Subject: [Id-event] Distribution - use cases

From: Phil Hunt <[email-masked]>
Date: Wed, 25 Jan 2017 10:26:12 -0800

As mentioned in my previous email, here are the use cases I think the distribution draft should be re-worked to address.  

Use Cases:

1.  How to transfer one or more SETs via HTTPS POST.  The Data Transfer Protocol (the subscriber is the server to the publisher)
2.  How to subscribe with a publisher and to interrogate and control a subscription status.  The Control Protocol (the publisher provides the service to the subscriber).
3.  How to adjust the enrolment of a feed. The Enrolment Service (the publisher provides the service to the subscriber).

With regards to 2 & 3, should this be part of the same API?  

For example, if we re-used SCIM for #2 (as currently proposed), then #3 would be easily defined by using a “members” attribute on the feed.  Enrolment happens by simply adding a new subject value to the members attribute.  

OR, we could have a very simple POST / DELETE endpoint where subscribers POST and DELETE subjects.  In this style, what would be expected from a GET (e.g. return all enrolled subjects)?  Should a GET even be possible? What about PUT etc?  My gut reaction is let’s not invent yet another HTTP protocol and to just re-use SCIM.  There are normal conventions that implementers can use to make their own decisions on this stuff. For example, in SCIM a service provider doesn’t have to return all values of a group unless it feels the client is authorized to receive it.  In cases where there are millions of values, it just does not always make sense.

Phil

Oracle Corporation, Identity Cloud Services & Identity Standards
@independentid
www.independentid.com <http://www.independentid.com/>[email-masked] <mailto:[email-masked]>

---

From: "Phil Hunt (IDM)" <[email-masked]>
Date: Tue, 31 Jan 2017 09:21:21 -0800

Not sure if people have had time to look at this. 

I am happy to just take a shot at reworking the draft to address the cases below if people are ok. 

I believe Yaron was also interested in starting to raise any issues with the WG SET draft. In particular, please let me know of any issues with normative concerns as there is already a dependent spec being implemented (OIDC Backchannel Logout). 

Thanks!

Phil

> On Jan 25, 2017, at 10:26 AM, Phil Hunt <[email-masked]> wrote:
> 
> www.independentid.com
> [email-masked]
> _______________________________________________
> Id-event mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/id-event