Subject: [scim] User Schema Extension example SCIM 1.1

From: Guy Van Tilborgh <[email-masked]>
Date: Thu, 4 Dec 2014 17:43:36 +0100

Hi all,

I am pretty new to SCIM (I read the specs) but I cannot figure out how to
create a SCIM schema extension. I could not find a good example on the
internet so I thought I tried this mailing list. I am trying to make an
extension to a user:

{
    "id" : "<my schema extension URI>, //I am guessing this is the "name"
of my schema extension
    "name" : "User",
    "description" : "U-Man User Account",
    "schema" : "urn:scim:schemas:core:1.0",//What is the point of this
attribute? Is it to specify which version of SCIM you try to extend?
    "endpoint" : "/Users",
    "attributes" : [
        {
            "name" : "myAttr",
            "type" : "complex",
            "multiValued" : false,
            "description" : "my attribute",
            "schema" : "urn:scim:schemas:core:1.0", //What is the point of
this attribute and what should be the value?
            "required" : false,
            "caseExact" : false,
...

Any help would be appreciated.

Kind regards

Guy Van Tilborgh

---

From: Phil Hunt <[email-masked]>
Date: Thu, 4 Dec 2014 10:27:34 -0800

There are two types of extensions. If you just want to extend a User, take a look at the example provided by the Enterprise User extension (sec 4.3).  Note that your new extension would be added to your SCIM SP, ResourceType definition for User under the extensions attribute.

The other way type of extension is to create whole new resources. This is done by defining a new ResourceType. Each resource type has a “base” or “core” schema and can have its own extensions registered.

Phil

@independentid
www.independentid.com
[email-masked]

> On Dec 4, 2014, at 8:43 AM, Guy Van Tilborgh <[email-masked]> wrote:
> 
> Hi all,
> 
> I am pretty new to SCIM (I read the specs) but I cannot figure out how to create a SCIM schema extension. I could not find a good example on the internet so I thought I tried this mailing list. I am trying to make an extension to a user:
> 
> {
>     "id" : "<my schema extension URI>, //I am guessing this is the "name" of my schema extension
>     "name" : "User",
>     "schema" : "urn:scim:schemas:core:1.0",//What is the point of this attribute? Is it to specify which version of SCIM you try to extend?
>     "endpoint" : "/Users",
>     "attributes" : [
>         {
>             "name" : "myAttr",
>             "type" : "complex",
>             "multiValued" : false,
>             "schema" : "urn:scim:schemas:core:1.0", //What is the point of this attribute and what should be the value?
>             "required" : false,
>             "caseExact" : false,
> ...
> 
> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim

---

From: Guy Van Tilborgh <[email-masked]>
Date: Fri, 5 Dec 2014 10:30:22 +0100

Hi,

you are referring to SCIM 2.0, not SCIM 1.1 if I understand correctly. If I
understand the specs, SCIM 1.1 does not require you to have a ResourceType
definition in the Service Provider.

Could you provide me with an example user extension for SCIM 1.1? One
attribute extension, just to illustrate the values the schema attributes
should have?

kind regards

Guy Van Tilborgh

On Thu, Dec 4, 2014 at 7:27 PM, Phil Hunt <[email-masked]> wrote:

> There are two types of extensions. If you just want to extend a User, take
> a look at the example provided by the Enterprise User extension (sec 4.3).
> Note that your new extension would be added to your SCIM SP, ResourceType
> definition for User under the extensions attribute.
>
> The other way type of extension is to create whole new resources. This is
> done by defining a new ResourceType. Each resource type has a “base” or
> “core” schema and can have its own extensions registered.
>
> Phil
>
> @independentid
> www.independentid.com
> [email-masked]
>

---

From: Phil Hunt <[email-masked]>
Date: Fri, 5 Dec 2014 06:56:52 -0800

Guy,

Extended schema is a SCIM 2 feature. It was one of the key issues that SCIM 1.1 had not addressed.

Phil

@independentid
www.independentid.com
[email-masked]

> On Dec 5, 2014, at 1:30 AM, Guy Van Tilborgh <[email-masked]> wrote:
> 
> Hi,
> 
> you are referring to SCIM 2.0, not SCIM 1.1 if I understand correctly. If I understand the specs, SCIM 1.1 does not require you to have a ResourceType definition in the Service Provider.
> 
> Could you provide me with an example user extension for SCIM 1.1? One attribute extension, just to illustrate the values the schema attributes should have?
> 
> kind regards
> 
> Guy Van Tilborgh
> 
> On Thu, Dec 4, 2014 at 7:27 PM, Phil Hunt <[email-masked] <mailto:[email-masked]>> wrote:
> www.independentid.com <http://www.independentid.com/>[email-masked] <mailto:[email-masked]>
>> On Dec 4, 2014, at 8:43 AM, Guy Van Tilborgh <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> Hi all,
>> 
>> [email-masked] <mailto:[email-masked]>
>> https://www.ietf.org/mailman/listinfo/scim <https://www.ietf.org/mailman/listinfo/scim>
> 
>

---

From: Guy Van Tilborgh <[email-masked]>
Date: Fri, 5 Dec 2014 16:19:01 +0100

Phil,

thanks for the help btw :-)

But now I am lost because I thought Schema extension is part of the SCIM
1.1 specs:
http://www.simplecloud.info/specs/draft-scim-core-schema-01.html#anchor1

I also found that WSo2 uses this schema extension to create their own User
objects:
https://docs.wso2.com/display/IS460/Extensible+SCIM+User+Schemas+With+WSO2+Identity+Server

However, I cannot find an example of the schema that they use to extend
their user object which brought me to asking the question.

kind regards

Guy Van Tilborgh

On Fri, Dec 5, 2014 at 3:56 PM, Phil Hunt <[email-masked]> wrote:

> you are referring to SCIM 2.0, not SCIM 1.1 if I understand correctly. If
> I understand the specs, SCIM 1.1 does not require you to have a
> ResourceType definition in the Service Provider.
>
>> There are two types of extensions. If you just want to extend a User,
>> take a look at the example provided by the Enterprise User extension (sec
>> 4.3).  Note that your new extension would be added to your SCIM SP,
>> ResourceType definition for User under the extensions attribute.
>>
>>             "schema" : "urn:scim:schemas:core:1.0", //What is the point
>> of this attribute and what should be the value?
>>             "required" : false,
>>             "caseExact" : false,
>> ...
>>

---

From: Phil Hunt <[email-masked]>
Date: Fri, 5 Dec 2014 08:14:04 -0800

Yes. That model didn’t turn out to work well. I’ll let others who participated in the SCIM 1.1 interops comment.

One of the problems was that in an objectclass model, there was no way for a client to discover what attributes are included with a particular extension, etc.  When we looked at how JSON parsers were working, it was a lot easier to use schema URI’s as containers for extended attributes.  This means that 
* collisions between attribute names are avoided.
* clients can scan JSON and don’t actually have to “discover” schema
* clients can find out by querying schemas and resourcetypes if they do want to discover what is supported
* service providers may ignore attributes and schema they do not support (along the lines of Postel’s law)

Phil

@independentid
www.independentid.com
[email-masked]

> On Dec 5, 2014, at 7:19 AM, Guy Van Tilborgh <[email-masked]> wrote:
> 
> Phil,
> 
> But now I am lost because I thought Schema extension is part of the SCIM 1.1 specs: http://www.simplecloud.info/specs/draft-scim-core-schema-01.html#anchor1 <http://www.simplecloud.info/specs/draft-scim-core-schema-01.html#anchor1>
> 
> I also found that WSo2 uses this schema extension to create their own User objects:https://docs.wso2.com/display/IS460/Extensible+SCIM+User+Schemas+With+WSO2+Identity+Server <https://docs.wso2.com/display/IS460/Extensible+SCIM+User+Schemas+With+WSO2+Identity+Server>
> 
> However, I cannot find an example of the schema that they use to extend their user object which brought me to asking the question.
> 
> kind regards
> 
> Guy Van Tilborgh
> 
> On Fri, Dec 5, 2014 at 3:56 PM, Phil Hunt <[email-masked] <mailto:[email-masked]>> wrote:
> Guy,
> 
>> On Dec 5, 2014, at 1:30 AM, Guy Van Tilborgh <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> Hi,
>>

---

From: Guy Van Tilborgh <[email-masked]>
Date: Mon, 8 Dec 2014 13:23:26 +0100

Thanks, for the reply, but I don't have an answer yet to my original
question. I will assume that extending the schema with one attribute looks
like this in SCIM 1.1:

{
    "id" : "<my schema extension URI>:User, //<my schema extension URI>
equals for instance "urn:hr:schemas"
    "name" : "User",
    "description" : "U-Man User Account",
    "schema" : "<my schema extension URI>",
    "endpoint" : "/Users",
    "attributes" : [
        {
            "name" : "myAttr",
            "type" : "string",
            "multiValued" : false,
            "description" : "my attribute",
            "schema" : "<my schema extension URI>",
            "required" : false,
            "caseExact" : false,
...

kind regards

Guy Van Tilborgh

On Fri, Dec 5, 2014 at 5:14 PM, Phil Hunt <[email-masked]> wrote:
>
> Yes. That model didn’t turn out to work well. I’ll let others who
> participated in the SCIM 1.1 interops comment.
>
> One of the problems was that in an objectclass model, there was no way for
> a client to discover what attributes are included with a particular
> extension, etc.  When we looked at how JSON parsers were working, it was a
> lot easier to use schema URI’s as containers for extended attributes.  This
> means that
>>> The other way type of extension is to create whole new resources. This
>>> is done by defining a new ResourceType. Each resource type has a “base” or
>>> I am pretty new to SCIM (I read the specs) but I cannot figure out how
>>> to create a SCIM schema extension. I could not find a good example on the

---

From: Phil Hunt <[email-masked]>
Date: Mon, 8 Dec 2014 10:10:52 -0800

Guy,

I can’t give you an answer for 1.1 because this is one of the issues 2.0 is intended to fix. 1.1 is underspecified on how to do this.

Can anyone else who implemented 1.1 let Guy know how your servers support extensions (if at all)?

Phil

@independentid
www.independentid.com
[email-masked]

> On Dec 8, 2014, at 4:23 AM, Guy Van Tilborgh <[email-masked]> wrote:
> 
> Thanks, for the reply, but I don't have an answer yet to my original question. I will assume that extending the schema with one attribute looks like this in SCIM 1.1:
> 
> {
>     "id" : "<my schema extension URI>:User, //<my schema extension URI> equals for instance "urn:hr:schemas"
>     "name" : "User",
> On Fri, Dec 5, 2014 at 5:14 PM, Phil Hunt <[email-masked] <mailto:[email-masked]>> wrote:
>> On Dec 5, 2014, at 7:19 AM, Guy Van Tilborgh <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> Phil,
>>