Subject: [scim] Organizational unit SCIM extension

From: Haavar Valeur <[email-masked]>
Date: Tue, 24 Mar 2015 23:54:33 +0000

Has there been any discussion around a standard SCIM extension that handles organizational units (OU)? A quick google search came up with a couple of emails from 3 years ago, but no real subsidence.  

If there has not been any discussion around this, is there a reason for it?

Best
Haavar

---

From: Phil Hunt <[email-masked]>
Date: Tue, 24 Mar 2015 19:15:56 -0500

It depends...

If you want hierarchy like ldap, there is no way to do this as scim is flat except for resource type. 

If you just want to define organizations as their own resource type it would be fairly easy to write this up as an extension. I believe many are doing this informally now. 

Hope this helps. 

Phil

> On Mar 24, 2015, at 18:54, Haavar Valeur <[email-masked]> wrote:
> 
> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim

---

From: Haavar Valeur <[email-masked]>
Date: Wed, 25 Mar 2015 01:02:47 +0000

I was thinking about it as it’s own resource type. It could be a simple as something similar to how groups work, or it could be more extensive and include rules/roles for delegated administration.

Doesn’t it make sense to make a formal schema for OUs?

> On Mar 24, 2015, at 7:15 PM, Phil Hunt <[email-masked]> wrote:
> 
> It depends...
> 
>> https://secure-web.cisco.com/1_BK0Fo6lGLVSPbrS2-AlBEDm4Wdg_EtiobfKOvpifVTl58fcj_Xdv2qVTbP1RAzfJrxQShzMliuxy2DwB8i_zUceTgizz8pM_fUB7dUtGBrj5DsYGoL7UYB6JcApwuIrUnsb27g9rMlh5f0vJTPjhHCDX8AKl6DGV6r-h5MPgsM/https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fscim
>

---

From: Phil Hunt <[email-masked]>
Date: Tue, 24 Mar 2015 20:19:33 -0500

I would avoid a group like object because of scalability issues.  Organization memberships tend to be very very large (compared even to groups).

I believe this is why there is an “organization” attribute in the Enterprise extension for User resources.

You can query for all the User’s who have a organization eq “some value”, or you can check a User resource to find out what organization they are a member of.   IOW - treat the organization attribute as a kind of role for delegated admin.

Phil

@independentid
www.independentid.com
[email-masked]

> On Mar 24, 2015, at 8:02 PM, Haavar Valeur <[email-masked]> wrote:
>

---

From: Haavar Valeur <[email-masked]>
Date: Wed, 25 Mar 2015 02:16:06 +0000

It probably makes sense for the OU association to be on the user object, since it’s a many-to-one relationship. However, I think it still makes sense to have a schema for OUs. You need a way to create and delete them, and make nested OUs. Perhaps even add admins to the OU.

> On Mar 24, 2015, at 8:19 PM, Phil Hunt <[email-masked]> wrote:
>