Subject: [scim] SCIM Soft Delete Draft

From: "Morteza Ansari (moransar)" <[email-masked]>
Date: Tue, 10 Mar 2015 00:50:12 +0000

Phil Hunt and I put together a very very very rough draft for SCIM soft delete semantics. The draft is missing a lot of details and require a lot more thinking but we wanted to put the basic concept out there for discussion at Dallas. The idea of soft delete/undelete has come up many times in various forums and I personally think it is a very important aspect of real life operationalizing SCIM.

https://datatracker.ietf.org/doc/draft-ansari-scim-soft-delete/

I would like a slot on the agenda to discuss this draft and get feedback from the WG.

Cheers,
Morteza

---

From: Leif Johansson <[email-masked]>
Date: Tue, 10 Mar 2015 11:15:25 +0100

On 03/10/2015 01:50 AM, Morteza Ansari (moransar) wrote:
> Phil Hunt and I put together a very very very rough draft for SCIM soft
> delete semantics. The draft is missing a lot of details and require a
> lot more thinking but we wanted to put the basic concept out there for
> discussion at Dallas. The idea of soft delete/undelete has come up many
> times in various forums and I personally think it is a very important
> aspect of real life operationalizing SCIM.
> 

Sounds like a plan!

---

From: Anthony Nadalin <[email-masked]>
Date: Tue, 10 Mar 2015 19:14:15 +0000

So if I delete (soft) an object and then add a new object with the same name, and then I undelete the object I deleted would the undelete fail ?

From: scim [mailto:[email-masked]] On Behalf Of Morteza Ansari (moransar)
Sent: Monday, March 9, 2015 5:50 PM
To: [email-masked]
Subject: [scim] SCIM Soft Delete Draft

Cheers,
Morteza

---

From: "Morteza Ansari (moransar)" <[email-masked]>
Date: Tue, 10 Mar 2015 19:26:52 +0000

Yes. There is a very short blurb about the fact you could provide additional attributes to resolve any potential namespace conflicts. For example if you are undeleting a user you could send a new userName as part of the modify request so you undelete the user object and resolve the conflict.

The more interesting case is the references and what to do in those cases. References should not be visible in cases of soft deleted objects, the question is how expensive is to maintain that information and add the links after the object is undeleted.

In a prototype I have done of this, I took the easy route and just deleted references and they need to be re-created. Obviously it works, but it is not the most useful solution. Then again if this is a provisioning case and essentially a slave of another IDM solution, it can easily be recreated. The real problem is preserving the ID of the user and reinstating it rather than getting a new ID.

From: Anthony Nadalin <[email-masked]<mailto:[email-masked]>>
Date: Tuesday, March 10, 2015 at 12:14 PM
To: Morteza Ansari <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: RE: SCIM Soft Delete Draft

From: scim [mailto:[email-masked]] On Behalf Of Morteza Ansari (moransar)
Sent: Monday, March 9, 2015 5:50 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [scim] SCIM Soft Delete Draft

Cheers,
Morteza

---

From: Anthony Nadalin <[email-masked]>
Date: Tue, 10 Mar 2015 21:15:27 +0000

Why no "soft create" ?

From: Morteza Ansari (moransar) [mailto:[email-masked]]
Sent: Tuesday, March 10, 2015 12:27 PM
To: Anthony Nadalin; [email-masked]
Subject: Re: SCIM Soft Delete Draft

Cheers,
Morteza

---

From: "Morteza Ansari (moransar)" <[email-masked]>
Date: Tue, 10 Mar 2015 21:17:03 +0000

Because I hadn’t thought of it and didn’t have a use case for it :)

Can you please explain?  Might be interesting.

From: Anthony Nadalin <[email-masked]<mailto:[email-masked]>>
Date: Tuesday, March 10, 2015 at 2:15 PM
To: Morteza Ansari <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: RE: SCIM Soft Delete Draft

Why no “soft create” ?

From: Morteza Ansari (moransar) [mailto:[email-masked]]
Sent: Tuesday, March 10, 2015 12:27 PM
To: Anthony Nadalin; [email-masked]<mailto:[email-masked]>
Subject: Re: SCIM Soft Delete Draft

Cheers,
Morteza

---

From: Anthony Nadalin <[email-masked]>
Date: Tue, 10 Mar 2015 21:22:55 +0000

Case is where an new employee has not started work yet, I go through the process, get registered, etc. and links to things I need and just like delete when I do the hard create everything works, up until then I get same results as soft delete

From: Morteza Ansari (moransar) [mailto:[email-masked]]
Sent: Tuesday, March 10, 2015 2:17 PM
To: Anthony Nadalin; [email-masked]
Subject: Re: SCIM Soft Delete Draft

Because I hadn't thought of it and didn't have a use case for it :)

Why no "soft create" ?

Cheers,
Morteza

---

From: Grahame Grieve <[email-masked]>
Date: Wed, 11 Mar 2015 08:30:34 +1100

This is a status active = true|false, not a soft create

Grahame

On Wed, Mar 11, 2015 at 8:22 AM, Anthony Nadalin <[email-masked]>
wrote:

>  Case is where an new employee has not started work yet, I go through the
> process, get registered, etc. and links to things I need and just like
> delete when I do the hard create everything works, up until then I get same
> results as soft delete
>
>
>
> *From:* Morteza Ansari (moransar) [mailto:[email-masked]]
> *Sent:* Tuesday, March 10, 2015 2:17 PM
>
> *To:* Anthony Nadalin; [email-masked]
> *Subject:* Re: SCIM Soft Delete Draft
>
>
>
> *From: *Anthony Nadalin <[email-masked]>
> *Date: *Tuesday, March 10, 2015 at 2:15 PM
> *To: *Morteza Ansari <[email-masked]>, "[email-masked]" <[email-masked]>
> *Subject: *RE: SCIM Soft Delete Draft
>
>
>
> Why no “soft create” ?
>
>
>
> *From:* Morteza Ansari (moransar) [mailto:[email-masked]
> <[email-masked]>]
> *Sent:* Tuesday, March 10, 2015 12:27 PM
> *To:* Anthony Nadalin; [email-masked]
> *Subject:* Re: SCIM Soft Delete Draft
>
>
>
> Yes. There is a very short blurb about the fact you could provide
> additional attributes to resolve any potential namespace conflicts. For
> example if you are undeleting a user you could send a new userName as part
> of the modify request so you undelete the user object and resolve the
> conflict.
>
>
>
> The more interesting case is the references and what to do in those cases.
> References should not be visible in cases of soft deleted objects, the
> question is how expensive is to maintain that information and add the links
> after the object is undeleted.
>
>
>
> In a prototype I have done of this, I took the easy route and just deleted
> references and they need to be re-created. Obviously it works, but it is
> not the most useful solution. Then again if this is a provisioning case and
> essentially a slave of another IDM solution, it can easily be recreated.
> The real problem is preserving the ID of the user and reinstating it rather
> than getting a new ID.
>
>
>
>
>
> *From: *Anthony Nadalin <[email-masked]>
> *Date: *Tuesday, March 10, 2015 at 12:14 PM
> *To: *Morteza Ansari <[email-masked]>, "[email-masked]" <[email-masked]>
> *Subject: *RE: SCIM Soft Delete Draft
>
>
>
> So if I delete (soft) an object and then add a new object with the same
> name, and then I undelete the object I deleted would the undelete fail ?
>
>
>
> *From:* scim [mailto:[email-masked] <[email-masked]>] *On
> Behalf Of *Morteza Ansari (moransar)
> *Sent:* Monday, March 9, 2015 5:50 PM
> *To:* [email-masked]
> *Subject:* [scim] SCIM Soft Delete Draft
>
>
>
> delete semantics. The draft is missing a lot of details and require a lot
> more thinking but we wanted to put the basic concept out there for
> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim
>
>

-- 
-----
http://www.healthintersections.com.au / [email-masked]
/ +61 411 867 065

---

From: Anthony Nadalin <[email-masked]>
Date: Tue, 10 Mar 2015 21:39:35 +0000

No, active means just that, I’m not an employee yet, thus it’s a soft create

From: [email-masked] [mailto:[email-masked]] On Behalf Of Grahame Grieve
Sent: Tuesday, March 10, 2015 2:31 PM
To: Anthony Nadalin
Cc: Morteza Ansari (moransar); [email-masked]
Subject: Re: [scim] SCIM Soft Delete Draft

Grahame

On Wed, Mar 11, 2015 at 8:22 AM, Anthony Nadalin <[email-masked]<mailto:[email-masked]>> wrote:
Case is where an new employee has not started work yet, I go through the process, get registered, etc. and links to things I need and just like delete when I do the hard create everything works, up until then I get same results as soft delete

From: Morteza Ansari (moransar) [mailto:[email-masked]<mailto:[email-masked]>]
Sent: Tuesday, March 10, 2015 2:17 PM

Why no “soft create” ?

Cheers,
Morteza

_______________________________________________
scim mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/scim

--
-----
http://www.healthintersections.com.au / [email-masked]<mailto:[email-masked]> / +61 411 867 065

---

From: "Morteza Ansari (moransar)" <[email-masked]>
Date: Tue, 10 Mar 2015 21:44:39 +0000

Not sure if these two are similar. In case of new employee provisioning, I would actually want to “reserve” the userName and that is already in the core spec. You can create users marking them disabled using the “active” attribute.

A similar use case exist for self provisioning when there is work flow associated with it. For example user self registers for a service but the account is not finalize until the user validates an email address or an admin approve the account creation. In both these cases the username needs to be reserved until the account is actually validated or rejected.

From: Anthony Nadalin <[email-masked]<mailto:[email-masked]>>
Date: Tuesday, March 10, 2015 at 2:22 PM
To: Morteza Ansari <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: RE: SCIM Soft Delete Draft

Why no “soft create” ?

Cheers,
Morteza

---

From: Bill Mills <[email-masked]>
Date: Tue, 10 Mar 2015 21:45:55 +0000 (UTC)

Also perhaps useful for reserving an identifier for later use.  I don't know if I would go farther than that because you have top make sure that downstream systems don't automatically act based on the presence of the record.

     On Tuesday, March 10, 2015 2:40 PM, Anthony Nadalin <[email-masked]> wrote:

 #yiv4426703768 #yiv4426703768 -- _filtered #yiv4426703768 {panose-1:2 4 5 3 5 4 6 3 2 4;} _filtered #yiv4426703768 {font-family:Calibri;panose-1:2 15 5 2 2 2 4 3 2 4;}#yiv4426703768 #yiv4426703768 p.yiv4426703768MsoNormal, #yiv4426703768 li.yiv4426703768MsoNormal, #yiv4426703768 div.yiv4426703768MsoNormal {margin:0in;margin-bottom:.0001pt;font-size:12.0pt;}#yiv4426703768 a:link, #yiv4426703768 span.yiv4426703768MsoHyperlink {color:blue;text-decoration:underline;}#yiv4426703768 a:visited, #yiv4426703768 span.yiv4426703768MsoHyperlinkFollowed {color:purple;text-decoration:underline;}#yiv4426703768 p {margin-right:0in;margin-left:0in;font-size:12.0pt;}#yiv4426703768 span.yiv4426703768EmailStyle18 {color:#1F497D;}#yiv4426703768 .yiv4426703768MsoChpDefault {} _filtered #yiv4426703768 {margin:1.0in 1.0in 1.0in 1.0in;}#yiv4426703768 div.yiv4426703768WordSection1 {}#yiv4426703768 No, active means just that, I’m not an employee yet, thus it’s a soft create    From: [email-masked] [mailto:[email-masked]]On Behalf Of Grahame Grieve
Sent: Tuesday, March 10, 2015 2:31 PM
To: Anthony Nadalin
Cc: Morteza Ansari (moransar); [email-masked]
Subject: Re: [scim] SCIM Soft Delete Draft    This is a status active = true|false, not a soft create     Grahame       On Wed, Mar 11, 2015 at 8:22 AM, Anthony Nadalin <[email-masked]> wrote: 
Case is where an new employee has not started work yet, I go through the process, get registered, etc. and links to things I need and just like delete when I do the hard create everything works, up until then I get same results as soft delete   From: Morteza Ansari (moransar) [mailto:[email-masked]]
Sent: Tuesday, March 10, 2015 2:17 PM 
To: Anthony Nadalin; [email-masked]
Subject: Re: SCIM Soft Delete Draft   Because I hadn’t thought of it and didn’t have a use case for it :)   Can you please explain?  Might be interesting.   From:Anthony Nadalin <[email-masked]>
Date: Tuesday, March 10, 2015 at 2:15 PM
To: Morteza Ansari <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: RE: SCIM Soft Delete Draft   Why no “soft create” ?   From: Morteza Ansari (moransar) [mailto:[email-masked]]
Sent: Tuesday, March 10, 2015 12:27 PM
To: Anthony Nadalin; [email-masked]
Subject: Re: SCIM Soft Delete Draft   Yes. There is a very short blurb about the fact you could provide additional attributes to resolve any potential namespace conflicts. For example if you are undeleting a user you could send a new userName as part of the modify request so you undelete the user object and resolve the conflict.   The more interesting case is the references and what to do in those cases. References should not be visible in cases of soft deleted objects, the question is how expensive is to maintain that information and add the links after the object is undeleted.   In a prototype I have done of this, I took the easy route and just deleted references and they need to be re-created. Obviously it works, but it is not the most useful solution. Then again if this is a provisioning case and essentially a slave of another IDM solution, it can easily be recreated. The real problem is preserving the ID of the user and reinstating it rather than getting a new ID.     From:Anthony Nadalin <[email-masked]>
Date: Tuesday, March 10, 2015 at 12:14 PM
To: Morteza Ansari <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: RE: SCIM Soft Delete Draft   So if I delete (soft) an object and then add a new object with the same name, and then I undelete the object I deleted would the undelete fail ?   From: scim [mailto:[email-masked]]On Behalf Of Morteza Ansari (moransar)
Sent: Monday, March 9, 2015 5:50 PM
To: [email-masked]
Subject: [scim] SCIM Soft Delete Draft   Phil Hunt and I put together a very very very rough draft for SCIM soft delete semantics. The draft is missing a lot of details and require a lot more thinking but we wanted to put the basic concept out there for discussion at Dallas. The idea of soft delete/undelete has come up many times in various forums and I personally think it is a very important aspect of real life operationalizing SCIM.   https://datatracker.ietf.org/doc/draft-ansari-scim-soft-delete/   I would like a slot on the agenda to discuss this draft and get feedback from the WG.     Cheers, Morteza 
_______________________________________________
scim mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/scim 

    --  -----
http://www.healthintersections.com.au /[email-masked] / +61 411 867 065 
_______________________________________________
scim mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/scim

---

From: Phil Hunt <[email-masked]>
Date: Tue, 10 Mar 2015 14:55:53 -0700

Wasn't the original perspective an issue of tombstoning?

I do think this would be a great opportunity to discuss the relationship to activation and deactivation. 

Phil

> On Mar 10, 2015, at 14:17, Morteza Ansari (moransar) <[email-masked]> wrote:
> 
> From: Anthony Nadalin <[email-masked]>
> From: Anthony Nadalin <[email-masked]>

---

From: Anthony Nadalin <[email-masked]>
Date: Tue, 10 Mar 2015 22:28:39 +0000

Yes, seems so

From: Phil Hunt [mailto:[email-masked]]
Sent: Tuesday, March 10, 2015 2:56 PM
To: Morteza Ansari (moransar)
Cc: Anthony Nadalin; [email-masked]
Subject: Re: [scim] SCIM Soft Delete Draft

Phil

On Mar 10, 2015, at 14:17, Morteza Ansari (moransar) <[email-masked]<mailto:[email-masked]>> wrote:
Because I hadn’t thought of it and didn’t have a use case for it :)

Why no “soft create” ?

Cheers,
Morteza

---

From: Haavar Valeur <[email-masked]>
Date: Tue, 24 Mar 2015 22:05:57 +0000

I have a couple of comments.

In section 2.3 (SCIM create) it says that “SCIM Create SHOULD NOT ignore namespace conflicts…”, but in the example is says that a create with a softy deleted conflicting user should not fail. Those two statements seems conflicting to me.

In section 2.9 (SCIM hard delete), it says the way to do a hard delete is to include a query parameter isSoftDeleted=true. That’s not very intuitive to me. I understand that’s the parameter name used in all the filters, but perhaps not a name suited for indicating a hard delete.

On Mar 10, 2015, at 5:28 PM, Anthony Nadalin <[email-masked]<mailto:[email-masked]>> wrote:

Yes, seems so

Cc: Anthony Nadalin; [email-masked]<mailto:[email-masked]>

Phil

Why no “soft create” ?

Cheers,
Morteza
_______________________________________________
scim mailing list
[email-masked]<mailto:[email-masked]>
https://secure-web.cisco.com/1ja_WP8_rfvIfsS4W2kAsnt2dwcyyWNR-Jln2QDFyIZ725khBrQpmI2BQRozdpHtp6LN3tW13x2GzID0QDJZTfZ2E-UK6OPcOPs8my7VOR6jGKoRT2r2X3DScPAGwtFuX_gcVeKJZ9dq0gdIzRgLb_0IEdttNdjDQjxN5fnKPfLI/https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fscim
_______________________________________________
scim mailing list
[email-masked]<mailto:[email-masked]>
https://secure-web.cisco.com/1ja_WP8_rfvIfsS4W2kAsnt2dwcyyWNR-Jln2QDFyIZ725khBrQpmI2BQRozdpHtp6LN3tW13x2GzID0QDJZTfZ2E-UK6OPcOPs8my7VOR6jGKoRT2r2X3DScPAGwtFuX_gcVeKJZ9dq0gdIzRgLb_0IEdttNdjDQjxN5fnKPfLI/https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fscim

---

From: "Morteza Ansari (moransar)" <[email-masked]>
Date: Wed, 25 Mar 2015 16:54:26 +0000

Thanks for the feedback.

The wording obviously need a lot of improving. The idea is that soft deleted objects don’t cause a conflict in namespace. So if “user1” is signed up for a service, and then user1 is soft deleted, another user1 can be created and if the admin attempts to undelete the soft deleted user1, then there is a conflict and user1 need to be renamed to an unused one.

And yes, I agree the naming for the filter is not the most intuitive one but the question is which is worse, not being consistent with the rest of the filters or make this one more readable? We can definitely go either route.

Cheers,
Morteza

From: Haavar Valeur <[email-masked]<mailto:[email-masked]>>
Date: Tuesday, March 24, 2015 at 5:05 PM
To: Anthony Nadalin <[email-masked]<mailto:[email-masked]>>
Cc: Phil Hunt <[email-masked]<mailto:[email-masked]>>, Morteza Ansari <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [scim] SCIM Soft Delete Draft

Yes, seems so

Phil

Why no “soft create” ?

Cheers,
Morteza