Subject: [scim] Question on the use of attributes from schema extensions

From: Keith Hazelton <[email-masked]>
Date: Tue, 11 Aug 2015 16:28:16 +0000

Prior to draft-ietf-scim-core-schema-10, this language was found in Section 3: “Except for the base object schema, the schema extension URI SHALL be used as a JSON container to distinguish attributes belonging to the extension namespace from base schema attributes.”

In later drafts, e.g. draft-ietf-scim-core-schema-22, the corresponding language is: "Unlike core attributes, extended attributes are kept in their own sub-attribute namespace identified by the schema extension URI."

Is it the intent of the current language that in the JSON representations of a resource it is permissible to interleave namespace-qualified attributes from schema extensions with attributes from the core schema? E.g., is something like this allowed:

{
  "schemas":
    [ "urn:ietf:params:scim:schemas:core:2.0:User",
      "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"],
  "id": "2819c223-7f76-453a-919d-413861904646",
  "externalId": "701984",
  "userName": "[email-masked]",
  "name": {
    "formatted": "Ms. Barbara J Jensen III",
    "familyName": "Jensen",
    "givenName": "Barbara",
    "middleName": "Jane",
    "honorificPrefix": "Ms.",
    "honorificSuffix": "III"
  },
  "displayName": "Babs Jensen",
  "nickName": "Babs",

  "enterprise:2.0:User:employeeNumber": "701984",
  "enterprise:2.0:User:costCenter": "4130",
  "enterprise:2.0:User:organization": "Universal Studios",
  "enterprise:2.0:User:division": "Theme Park",
  "enterprise:2.0:User:department": "Tour Operations",
  "enterprise:2.0:User:manager": {
      "value": "26118915-6090-4610-87e4-49d8ca9f808d",
      "$ref": "../Users/26118915-6090-4610-87e4-49d8ca9f808d",
      "displayName": "John Smith"
    }
...
}

Such a layout would make it easier to visually scan such a resource, thus encouraging the freer use of schema extensions where appropriate.

      Regards,  --Keith Hazelton
--
email & jabber: [email-masked]<mailto:[email-masked]>
calendar: http://go.wisc.edu/i6zxx0

---

From: Kelly Grizzle <[email-masked]>
Date: Tue, 11 Aug 2015 16:48:10 +0000

Hi Keith … given the language “namespace identified by the schema extension URI”, I believe that the spec is indicating that the sub-attribute must be named using the schema extension URI.  By adding the attribute name to the end of the URI, your example is not following that pattern.

From: scim [mailto:[email-masked]] On Behalf Of Keith Hazelton
Sent: Tuesday, August 11, 2015 11:28 AM
To: SCIM WG
Subject: [scim] Question on the use of attributes from schema extensions

{
  "schemas":
  "userName": "[email-masked]<mailto:[email-masked]>",

---

From: Keith Hazelton <[email-masked]>
Date: Tue, 11 Aug 2015 17:07:19 +0000

Kelly,

Thanks for your quick response.

So does 'the sub-attribute must be named using the schema extension URI” mean that all the enterprise user attributes have to appear together in a uri-container as indicated in draft-22, Figure 5: Example Enterprise User JSON Representation:

…

 "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User": {
    "employeeNumber": "701984",
    "costCenter": "4130",
    "organization": "Universal Studios",
    "division": "Theme Park",
    "department": "Tour Operations",
    "manager": {
      "value": "26118915-6090-4610-87e4-49d8ca9f808d",
      "$ref": "../Users/26118915-6090-4610-87e4-49d8ca9f808d",
      "displayName": "John Smith"
    }
  },

…

Or could the extended attributes be interleaved with the User schema attributes by putting each one in that form, e.g.,

…

"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User": {"employeeNumber": "701984",},

…

From: Kelly Grizzle
Date: Tuesday, August 11, 2015 at 11:48
To: Keith Hazelton, SCIM WG
Subject: RE: Question on the use of attributes from schema extensions

named using th

---

From: Kelly Grizzle <[email-masked]>
Date: Tue, 11 Aug 2015 17:14:23 +0000

Hmmm … I don’t think the docs are quite so clear on that one.  In JSON, ordering does not matter, so it doesn’t matter if it is interleaved with other attributes or not.  However, JSON also does not allow multiple keys with the same name.  In other words, this will not work:

"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User": {"employeeNumber": "701984" },

"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User": {"department": "Tour Operations" },

...

From: scim [mailto:[email-masked]] On Behalf Of Keith Hazelton
Sent: Tuesday, August 11, 2015 12:07 PM
To: SCIM WG
Subject: Re: [scim] Question on the use of attributes from schema extensions

Kelly,

…

    "costCenter": "4130",

    "manager": {

    }

  },

…

…

…

From: Kelly Grizzle

named using th

---

From: Keith Hazelton <[email-masked]>
Date: Tue, 11 Aug 2015 17:38:31 +0000

Kelly,

OK, I get that.  So SCIM doesn’t have the notion of namespace prefixes for attributes. Perhaps in version 3. ;-)

Thanks again for your quick and clear responses.

       —Keith

From: Kelly Grizzle
Date: Tuesday, August 11, 2015 at 12:14
To: Keith Hazelton, SCIM WG
Subject: RE: Question on the use of attributes from schema extensions

...

Kelly,

…

    "costCenter": "4130",

    "manager": {

    }

  },

…

…

…

From: Kelly Grizzle

named using th

---

From: Keith Hazelton <[email-masked]>
Date: Tue, 11 Aug 2015 18:12:16 +0000

Of course, namespaces are not supported natively in JSON, but one way forward might be something like the approach described in “Using Namespaces” section of:

https://eclipse.org/eclipselink/documentation/2.4/moxy/json003.htm
--
email & jabber: [email-masked]<mailto:[email-masked]>
calendar: http://go.wisc.edu/i6zxx0

From: Kelly Grizzle

...

Kelly,

…

    "costCenter": "4130",

    "manager": {

    }

  },

…

…

…

From: Kelly Grizzle

named using th

---

From: Phil Hunt <[email-masked]>
Date: Fri, 14 Aug 2015 09:41:31 -0700

Keith,

Sorry for the late response.  Just got back from my off-the-grid holiday.  :-)

The example below (from Kelly) would likely not parse reliably as some parsers might only return the last or first instance.  The idea is to place all extension attributes together in a JSON “bag” which is a JSON attribute holding the name of the schema extension URI (as per the examples).

BAD:
> "userName": "[email-masked] <mailto:[email-masked]>",

Good:
{
  "schemas":
  "userName": "[email-masked] <mailto:[email-masked]>",

  “urn:enterprise:2.0:User”: {
     “costCenter": "4130",

“urn:enterprise:2.0:User” could be any extension URN you define.  Thus if you define attributes of same name as urn:ietf:params:scim:schemas:extension:enterprise:2.0:User”, then there is no collision.

In this sense, every attribute is prefixed with its own schema.  We do not have to worry about attribute name collisions since the base object and each extension have their own position in the json structure.

You will also notice that when referring to those attributes, you use the schema uri plus the attribute extension name together.  Eg.

filter=urn:enterprise:2.0:User:organization eq “Universal Studio"

At the time we wrote this specification, there was still a tremendous pushback in the JSON community on having any schema at all.  As a result, we adopted a very “loose” model that focuses on letting a parser know what attributes may be present in a JSON object that also avoids naming conflicts.

Hopefully this helps.

Thanks for the comments!

Phil

@independentid
www.independentid.com
[email-masked]

> On Aug 11, 2015, at 10:14 AM, Kelly Grizzle <[email-masked]> wrote:
> 
> "userName": "[email-masked] <mailto:[email-masked]>",
> "userName": "[email-masked] <mailto:[email-masked]>",
> email & jabber: [email-masked] <mailto:[email-masked]>
> calendar: http://go.wisc.edu/i6zxx0 <http://go.wisc.edu/i6zxx0>
>  
> From: Kelly Grizzle
> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim

---

From: Phil Hunt <[email-masked]>
Date: Fri, 14 Aug 2015 09:43:28 -0700

Ooops…  in my “good” example below, I forgot to make the schemas value "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User" consistent with the schema bag "urn:enterprise:2.0:User"

apologies for any confusion.

Phil

@independentid
www.independentid.com
[email-masked]

> On Aug 14, 2015, at 9:41 AM, Phil Hunt <[email-masked]> wrote:
> 
> Keith,
> 
> www.independentid.com <http://www.independentid.com/>[email-masked] <mailto:[email-masked]>
>> On Aug 11, 2015, at 10:14 AM, Kelly Grizzle <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> From: scim [mailto:[email-masked] <mailto:[email-masked]>] On Behalf Of Keith Hazelton
>> [email-masked] <mailto:[email-masked]>

---

From: Keith Hazelton <[email-masked]>
Date: Fri, 14 Aug 2015 16:50:10 +0000

Phil,

No confusion. I get the point of "place all extension attributes together in a JSON “bag” which is a JSON attribute holding the name of the schema extension URI”.  Thanks to you and Kelly for the clarifications.     —Keith
--
email & jabber: [email-masked]<mailto:[email-masked]>
calendar: http://go.wisc.edu/i6zxx0

From: Phil Hunt
Date: Friday, August 14, 2015 at 11:43
To: Phil Hunt
Cc: Kelly Grizzle, Keith Hazelton, SCIM WG
Subject: Re: [scim] Question on the use of attributes from schema extensions

Phil

@independentid
www.independentid.com<http://www.independentid.com>
[email-masked]<mailto:[email-masked]>

On Aug 14, 2015, at 9:41 AM, Phil Hunt <[email-masked]<mailto:[email-masked]>> wrote:

Keith,

BAD:

Good:
{
  "schemas":

Hopefully this helps.

Thanks for the comments!

Phil

@independentid
www.independentid.com<http://www.independentid.com/>
[email-masked]<mailto:[email-masked]>

On Aug 11, 2015, at 10:14 AM, Kelly Grizzle <[email-masked]<mailto:[email-masked]>> wrote:

...

Kelly,

…

    "costCenter": "4130",

    "manager": {

    }

  },

…

…

…

From: Kelly Grizzle

named using th
_______________________________________________
scim mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/scim

---

From: Keith Hazelton <[email-masked]>
Date: Fri, 14 Aug 2015 16:53:00 +0000

Quick followup question: For custom extensions, does the unique schema value URI have to be under urn:ietf:params:scim:schemas:extension  or could it be under any valid uri?     —Keith
--
email & jabber: [email-masked]<mailto:[email-masked]>
calendar: http://go.wisc.edu/i6zxx0

From: Phil Hunt

Phil

@independentid

Keith,

BAD:

Good:
{
  "schemas":

Hopefully this helps.

Thanks for the comments!

Phil

@independentid

...

Kelly,

…

    "costCenter": "4130",

    "manager": {

    }

  },

…

…

…

From: Kelly Grizzle

named using th

---

From: Phil Hunt <[email-masked]>
Date: Fri, 14 Aug 2015 10:11:23 -0700

From a protocol perspective it does not matter.

However we set aside that namespace in the IANA registry for those that want to use it to signal a schema is an “extension”.

In practice a server will only pay attention to those schemas that it lists under the /Schemas endpoint and will ignore the rest.  Wether a schema defines an object or an extension to an object is defined under /ResourceTypes.

Cheers,

Phil

@independentid
www.independentid.com
[email-masked]

> On Aug 14, 2015, at 9:53 AM, Keith Hazelton <[email-masked]> wrote:
> 
>> On Aug 14, 2015, at 9:41 AM, Phil Hunt <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> Keith,
>> 
>>> https://www.ietf.org/mailman/listinfo/scim <https://www.ietf.org/mailman/listinfo/scim>
>> 
>

---

From: Keith Hazelton <[email-masked]>
Date: Fri, 14 Aug 2015 18:31:14 +0000

Understood about the server-side support. Would you say the IANA registry process defined in Core Schema Section 10 is intended to be relatively open to outside contributions (such as higher ed) for new schema or schema extensions?    —Keith
--
email & jabber: [email-masked]<mailto:[email-masked]>
calendar: http://go.wisc.edu/i6zxx0

From: Phil Hunt
Date: Friday, August 14, 2015 at 12:11
To: Keith Hazelton
Cc: SCIM WG
Subject: Re: [scim] Question on the use of attributes from schema extensions

Cheers,

Phil

@independentid

On Aug 14, 2015, at 9:53 AM, Keith Hazelton <[email-masked]<mailto:[email-masked]>> wrote:

From: Phil Hunt

Phil

@independentid

Keith,

BAD:

Good:
{
  "schemas":

Hopefully this helps.

Thanks for the comments!

Phil

@independentid

...

Kelly,

…

    "costCenter": "4130",

    "manager": {

    }

  },

…

…

…

From: Kelly Grizzle

named using th

---

From: Phil Hunt <[email-masked]>
Date: Fri, 14 Aug 2015 11:56:07 -0700

Yes.  Wide open.  My understanding of the WG and the IESG intent is the only intent of review is to eliminate spammy registrations. 

Some thoughts...

Before you register, the only caution is that the WG has not really discussed (at length) how to handle versioning of schema (as opposed to versioning of the protocol). 

For example, if you were to submit a first draft of the “edu" schema, what should you do when you want to revise it?  Simply revise the current document registration, OR, register a new schema URN with version n.1?   The problem that arises is does a new “version” of a schema represent a different schema “bag” because it is technically a different URN.  Or is it a replacement?

I’m not sure it matters that much to the WG. But we might be able to collectively come up with some best practices. Something to think about.  Curious as to your thoughts.

Given the edu schema that’s been used in other protocols is actually very mature, I wouldn’t be afraid to register it sooner than later.  One item to consider is whether to make use of SCIM’s complex attributes if you are porting from the LDAP eduschema.  There’s a certain advantage in SCIM to be able to “type” multi-valued attributes (such as we have with emails and addresses).

Phil

@independentid
www.independentid.com
[email-masked]

> On Aug 14, 2015, at 11:31 AM, Keith Hazelton <[email-masked]> wrote:
> 
>> On Aug 14, 2015, at 9:53 AM, Keith Hazelton <[email-masked] <mailto:[email-masked]>> wrote:
>>