Subject: Re: [scim] Stephen Farrell's No Objection on draft-ietf-scim-use-cases-06: (with COMMENT)

From: "Kepeng Li" <[email-masked]>
Date: Sun, 03 May 2015 00:12:14 +0800

Hi Stephen,

Thanks for your review and comments.

Please find my proposed changes below.

Thanks,

Kind Regards
Kepeng

在 22/4/15 11:44 pm， "Stephen Farrell" <[email-masked]> 写入:

>Stephen Farrell has entered the following ballot position for
>draft-ietf-scim-use-cases-06: No Objection
>
>When responding, please keep the subject line intact and reply to all
>email addresses included in the To and CC lines. (Feel free to cut this
>introductory paragraph, however.)
>
>Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
>for more information about IESG DISCUSS and COMMENT positions.
>
>
>The document, along with other ballot positions, can be found here:
>http://datatracker.ietf.org/doc/draft-ietf-scim-use-cases/
>
>----------------------------------------------------------------------
>COMMENT:
>----------------------------------------------------------------------
>
>
>- 2.1: "make ... easier" seems understated, presumably we
>care about interop, security, scaling etc. and it'd actually
>have been easier (in a sense) to just have everyone follow
>one vendor or open-source thing.

Changed it to this:

The System for Cross-domain Identity Management (SCIM) specification is
designed to manage user identity
		in cloud based applications and services in a standardized way to enable
interoperability, security and scalability.

>
>- 2.1, "It's intent" - the It's is a little ambiguous.

Changed it to this:

The intent of SCIM specification ...

>
>- 2.2.1, last bullet: I don't get that. Are real-time things
>even in charter I wonder? (CHECK)

I removed “real-time” in this paragraph.

>
>- 2.2.2, Better to use example.com, example.net than
>FooBar.Inc etc unless there is a reason that the usual
>examples do not work.

I changed “FooBar.Inc” to “Example.com”.

> 
>- 2.4, what is the impact for SCIM generally of "assuming"
>use of LDAP here? If that's just an example, that's fine (but
>it could be clarified), if it's more than that, then it'd be
>good to know what exactly is meant.

The main idea is, ECS and CSP can provide service for CSU.
We need something between ECS and CSP.

I changed “LDAP service” to “information access service”.

>
>- 3.1, file permissions seem to me to be out of scope of
>SCIM. Changing UIDs, UUIDs, or similar is in scope though but
>this section doesn't make that clear. (Put another way: I am
>correct that SCIM is not NFS, right?  :-)

Right, SCIM is not NFS. I removed this section.

>
>- 3.3, as per my comment on 3.1, this is unclear as to what
>is in or out of scope of SCIM.

"SSO" (Single-Sign On) use case is designed to capture a class of use case
that
 makes sense to the actor requesting it rather than to describe a
			protocol operation.

2.3.4, 2.3.5 and 2.4.5 described that SSO can work as a trigger for the
SCIM operations. The actual SSO processing is out of scope but as a
trigger,
I think it is fine to be listed as a use case.

>
>- 3.5 you say "selected attributes" a number of times.  Don't
>you need to say by whom and when?

I added one sentence to say, web site B requires attributes from the user,
And user selects some attributes.

>
>- 4: it'd be good if this explicitly called out that there
>can be privacy issues here that go beyond transport security,
>e.g. moving PII offshore between CSPs. I don't think you need
>say more than that, but it'd be worth doing I think.

I added the following sentence:

There can be privacy issues that go beyond transport security,
   e.g. moving PII offshore between CSPs.
   Regulatory requirements shall be met when migrating
   identity information between jurisdictional regions (countries,
   state-by-state for regulations on privacy.

---

From: "Kepeng Li" <[email-masked]>
Date: Sun, 03 May 2015 00:23:42 +0800

Hi Stephen,

Thanks,

Kind Regards
Kepeng

Changed it to this:

Changed it to this: