Subject: [scim] Fwd: New Version Notification for draft-hunt-scim-discovery-00.txt

From: Phil Hunt <[email-masked]>
Date: Wed, 3 Feb 2016 11:12:16 -0800

This draft provides a way to discover a SCIM server endpoint using ./well-known discovery technique.

The draft supports two methods:

1. Simple ./well-known/scim for discovery a server based on the current user (if authenticated).

2. WebFinger to enable a scim client to discover the appropriate scim server based on a user account identifier (e.g.email address). This is useful in multi-tenancy situations when clients need to discover tenancies based on user identifiers.

In both cases, the information disclosed is kept to a minimum to avoid duplication of what SCIM already has since the call to a discovery service likely only has to be done once.  Thus duplicating things like ServiceProviderConfig or returning information about a user would complicate security and scalability dramatically.

You may note I included an “issuer” value which is intended to help the client confirm that the information it discovered comes from the correct source.  I’m not sure this is needed, but I suggest we follow what is happening with the discussion in OAuth around Mike Jones discovery draft for OAuth.  See: https://tools.ietf.org/html/draft-jones-oauth-discovery-01

Comments, feedback and support much appreciated.

Phil

@independentid
www.independentid.com <http://www.independentid.com/>[email-masked] <mailto:[email-masked]>

> Begin forwarded message:
> 
> From: [email-masked]
> Subject: New Version Notification for draft-hunt-scim-discovery-00.txt
> Date: February 3, 2016 at 10:54:15 AM PST
> To: "Phil Hunt" <[email-masked]>
> 
> 
> A new version of I-D, draft-hunt-scim-discovery-00.txt
> has been successfully submitted by Phil Hunt and posted to the
> IETF repository.
> 
> Name:		draft-hunt-scim-discovery
> Revision:	00
> Title:		System for Cross-Domain Identity Management: Discovery
> Document date:	2016-02-03
> Group:		Individual Submission
> Pages:		8
> URL:            https://www.ietf.org/internet-drafts/draft-hunt-scim-discovery-00.txt
> Status:         https://datatracker.ietf.org/doc/draft-hunt-scim-discovery/
> Htmlized:       https://tools.ietf.org/html/draft-hunt-scim-discovery-00
> 
> 
> Abstract:
>   The System for Cross-Domain Identity Management (SCIM) specifications
>   are designed to enable identity provisioning in cloud based
>   applications and web services easier using HTTP protocol.  This
>   specification defines a method for discovering a SCIM service
>   provider using the "/.well-known" mechanism and optional support for
>   WebFinger queries.
> 
> 
> 
> 
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
> 
> The IETF Secretariat
>

---

From: Anthony Nadalin <[email-masked]>
Date: Wed, 3 Feb 2016 20:59:17 +0000

There are issues with trying to discover with account identifier as I may use the same account identifier with different tenants

From: scim [mailto:[email-masked]] On Behalf Of Phil Hunt
Sent: Wednesday, February 3, 2016 11:12 AM
To: [email-masked] WG <[email-masked]>
Subject: [scim] Fwd: New Version Notification for draft-hunt-scim-discovery-00.txt

You may note I included an “issuer” value which is intended to help the client confirm that the information it discovered comes from the correct source.  I’m not sure this is needed, but I suggest we follow what is happening with the discussion in OAuth around Mike Jones discovery draft for OAuth.  See: https://tools.ietf.org/html/draft-jones-oauth-discovery-01<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fhtml%2fdraft-jones-oauth-discovery-01&data=01%7c01%7ctonynad%40microsoft.com%7c009715c2eb0f431a627508d32ccdf3f1%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=ucPOyjmC9Gk%2bxAvZ5N3DaMJZq2MeQyyBlzX6sjFulyE%3d>

Phil

@independentid
www.independentid.com<https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fwww.independentid.com&data=01%7c01%7ctonynad%40microsoft.com%7c009715c2eb0f431a627508d32ccdf3f1%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=1%2fmq3qL7PBpfT5YHFJJf7JygzZK9c9D%2faGRqaQ6S7zQ%3d>
[email-masked]<mailto:[email-masked]>

Begin forwarded message:

From: [email-masked]<mailto:[email-masked]>
Subject: New Version Notification for draft-hunt-scim-discovery-00.txt
Date: February 3, 2016 at 10:54:15 AM PST
To: "Phil Hunt" <[email-masked]<mailto:[email-masked]>>

Name:             draft-hunt-scim-discovery
Revision:         00
Title:               System for Cross-Domain Identity Management: Discovery
Document date:          2016-02-03
Group:             Individual Submission
Pages:              8
URL:            https://www.ietf.org/internet-drafts/draft-hunt-scim-discovery-00.txt<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2finternet-drafts%2fdraft-hunt-scim-discovery-00.txt&data=01%7c01%7ctonynad%40microsoft.com%7c009715c2eb0f431a627508d32ccdf3f1%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=AkkUpbD5XEq%2bMnDAJYdyeShX5T5omPyZSZulaQMrABs%3d>
Status:         https://datatracker.ietf.org/doc/draft-hunt-scim-discovery/<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fdatatracker.ietf.org%2fdoc%2fdraft-hunt-scim-discovery%2f&data=01%7c01%7ctonynad%40microsoft.com%7c009715c2eb0f431a627508d32ccdf3f1%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=BSi4dH7YgwfgZxyhp0M2SGugREa%2f3yvFNbRuGHJ70PI%3d>
Htmlized:       https://tools.ietf.org/html/draft-hunt-scim-discovery-00<https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2ftools.ietf.org%2fhtml%2fdraft-hunt-scim-discovery-00&data=01%7c01%7ctonynad%40microsoft.com%7c009715c2eb0f431a627508d32ccdf3f1%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=vjdEn4Nm2vfdMMaA8vCRU52f3%2fhGEGYHVy8VAFt1vR4%3d>

Abstract:

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org<https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2ftools.ietf.org&data=01%7c01%7ctonynad%40microsoft.com%7c009715c2eb0f431a627508d32ccdf3f1%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=nYw6gbiRpK%2b0F5anJC5vd1hoB5e3w41rTePTNsBr8QY%3d>.

The IETF Secretariat

---

From: "Phil Hunt (IDM)" <[email-masked]>
Date: Wed, 3 Feb 2016 13:07:00 -0800

Right. The definition for acct uri is actually quite broad. Anything that maps to a specific acnt. 

So while email is often used for acnt, it might not be unique. This is why the acct uri spec defines itself as distinct from mailto:. So MS would be free to use another value that maps to a unqiue acnt identifer across all tenancies. 

I believe webfinger already covers what should happen if multiple responses are matched because the client gave a value that isn't uniquely matched. 

Phil

> On Feb 3, 2016, at 12:59, Anthony Nadalin <[email-masked]> wrote:
> 
> www.independentid.com
> [email-masked]
> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim