Subject: [scim] Kathleen Moriarty's No Objection on draft-ietf-scim-use-cases-06: (with COMMENT)

From: "Kathleen Moriarty" <[email-masked]>
Date: Wed, 22 Apr 2015 15:15:37 -0700

Kathleen Moriarty has entered the following ballot position for
draft-ietf-scim-use-cases-06: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-scim-use-cases/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Section 2.4
I agree with Stephen's question on the assumption of using LDAP.  If its'
just an example, could you say that or abstract it from LDAP or a
particular choice. 

Section 3.2
I agree with Stephen (his comment on security considerations section)
that there should be some mention of regulatory concerns when moving
identity information between jurisdictional regions (countries,
state-by-state for regulations on privacy, and universities have
additional regulations on personal information).  This also applies to
Section 3.4 (or likely all use cases) as personal information is
discussed in that use case description.  For section 3.4, you'd need to
worry about where accounts are provisioned.

Nit:
Section 2.3.4
   At the protocol level, this class of scenarios may result in the use
   of common protocol exchange patters between CSP-1 & CSP-2.
s/patters/patterns/