Subject: [scim] Search Endpoint Requirements

From: Shelley <[email-masked]>
Date: Thu, 25 Aug 2016 11:08:22 -0500

Is the *.search* endpoint [1] *required *for service providers to implement?

Further, are the *attributes within a search request* subject to the *service
provider config*? If, for example, a Service Provider supports sorting but
does *not *support filtering, what is the expected response when a client
includes a filter in the .search? Should the unsupported attributes simply
be ignored?

[1] https://tools.ietf.org/html/rfc7644#section-3.4.3

---

From: Phil Hunt <[email-masked]>
Date: Thu, 25 Aug 2016 09:27:20 -0700

Shelley,

inline…

hope this helps…

Phil

@independentid
www.independentid.com <http://www.independentid.com/>[email-masked] <mailto:[email-masked]>

> On Aug 25, 2016, at 9:08 AM, Shelley <[email-masked]> wrote:
> 
> Is the .search endpoint [1] required for service providers to implement?

If my memory serves. No.  However, you need it if you need to pass PII or personally confidential information in a filter as otherwise it may leak through the URL (a privacy consideration).

The secondary reason is to allow a “root” level search so clients can apply a filter searching for resources of more than one ResourceType.  There were cases where the client might not know if they were searching for a group or a user in a search-as-you-type series of searches.  Others are using as they are extending SCIM into IoT, devices, OAuth Clients, and other things.

> 
> Further, are the attributes within a search request subject to the service provider config? If, for example, a Service Provider supports sorting but does not support filtering, what is the expected response when a client includes a filter in the .search? Should the unsupported attributes simply be ignored?

Not sure why you would implement .search if you aren’t using filters (given there is no PII issue).  All you could return (over normal GET) is all objects within the entire server which generally seems like something to be avoided except in a very small data set.

If the service provider config says filters are not supported then it should return HTTP Status 501 (not implemented) if a filter parameter is provided.  

> 
> [1] https://tools.ietf.org/html/rfc7644#section-3.4.3 <https://tools.ietf.org/html/rfc7644#section-3.4.3>
> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim