Subject: [scim] What are the response attributes when calling SCIM filter

From: Darshana Gunawardana <[email-masked]>
Date: Wed, 1 Oct 2014 20:06:17 +0530

Hi all,

I'm working on a improvement on SCIM user filtering capabilities in WSO2
Charon implementation which is based on SCIM 1.1.

While implementing, I couldn't find in the spec, what are the bare minimum
attributes should be in SCIM response. I have search this in
section 3.2.2.1 in [1].

In section 3.2, it specify generally when retrieving resources,
"Service Providers MAY choose to respond with a sub-set of Resource
attributes, though MUST minimally return the Resource id and meta
attributes"

Does the same rule apply in filtering also?

[1] http://www.simplecloud.info/specs/draft-scim-api-01.html#query-resources

Thanks,
Darshana

-- 
With Regards,

Darshana Gunawardana,
Alumni : Dept. of Computer Science & Engineering,
University of Moratuwa,
Sri Lanka

---

From: Phil Hunt <[email-masked]>
Date: Wed, 1 Oct 2014 09:10:31 -0700

This is resolved in scim 2. Look under schemas for the attribute meta item "returned". 

Phil

> On Oct 1, 2014, at 7:36, Darshana Gunawardana <[email-masked]> wrote:
> 
> Hi all,
> 
> I'm working on a improvement on SCIM user filtering capabilities in WSO2 Charon implementation which is based on SCIM 1.1.
> 
> While implementing, I couldn't find in the spec, what are the bare minimum attributes should be in SCIM response. I have search this in section 3.2.2.1 in [1].
> 
> "Service Providers MAY choose to respond with a sub-set of Resource attributes, though MUST minimally return the Resource id and meta attributes"
> 
> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim

---

From: Darshana Gunawardana <[email-masked]>
Date: Thu, 2 Oct 2014 09:28:34 +0530

Hi Phil,

Thanks for the response.

Seems like SCIM 2 have well defined structure for attributes returning.

When i look for User schema it have almost all of attributes have returned
value as default. In the attribute required the value default defined as
follows,
   "default : The attribute is returned by default in all SCIM operation
responses where attribute values are returned"
So the question is whether SCIM filter operation response is a one of those
operations which should contains attribute values?

I'm having this problem due to our current implementation return all
attributes for users which matches search filter which seems to be
compliant with the SCIM 2 spec as well. And currently our maxResults for
filter operation is not limited. Hence it takes unacceptable time to build
whole response for filter operations in large user base.

When we do a profiling, we identified that to search in whole user base and
return 1000 user id takes time in milliseconds, but to build response which
contains 1000 users with all attributes takes time like 5 minutes. As for a
improvement, our initial thought was only returning scim id is sufficient, when
filter request does not specified the parameter "attributes".

Wanted to confirm whether this way is compliant with the spec or whether it
is defined, returning id only is not sufficient and specific set
attributes also should always returned for each user in filtering.

Thanks,
Darshana.

On Wed, Oct 1, 2014 at 9:40 PM, Phil Hunt <[email-masked]> wrote:

> [1]
> http://www.simplecloud.info/specs/draft-scim-api-01.html#query-resources
>
> Thanks,
> Darshana
>
> --
> With Regards,
>
> Darshana Gunawardana,

-- 
With Regards,

Darshana Gunawardana,

---

From: Phil Hunt <[email-masked]>
Date: Wed, 1 Oct 2014 21:12:28 -0700

If you want that behavior you could have the client request attributes=id. 

In general only privileged users should be able to return all entries and all attrs. 

You can also change returned to "request" to get the behavior you want and that would be legit. However you could expect some clients to react badly. 

Better to limit max results for most users and limit what avg low-priv users can see. 

Phil

> On Oct 1, 2014, at 20:58, Darshana Gunawardana <[email-masked]> wrote:
> 
> Hi Phil,
> 
> Thanks for the response.
> 
> When i look for User schema it have almost all of attributes have returned value as default. In the attribute required the value default defined as follows,
>    "default : The attribute is returned by default in all SCIM operation responses where attribute values are returned"
> So the question is whether SCIM filter operation response is a one of those operations which should contains attribute values?
> 
> I'm having this problem due to our current implementation return all attributes for users which matches search filter which seems to be compliant with the SCIM 2 spec as well. And currently our maxResults for filter operation is not limited. Hence it takes unacceptable time to build whole response for filter operations in large user base.
> 
> When we do a profiling, we identified that to search in whole user base and return 1000 user id takes time in milliseconds, but to build response which contains 1000 users with all attributes takes time like 5 minutes. As for a improvement, our initial thought was only returning scim id is sufficient, when filter request does not specified the parameter "attributes".
> 
> Wanted to confirm whether this way is compliant with the spec or whether it is defined, returning id only is not sufficient and specific set attributes also should always returned for each user in filtering.
> 
> Thanks,
> Darshana.
>

---

From: Darshana Gunawardana <[email-masked]>
Date: Sat, 4 Oct 2014 23:52:29 +0530

Hi Phil,

Yes, changing to return only id in the filtering, make some existing
clients to do extra work. We need to do some research to find optimal
solution to keep reduce ldap calls while compatible with all existing
clients..

Thanks a lot for your input..

Regards,
Dashana

On Thu, Oct 2, 2014 at 9:42 AM, Phil Hunt <[email-masked]> wrote:

> You can also change returned to "request" to get the behavior you want and
> that would be legit. However you could expect some clients to react badly.
>
> So the question is whether SCIM filter operation response is a one of
> those operations which should contains attribute values?
>
> When we do a profiling, we identified that to search in whole user base
> and return 1000 user id takes time in milliseconds, but to build response
> which contains 1000 users with all attributes takes time like 5 minutes. As
> for a improvement, our initial thought was only returning scim id is
> sufficient, when filter request does not specified the parameter
> "attributes".
>
> Wanted to confirm whether this way is compliant with the spec or whether
> it is defined, returning id only is not sufficient and specific set
>> While implementing, I couldn't find in the spec, what are the bare
>> minimum attributes should be in SCIM response. I have search this in
>> section 3.2.2.1 in [1].
>>

-- 
With Regards,

Darshana Gunawardana,

---

From: Phil Hunt <[email-masked]>
Date: Sat, 4 Oct 2014 11:49:14 -0700

Dashana,

I am not sure what you are suggesting/proposing. 

If anything SCIM2 already has a lot of functionality to control which attributes are returned per request that is similar in nature to LDAP. LDAP protocol returns all attributes by default except for ‘operational' attributes. If anything, SCIM returns slightly fewer attributes and allows for configured flexibility (as with LDAP).

In SCIM, returning only “id” is easily achieved using the attributes qualifier.

What are you suggesting we change exactly?

Phil

@independentid
www.independentid.com
[email-masked]

On Oct 4, 2014, at 11:22 AM, Darshana Gunawardana <[email-masked]> wrote:

> Hi Phil,
> 
> Yes, changing to return only id in the filtering, make some existing clients to do extra work. We need to do some research to find optimal solution to keep reduce ldap calls while compatible with all existing clients..
>

---

From: Darshana Gunawardana <[email-masked]>
Date: Sun, 5 Oct 2014 00:52:57 +0530

Hi Phil,

Oh.. I thinks my previous mail was bit ambiguous..  Sorry for that.. I'm
agree that SCIM2 has the flexibility to define which attributes should
return.

In my earlier response what i meant was, I need to look deep-in *my*
implementation details and find optimal solution.. It wasn't meant to
suggest to change the spec..

I got answers for my original question, "what attributes should return in a
user filter response" and the answer was "as per SCIM2 it depends on the
'returned' meta attribute in user schema".

So we can conclude the thread i guess..

Thanks,
Darshana

On Sun, Oct 5, 2014 at 12:19 AM, Phil Hunt <[email-masked]> wrote:

> If anything SCIM2 already has a lot of functionality to control which
> attributes are returned per request that is similar in nature to LDAP. LDAP
> protocol returns all attributes by default except for ‘operational'
> attributes. If anything, SCIM returns slightly fewer attributes and allows
> for configured flexibility (as with LDAP).
>
>> You can also change returned to "request" to get the behavior you want
>> and that would be legit. However you could expect some clients to react
>> badly.
>>
>> When i look for User schema it have almost all of attributes have
>> returned value as default. In the attribute required the value default
>> defined as follows,

-- 
With Regards,

Darshana Gunawardana,

---

From: Phil Hunt <[email-masked]>
Date: Sat, 4 Oct 2014 12:39:41 -0700

Darshana,

No problem.

Cheers,

Phil

@independentid
www.independentid.com
[email-masked]

On Oct 4, 2014, at 12:22 PM, Darshana Gunawardana <[email-masked]> wrote:

> Hi Phil,
> 
> Oh.. I thinks my previous mail was bit ambiguous..  Sorry for that.. I'm agree that SCIM2 has the flexibility to define which attributes should return.
> 
> In my earlier response what i meant was, I need to look deep-in my implementation details and find optimal solution.. It wasn't meant to suggest to change the spec..
> 
> I got answers for my original question, "what attributes should return in a user filter response" and the answer was "as per SCIM2 it depends on the 'returned' meta attribute in user schema".
>