Subject: Re: [scim] Implementer Questions

From: Grahame Grieve <[email-masked]>
Date: Sat, 16 Aug 2014 21:37:18 +1000

A follow up question:

Concerning the filters, it says:

If the specified attribute in a filter expression is a multi-valued
attribute, the resource MUST match if any of the instances of the
given attribute match the specified criterion; e.g. if a User has
multiple emails values, only one has to match for the entire User to
match.

This has unexpected consequences when the filter operator is "ne", and
there is more than one item

Grahame

On Sat, Aug 16, 2014 at 9:20 AM, Grahame Grieve
<[email-masked]> wrote:
> hi
>
> I am the lead editor for FHIR, a healthcare equivalent to SCIM. I am
> just adding SCIM support to my FHIR reference server - partly to allow
> me to use SCIM for it's purpose in my server, and partly so we can
> explore what is required to write up how to integrate SCIM into FHIR
> (and therefore encourage users in health to adopt it - it's still over
> the horizon for health, but not long now)
>
> I have a few questions that the documentation doesn't really explain:
>
> 1. can you PUT after a DELETE to bring a user back to life?
>
> 2. When you do a PUT, the document says:
>
> Attributes whose mutability is "readWrite", that are omitted from the
>    request body, MAY be assumed to be not asserted by the client.  The
>    service provider MAY assume any existing values are to be cleared or
>    the service provider MAY assign a default value to the final resource
>    representation.  Service providers MAY take into account whether a
>    client has access to, or understands, all of the resource's
>    attributes when deciding whether non-asserted attributes SHALL be
>    removed or defaulted.  Clients that would like to override a server
>    defaults, MAY specify "null" for a single-valued attribute or an
>    empty array "[]" for a multi-valued attribute to clear all values.
>
> I find this little obscure for multi-valued attributes. If the client
> provides a single email address, then all the existing ones are
> over-written? It would be nice if this were clear. Also, this doesn't
> address the question of a extension schemas - I haven't found anywhere
> about whether a server is allowed to accept extension schemas it
> doesn't know about (or required to), but if it can/does, how does that
> work with updates?
>
> 3. if the server exposes the same interface on multiple host names
> (this is common), what happens to meta.location?
>
> 4. there's nothing like a namespace on the user name. If you're using
> SCIM with OAuth, and auto-creating user accounts on the fly, where
> would the OAuth user identity go? (The intent here is that you
> autocreate the user resource, but then a user can edit the details
> associated with the account after it is created)
>
> 5. Regarding query, it says "SCIM service SHOULD ignore any query
> parameters they do not recognize" - the specification doesn't give
> guidance about what to do if a single parameter in a value path or a
> logical conjunction is not recognised (treat it as true or false or
> ignore the whole group?). And there doesn't seem like a way for the
> client to know what has been accepted or not? But later the
> specification says "Providers MUST decline to filter results if the
> specified filter operation is not recognized" - This doesn't seem
> reliably consistent
>
> 6. I am mystified by the /ServiceProviderConfigs end-point. As far as
> I can figure out, there is only ever one config, so do you have to
> search for it? or does it have some kind of fixed identity that I have
> missed?
>
>
> thanks
> Grahame
>
> --
> -----
> http://www.healthintersections.com.au /
> [email-masked] / +61 411 867 065

-- 
-----
http://www.healthintersections.com.au / [email-masked]

---

From: Phil Hunt <[email-masked]>
Date: Sat, 16 Aug 2014 11:11:37 -0700

We may need to revise the text a bit here.

The issue with filters is that filters are used to match “resources” rather than specific “values” of a multi-valued attribute.

So  a match with any value means that all values are returned (with the resource).  Likewise, for a ne, then no values must be equal.

I will take a look at the text and try to clean it up.

Phil

@independentid
www.independentid.com
[email-masked]

On Aug 16, 2014, at 4:37 AM, Grahame Grieve <[email-masked]> wrote:

> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim

---

From: Grahame Grieve <[email-masked]>
Date: Sun, 17 Aug 2014 07:43:51 +1000

I think revision is definitely required, because this is not
"likewise" to me - if it were likewise then for ne, a match would be
returned if there was any value with no match

Grahame