Subject: [scim] Clarification on authentication related status codes

From: Phil Hunt <[email-masked]>
Date: Tue, 5 May 2015 10:26:43 -0700

During the IESG review process regarding authentication, I have been asked to make some changes to the authentication section (the text of which is to to be posted in another email). 

While reviewing this, I (and a couple others) noticed that we may have documented the HTTP status codes somewhat incorrectly.  Particularly HTTP Status code 403.

I propose to correct section 3.12 as follows:

CURRENT TEXT:
> | 401          | GET, POST,    | Authorization failure              |
> | UNAUTHORIZED | PUT, PATCH,   |                                    |
> |              | DELETE        |                                    |
> | 403          | GET, POST,    | Server does not support requested  |
> | FORBIDDEN    | PUT, PATCH,   | operation                          |

NEW TEXT:
| 401          | GET, POST,    | Authorization failure. The author- |
| UNAUTHORIZED | PUT, PATCH,   | ization header is invalid/missing  |
|              | DELETE        |                                    |
| 403          | GET, POST,    | Operation not permitted based on   |
| FORBIDDEN    | PUT, PATCH,   | the supplied authorization.        |

Note that anyone using 403 to indicate an unimplemented SCIM method should be returning the 501 NOT IMPLEMENTED status.

Phil

@independentid
www.independentid.com
[email-masked]

---

From: Craig McClanahan <[email-masked]>
Date: Tue, 5 May 2015 21:16:28 -0700

Returning 501 for not-implemented functions makes total sense to me.

Craig McClanahan

On Tue, May 5, 2015 at 10:26 AM, Phil Hunt <[email-masked]> wrote:

> During the IESG review process regarding authentication, I have been asked
> to make some changes to the authentication section (the text of which is to
> to be posted in another email).
>
> While reviewing this, I (and a couple others) noticed that we may have
> documented the HTTP status codes somewhat incorrectly.  Particularly HTTP
> Status code 403.
>
> Note that anyone using 403 to indicate an unimplemented SCIM method should
> be returning the 501 NOT IMPLEMENTED status.
>
> Phil
>
> @independentid
> www.independentid.com
> [email-masked]
>
>
> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim
>
>