Subject: Re: [scim] SCIM Notify Draft

From: Haavar Valeur <[email-masked]>
Date: Wed, 27 May 2015 22:58:18 +0000

Hi Phil.
I’d be interested in working on this. I have a few uses cases where I might be able to apply SCIM notifications.

One comment I would like to make off the bat is that we should consider divorcing the transport and message format. I think the barrier of entry of adopting the message format, while using existing transports in the infrastructure, is relatively low. There is value in switching the underlaying transport, but it should not be a strict requirement.

Best
Haavar

On Mar 8, 2015, at 4:32 PM, Phil Hunt <[email-masked]<mailto:[email-masked]>> wrote:

On behalf of Ian Glazer, Morteza Ansari, and myself, I have submitted an individual draft contribution for comments and consideration. The draft is available here:
https://tools.ietf.org/html/draft-hunt-scim-notify-00

The draft follows up from the presentation made at IETF91 in Honolulu and defines SCIM events and messages used to notify subscribers of events from a publishing service provider via a distribution service known as a notification hub.  The hub should have the capability to deliver event messages securely via simple HTTP POST, WebPUSH, and other messaging protocols where useful.

I would like to request that we add this as a discussion item for the Dallas agenda.

At the meeting I propose we discuss:

1.  What are the intended benefits and uses for Notify in SCIM environments
2.  What are the scalability, information, and technical problems being addressed
3.  What is left to define
and finally,
4.  Is there enough interest in the working group to add Notify to the SCIM charter.

Phil

@independentid
www.independentid.com<http://www.independentid.com>
[email-masked]<mailto:[email-masked]>

_______________________________________________
scim mailing list
[email-masked]<mailto:[email-masked]>
https://secure-web.cisco.com/1W2BR0G3Ll9pscXlZRUoLXePQdZUdNOMomA_UD4UaIYyKRBkEywJJhX2smiG5hBBMnNjUhzYUwfNTH6pObe-E84hD35qsgShWVqRbTMw8mKGe4s_dK0USAp6_-9ovqvk0nlQtdnmvGtgWWrEL96C1r9pgyj-QD5l-sCESPmA9MzI/https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fscim

---

From: Phil Hunt <[email-masked]>
Date: Wed, 27 May 2015 16:12:27 -0700

Thanks for the feed back. 

I agree we should narrow down where possible. 

Would like to see a single publish method but I can see need for multiple delivery methods. 

Scale and diversity are issues. Eg major cloud sp to major cloud sp is different from secure mobile events. 

There was a lot of pressure to consider web push too. I don't see the specific case for it. It kinda fits as a persistent search mechanism. 

I agree we need to focus the draft to move it forward. 

Phil

> On May 27, 2015, at 15:58, Haavar Valeur <[email-masked]> wrote:
> 
> Hi Phil.
>> On Mar 8, 2015, at 4:32 PM, Phil Hunt <[email-masked]> wrote:
>> 
>> www.independentid.com
>> [email-masked]
>> [email-masked]
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim

---

From: Anthony Nadalin <[email-masked]>
Date: Thu, 28 May 2015 21:47:05 +0000

Not mentioned in the draft but did you intend to allow for error condition notification ?

From: scim [mailto:[email-masked]] On Behalf Of Phil Hunt
Sent: Wednesday, May 27, 2015 4:12 PM
To: Haavar Valeur
Cc: SCIM WG
Subject: Re: [scim] SCIM Notify Draft

Phil

On May 27, 2015, at 15:58, Haavar Valeur <[email-masked]<mailto:[email-masked]>> wrote:
Hi Phil.
I’d be interested in working on this. I have a few uses cases where I might be able to apply SCIM notifications.

Best
Haavar

Phil

@independentid

---

From: Phil Hunt <[email-masked]>
Date: Thu, 28 May 2015 15:11:17 -0700

Tony,

Good question.

Well, the idea of publishing “events” rather than commands is to avoid errors being an issue.

Consider the following cases:

1. A client that fails to make an update (it is rejected) at a publishing service provider. In this case it is a non-event since service provider state did not change.

2. An error that is an account condition (can be defined by a filter): If the resource has certain state (e.g. account is disabled due to login failures) then it just becomes a resource modification event does it not?

3. Publisher / Subscriber State Inconsistency:  The publisher is simply telling the client what happened at the publisher. It is up to the client to decide what it wants to do. If the client deems it an error, it has to decide its own recovery or mapping.

E.g.   User Anne gets added to CRM_Users.

An event goes to the CRM SaaS service indicating Anne is a member of CRM_Users.  The SaaS service provider receiving the event realizes it has no account for “Anne”. It has to first go get Anne from the publisher (SCIM GET) to create the account and then provision Ann for CRM SaaS

Or… were you thinking of something else?

Phil

@independentid
www.independentid.com
[email-masked]

> On May 28, 2015, at 2:47 PM, Anthony Nadalin <[email-masked]> wrote:
> 
>   <>
> On May 27, 2015, at 15:58, Haavar Valeur <[email-masked] <mailto:[email-masked]>> wrote:
> 
> Hi Phil.
> On Mar 8, 2015, at 4:32 PM, Phil Hunt <[email-masked] <mailto:[email-masked]>> wrote:
>  
> https://tools.ietf.org/html/draft-hunt-scim-notify-00 <https://tools.ietf.org/html/draft-hunt-scim-notify-00>
>  
> www.independentid.com <http://www.independentid.com/>
> [email-masked] <mailto:[email-masked]>
>  
> [email-masked] <mailto:[email-masked]>
> https://secure-web.cisco.com/1W2BR0G3Ll9pscXlZRUoLXePQdZUdNOMomA_UD4UaIYyKRBkEywJJhX2smiG5hBBMnNjUhzYUwfNTH6pObe-E84hD35qsgShWVqRbTMw8mKGe4s_dK0USAp6_-9ovqvk0nlQtdnmvGtgWWrEL96C1r9pgyj-QD5l-sCESPmA9MzI/https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fscim <https://secure-web.cisco.com/1W2BR0G3Ll9pscXlZRUoLXePQdZUdNOMomA_UD4UaIYyKRBkEywJJhX2smiG5hBBMnNjUhzYUwfNTH6pObe-E84hD35qsgShWVqRbTMw8mKGe4s_dK0USAp6_-9ovqvk0nlQtdnmvGtgWWrEL96C1r9pgyj-QD5l-sCESPmA9MzI/https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fscim>
>  
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/scim <https://www.ietf.org/mailman/listinfo/scim>

---

From: "Morteza Ansari (moransar)" <[email-masked]>
Date: Thu, 28 May 2015 22:27:15 +0000

Interesting question. I never thought of that. Do you have any specific use case(s) in mind?

Cheers,
Morteza

From: Anthony Nadalin <[email-masked]<mailto:[email-masked]>>
Date: Thursday, May 28, 2015 at 2:47 PM
To: Phil Hunt <[email-masked]<mailto:[email-masked]>>, Haavar Valeur <[email-masked]<mailto:[email-masked]>>
Cc: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [scim] SCIM Notify Draft

Phil

Best
Haavar

Phil

@independentid

---

From: Anthony Nadalin <[email-masked]>
Date: Thu, 28 May 2015 22:41:04 +0000

Not all these operations have to/can be be atomic so was thinking about the case where it was not atomic but wanted the listeners to know that a CREATE was in progress (to reserve that entry), but this might fail later

From: Morteza Ansari (moransar) [mailto:[email-masked]]
Sent: Thursday, May 28, 2015 3:27 PM
To: Anthony Nadalin; Phil Hunt; Haavar Valeur
Cc: SCIM WG
Subject: Re: [scim] SCIM Notify Draft

Cheers,
Morteza

Phil

On May 27, 2015, at 15:58, Haavar Valeur <[email-masked]<mailto:[email-masked]>> wrot
Hi Phil.
I'd be interested in working on this. I have a few uses cases where I might be able to apply SCIM notifications.

Best
Haavar

Phil

@independentid

---

From: Phil Hunt <[email-masked]>
Date: Thu, 28 May 2015 15:48:15 -0700

Not sure if this matters if the event isn't published until commit. 

Eg a bulk request that must roll back all items is not committed so it is a non event. 

Maybe this is a higher level workflow error that is not atomic?  Eg an initial account is created but never verified. 

Phil

> On May 28, 2015, at 15:41, Anthony Nadalin <[email-masked]> wrote:
> 
> From: Anthony Nadalin <[email-masked]>
> To: Phil Hunt <[email-masked]>, Haavar Valeur <[email-masked]>
> Cc: "[email-masked]" <[email-masked]>
> On May 27, 2015, at 15:58, Haavar Valeur <[email-masked]> wrot
> 
> Hi Phil.