Subject: [scim] How to handle multi-valued attribute elements with none sub-attributes set

From: David Crome <[email-masked]>
Date: Mon, 18 May 2015 17:16:18 +0200

Hello,

If I create a user with an multi-valued attribute e.g. an address and none
sub-attributes are set:

"addresses": [
    {

    }
]

Should the Service Provider ignore means truncated the multi-value
attribute or not accepting the user? I don't think the specification makes
this clear.
What is the definition of an empty multi-valued attribute element? The
specification don't mentioned anything about if a multi-valued attribute
element is empty and how the Service Provider should handle this.
Same for the complex attribute 'name' [1]. If the complex attribute 'name'
has no sub-attributes set, what should the Service Provider do with the
empty attribute?

I think a complex attribute or multi-valued attribute element is empty when
none sub-attribute is set, like the example above. The Service Provider
should ignore the empty attribute.

And if I create a user with an multi-valued attribute e.g. an address with
only the 'primary' sub-attribute set:

"addresses": [
    {
      "primary": true
    }
]

Should this be accepted? SCIM spec says that all sub-attributes of a
multi-valued attribute element (in this case the address) are optional [2].
I think it doesn't makes sense to accept a multi-valued attribute element
if only the meta sub-attribute 'primary' is set.

I think in this case the user should not be accepted because the attribute
is not complete.

Another one: In case of the multi-valued attribute 'emails' the
sub-attribute 'value'  "...SHOULD be specified according to [RFC5321]". But
what if the 'value' attribute is missing? Same for the other multi-valued
attributes with the possibility to validate the 'value' sub-attribute.

What do you think?

Greetz,
David

[1] https://tools.ietf.org/html/draft-ietf-scim-core-schema-20#section-2.3.8
[2] https://tools.ietf.org/html/draft-ietf-scim-core-schema-20#section-4.1.2

-- 
David Crome
Softwareentwicklung
tarent solutions GmbH

Telefon +49 (0) 30 138803-132
Telefax +49 (0) 30 56829495
[email-masked]

tarent solutions GmbH Niederlassung Berlin
Voltastraße 5, D-13355 Berlin • http://www.tarent.de/
Tel: +49 30 138803-0 • Fax: +49 30 56829495

Rochusstraße 2-4, D-53123 Bonn • http://www.tarent.de/
Tel: +49 228 54881-0 • Fax: +49 228 54881-235
HRB AG Bonn 5168 • USt-ID (VAT): DE122264941
Geschäftsführer:
Dr. Stefan Barth, Kai Ebenrett, Boris Esser, Alexander Steeg

---

From: Phil Hunt <[email-masked]>
Date: Mon, 18 May 2015 09:50:03 -0700

David,

The service provider some flexibility on what it can choose to do. The only stipulation is:

The spec says that a client asserting null or empty intends that the attribute be cleared (e.g. no default).

The request must be valid JSON.

One way that this scenario can be improved, is through configured schema using attribute “required” characteristic on parent attribute vs sub-attributes.  You can leave “addresses” as not required, while making sub-attributes of a complex attribute required.  This way, if an address is specified, certain sub-attributes must be present.

After that the service provider can do what makes sense in the context of the environment or application it is provisioning to. If it makes sense to accept partial addresses / or ignore them, thats ok.  Whatever the service provider decides to do, it should return the “accepted” state back to the client in the response to the request.  

Phil

@independentid
www.independentid.com
[email-masked]

> On May 18, 2015, at 8:16 AM, David Crome <[email-masked]> wrote:
> 
> Hello,
> 
> If I create a user with an multi-valued attribute e.g. an address and none sub-attributes are set:
> 
> "addresses": [
>     {
> 
>     }
> ]
> 
> Should the Service Provider ignore means truncated the multi-value attribute or not accepting the user? I don't think the specification makes this clear.
> What is the definition of an empty multi-valued attribute element? The specification don't mentioned anything about if a multi-valued attribute element is empty and how the Service Provider should handle this.
> Same for the complex attribute 'name' [1]. If the complex attribute 'name' has no sub-attributes set, what should the Service Provider do with the empty attribute? 
> 
> I think a complex attribute or multi-valued attribute element is empty when none sub-attribute is set, like the example above. The Service Provider should ignore the empty attribute.
> 
> And if I create a user with an multi-valued attribute e.g. an address with only the 'primary' sub-attribute set:
> 
> "addresses": [
>     {
>       "primary": true
>     }
> ]
> 
> Should this be accepted? SCIM spec says that all sub-attributes of a multi-valued attribute element (in this case the address) are optional [2].
> I think it doesn't makes sense to accept a multi-valued attribute element if only the meta sub-attribute 'primary' is set.
> 
> I think in this case the user should not be accepted because the attribute is not complete.
> 
> Another one: In case of the multi-valued attribute 'emails' the sub-attribute 'value'  "...SHOULD be specified according to [RFC5321]". But what if the 'value' attribute is missing? Same for the other multi-valued attributes with the possibility to validate the 'value' sub-attribute.
> 
> What do you think?
> 
> Greetz,
> David
> 
> [1] https://tools.ietf.org/html/draft-ietf-scim-core-schema-20#section-2.3.8 <https://tools.ietf.org/html/draft-ietf-scim-core-schema-20#section-2.3.8>
> [2] https://tools.ietf.org/html/draft-ietf-scim-core-schema-20#section-4.1.2 <https://tools.ietf.org/html/draft-ietf-scim-core-schema-20#section-4.1.2>
> 
> -- 
> David Crome
> Softwareentwicklung
> tarent solutions GmbH
> 
> [email-masked] <mailto:[email-masked]>
> 
> Voltastraße 5, D-13355 Berlin • http://www.tarent.de/ <http://www.tarent.de/>
> Rochusstraße 2-4, D-53123 Bonn • http://www.tarent.de/ <http://www.tarent.de/>
> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim