Subject: [scim] Stephen Farrell's No Objection on draft-ietf-scim-use-cases-06: (with COMMENT)

From: "Stephen Farrell" <[email-masked]>
Date: Wed, 22 Apr 2015 08:44:06 -0700

Stephen Farrell has entered the following ballot position for
draft-ietf-scim-use-cases-06: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-scim-use-cases/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

- 2.1: "make ... easier" seems understated, presumably we
care about interop, security, scaling etc. and it'd actually
have been easier (in a sense) to just have everyone follow
one vendor or open-source thing.

- 2.1, "It's intent" - the It's is a little ambiguous.

- 2.2.1, last bullet: I don't get that. Are real-time things
even in charter I wonder? (CHECK)

- 2.2.2, Better to use example.com, example.net than
FooBar.Inc etc unless there is a reason that the usual
examples do not work.
 
- 2.4, what is the impact for SCIM generally of "assuming"
use of LDAP here? If that's just an example, that's fine (but
it could be clarified), if it's more than that, then it'd be
good to know what exactly is meant.

- 3.1, file permissions seem to me to be out of scope of
SCIM. Changing UIDs, UUIDs, or similar is in scope though but
this section doesn't make that clear. (Put another way: I am
correct that SCIM is not NFS, right?  :-)

- 3.3, as per my comment on 3.1, this is unclear as to what
is in or out of scope of SCIM.

- 3.5 you say "selected attributes" a number of times.  Don't
you need to say by whom and when?

- 4: it'd be good if this explicitly called out that there
can be privacy issues here that go beyond transport security,
e.g. moving PII offshore between CSPs. I don't think you need
say more than that, but it'd be worth doing I think.