Subject: [scim] AD review of draft-ietf-scim-use-cases-04

From: Barry Leiba <[email-masked]>
Date: Thu, 12 Mar 2015 15:26:52 -0400

I like this document, and I think it's about ready to go.  I just have
two issues I'd like to discuss with the editors and working group:

1. I think the security considerations section is too brief, and would
be better fleshed out a bit.  There are going to be details that'll be
left to the schema and api documents -- details that have to do with
the schema and api, of course.  But this document could and should
talk about the general security considerations for what SCIM is doing.
What are the general threats and privacy issues, and how do you expect
them to be dealt with?  Let the security considerations in this
document form the basis on which the other documents with expand when
the protocol details are in place.

2. The IESG has been strongly questioning the value of publishing
use-case documents as RFCs.  The question is whether they really have
archival value, or whether no one will read them in six months or so,
when the protocols they informed have been published.  Often, it would
be better to publish collections of use cases and related discussion
in the working group's wiki, rather than going for RFC publication.  I
very much support that questioning.  But...

This document is more than a use-cases document, and it sells itself
short by burying that, by making the reader figure that out.  It's
really definitions and overview, flows, use cases, and requirements.
As such, I think it *does* have value as an RFC.  Let's not make the
rest of the IESG wonder about that, and perhaps take a different view.
I suggest you retitle the document something like this:

OLD
SCIM Use Cases

NEW
System for Cross-domain Identity Management (SCIM) Definitions,
Overview, and Flows

END

(That also expands SCIM, which the RFC Editor will insist on, so you
might as well do it now.)

Then for the abstract:

OLD
   This document lists the user scenarios and use cases of System for
   Cross-domain Identity Management (SCIM).

NEW
   This document provides definitions and an overview of the System
   for Cross-domain Identity Management (SCIM).  It lays out the
   system's modes and flows, and includes user scenarios, use cases,
   and requirements.

END

And then tweak the Introduction accordingly.

Do those points sound reasonable?
(I will put the document into "AD Evaluation: Revised I-D Needed" state.)

Barry

---

From: "Kepeng Li" <[email-masked]>
Date: Fri, 13 Mar 2015 11:12:02 +0800

Hi Barry,

Thanks for the review and evaluation.

>But this document could and should talk about the general security
>considerations for what SCIM is doing.

OK, will add that.

>Do those points sound reasonable?

Sounds reasonable to me.

Kind Regards
Kepeng

在 13/3/15 3:26 am， "Barry Leiba" <[email-masked]> 写入:

>_______________________________________________
>scim mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/scim

---

From: "Morteza Ansari (moransar)" <[email-masked]>
Date: Fri, 13 Mar 2015 16:36:16 +0000

Thanks for the review Barry.

My comment as WG members and definitely not as Chair:

Do we really need to publish the use cases as an RFC, even if we modify it
to ³definitions, overview, and flows² as Barry suggested? I think the
biggest value of the use cases doc was to the WG during development of the
core spec, and now that the core spec are pretty much final or close to
final its value for the most part is superseded by the core spec.

I certainly think it still has historical value helping someone new to
SCIM understand why some decisions were made. It also could help with the
overall overview of SCIM. However, I think there might be other
potentially more suitable mechanisms for capture that as opposed to
turning this into an Informational RFC. For example we could publish it on
³simplecloud.info² site along with other implementation/testing/guide
articles & presentations.

Thoughts?

Cheers,
Morteza

---

From: Ian Glazer <[email-masked]>
Date: Fri, 13 Mar 2015 12:58:10 -0400

I don't have a strong opinion one way or another but lean slightly towards
publishing it on scimplecloud.info

-- 
Ian Glazer
Senior Director, Identity
+1 202 255 3166
@iglazer <https://twitter.com/iglazer>

---

From: Phil Hunt <[email-masked]>
Date: Fri, 13 Mar 2015 10:42:15 -0700

+1.  It has informed the development of the WG drafts but I am not sure it is needed as RFC.

Phil

> On Mar 13, 2015, at 09:58, Ian Glazer <[email-masked]> wrote:
> 
> I don't have a strong opinion one way or another but lean slightly towards publishing it on scimplecloud.info
> 
>> On Fri, Mar 13, 2015 at 12:36 PM, Morteza Ansari (moransar) <[email-masked]> wrote:
> @iglazer

---

From: "Kepeng Li" <[email-masked]>
Date: Sun, 15 Mar 2015 01:02:55 +0800

I believe this document has value and worth publishing as RFC.

It contains more than use cases, and also definitions, overview,
scenarios, flows, and requirements.

It can help the readers to understand the background, scenarios and use
cases, and make better use of the API/core specs.

Putting it somewhere else will decrease the value of the document.

Thanks,

Kind Regards
Kepeng

---

From: Anthony Nadalin <[email-masked]>
Date: Sun, 15 Mar 2015 00:55:06 +0000

Hmmm, the issue is that these need to stick around and be tied to the existing specifications and future specifications so folks understand the problems being solved, so I don’t support publishing on scimplecloud.info

From: scim [mailto:[email-masked]] On Behalf Of Phil Hunt
Sent: Friday, March 13, 2015 10:42 AM
To: Ian Glazer
Cc: [email-masked]; Barry Leiba; Morteza Ansari (moransar)
Subject: Re: [scim] AD review of draft-ietf-scim-use-cases-04

Phil

On Mar 13, 2015, at 09:58, Ian Glazer <[email-masked]<mailto:[email-masked]>> wrote:
I don't have a strong opinion one way or another but lean slightly towards publishing it on scimplecloud.info<http://scimplecloud.info>

On Fri, Mar 13, 2015 at 12:36 PM, Morteza Ansari (moransar) <[email-masked]<mailto:[email-masked]>> wrote:
Thanks for the review Barry.

³simplecloud.info<http://simplecloud.info>² site along with other implementation/testing/guide

Thoughts?

Cheers,
Morteza

On 3/12/15, 12:26 PM, "Barry Leiba" <[email-masked]<mailto:[email-masked]>> wrote:

>[email-masked]<mailto:[email-masked]>

_______________________________________________
scim mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/scim

--
Ian Glazer
Senior Director, Identity
+1 202 255 3166
@iglazer<https://twitter.com/iglazer>
_______________________________________________
scim mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/scim

---

From: "Morteza Ansari (moransar)" <[email-masked]>
Date: Mon, 16 Mar 2015 22:20:23 +0000

Sounds like there is WG interest in publishing this as an Informational RFC.

Document editors, can you please consider Barry’s feedback and suggest text updates to the WG?

Cheers,
Morteza

From: Anthony Nadalin <[email-masked]<mailto:[email-masked]>>
Date: Saturday, March 14, 2015 at 5:55 PM
To: Phil Hunt <[email-masked]<mailto:[email-masked]>>, Ian Glazer <[email-masked]<mailto:[email-masked]>>
Cc: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "Barry org>" <[email-masked]<mailto:[email-masked]>>, Morteza Ansari <[email-masked]<mailto:[email-masked]>>
Subject: RE: [scim] AD review of draft-ietf-scim-use-cases-04

From: scim [mailto:[email-masked]] On Behalf Of Phil Hunt
Sent: Friday, March 13, 2015 10:42 AM
To: Ian Glazer
Cc: [email-masked]<mailto:[email-masked]>; Barry Leiba; Morteza Ansari (moransar)
Subject: Re: [scim] AD review of draft-ietf-scim-use-cases-04

Phil

Thoughts?

Cheers,
Morteza

---

From: "Kepeng Li" <[email-masked]>
Date: Tue, 17 Mar 2015 14:22:31 +0800

>Document editors, can you please consider Barry’s feedback and suggest text
updates to the WG?

Yes, will do.

Thanks,

Kind Regards
Kepeng

发件人:  "Morteza Ansari (moransar)" <[email-masked]>
日期:  Tuesday, 17 March, 2015 6:20 am
至:  Anthony Nadalin <[email-masked]>, Phil Hunt
<[email-masked]>, Ian Glazer <[email-masked]>
抄送:  "[email-masked]" <[email-masked]>, Barry Leiba
<[email-masked]>
主题:  Re: [scim] AD review of draft-ietf-scim-use-cases-04

Document editors, can you please consider Barry’s feedback and suggest text
updates to the WG?

Cheers,
Morteza

From: Anthony Nadalin <[email-masked]>
Date: Saturday, March 14, 2015 at 5:55 PM
To: Phil Hunt <[email-masked]>, Ian Glazer <[email-masked]>
Cc: "[email-masked]" <[email-masked]>, "Barry org>" <[email-masked]>,
Morteza Ansari <[email-masked]>
Subject: RE: [scim] AD review of draft-ietf-scim-use-cases-04

Hmmm, the issue is that these need to stick around and be tied to the
existing specifications and future specifications so folks understand the
problems being solved, so I don’t support publishing on scimplecloud.info

+1.  It has informed the development of the WG drafts but I am not sure it
is needed as RFC.

Phil

On Mar 13, 2015, at 09:58, Ian Glazer <[email-masked]> wrote:
> publishing it on scimplecloud.info <http://scimplecloud.info>
> 
>  
> 
>> ³simplecloud.info <http://simplecloud.info> ² site along with other
>> implementation/testing/guide
_______________________________________________ scim mailing list
[email-masked] https://www.ietf.org/mailman/listinfo/scim