Subject: [scim] Changes regarding error in 7.5.2

From: Phil Hunt <[email-masked]>
Date: Fri, 8 May 2015 23:06:42 -0700

It was pointed out that the error response shown in section 7.5.2 is inconsistent with the other SCIM error response and the schema. 

The section 7.5.2 error is a forbidden response that is returned when the client attempts to use a GET filter parameter that contains sensitive information (that should not be processed).

I propose to correct the error response and the error type to conform to the other “scimType” errors as follows:

Adding the sensitive error to the scimType table:

   | sensitive    | The specified request cannot | GET (Section        |
   |              | be completed due to passing  | 3.4.2).             |
   |              | of sensitive (e.g.,          |                     |
   |              | personal) information in a   |                     |
   |              | request URI. For example,    |                     |
   |              | personal information SHALL   |                     |
   |              | NOT be transmitted over      |                     |
   |              | request URIs. See Section    |                     |
   |              | 7.5.2.                       |                     |
   +--------------+------------------------------+---------------------+

And sec 7.5.2 (basically only the example JSON is changed and the error type)...
7.5.2.  Disclosure of Sensitive Information in URIs

   As mentioned in Section 9.4 [RFC7231], SCIM clients requesting
   information using query filters using HTTP GET SHOULD give
   consideration to the information content of the filters and whether
   their exposure in a URI would represent a breach of security or
   confidentiality through leakage in a web browsers or server logs.
   This is particularly true for information that is legally considered
   "personally identifiable information" or is otherwise restricted by
   privacy laws.  In these situations to ensure maximum security and
   confidentiality, clients SHOULD query using HTTP POST (see
   Section 3.4.3 ).

   Servers that receive HTTP GET requests using filters that contain
   sensitive or confidential personal information SHOULD respond with
   HTTP status 403 indicating the operation is FORBIDDEN.  A "scimType"
   error of "sensitive" may be returned indicating the request must be
   submitted using POST.  A non-normative example:

  HTTP/1.1 403 FORBIDDEN

  {
    "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"],
    "detail":
          "Query filter involving 'name' is restricted or confidential",
    "scimType": "sensitive",
    "status": "404"
  }

Phil

@independentid
www.independentid.com
[email-masked]