique attribute in the Group resource still seems to
represent a bit of a gap and inconsistency in the core schema and this
appears to be an outstanding concern as noted by this and other discussions
which remain open [1,2,3].

The SCIM id is an immutable, provider-generated ID and the externalId is
consumer-specific. As such, neither of these are appropriate candidates for
defining a semantic contract between multiple consumers and SPs without the
use of an extension or separate process. The lack of a required, unique
attribute can limit both systems and human abilities to differentiate
between groups and derive meaning from them.

Dale's proposal to introduce "groupName" [1] seems reasonable to help
mitigate this concern, although this will not help our 1.1 implementation.
As mentioned, our SCIM 1.1 SP implementation currently requires the group
displayName to be unique to help fill this gap, although we're considering
using custom extensions in addition to/instead of the unique displayName.
Admittedly, requiring a "display name" to be unique doesn't seem completely
appropriate; however, given that it is the only required attribute for
groups, it seems like a reasonable option and the least disruptive place to
put a unique constraint.

Any further thoughts on this topic or practical examples of how other SCIM
implementations handle groups -particularly, if/how groups with duplicate
displayNames are reconciled/differentiated and how semantic meaning is
derived- would be appreciated.

[1] http://www.ietf.org/mail-archive/web/scim/current/msg00698.html
[2] http://www.ietf.org/mail-archive/web/scim/current/msg01253.html
[3] http://storm.alert.sk/blog/2012/04/13/SCIMming-the-Surface #15

On Wed, Jul 24, 2013 at 9:51 AM, Shelley <[email-masked]> wrote:

> Should the group "displayName" attribute be UNIQUE?
>
> This would be more inline with requiring the user "userName" attribute to
> be unique, and seems reasonable - what value is there in having multiple
> different groups with the same name without a guaranteed differentiation
> between them aside from a provider-generated ID?
>
> (For what it's worth, for these reasons our SCIM SP implementation already
> requires group displayNames to be UNIQUE such that they behave similarly to
> user userNames.)
>