From leifj@sunet.se Sat Feb 1 04:33:11 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4BD071A0594 for ; Sat, 1 Feb 2014 04:33:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.593 X-Spam-Level: X-Spam-Status: No, score=0.593 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, HELO_EQ_SE=0.35, RP_MATCHES_RCVD=-0.535, SPF_NEUTRAL=0.779] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zNg3WGqIHibr for ; Sat, 1 Feb 2014 04:33:10 -0800 (PST) Received: from e-mailfilter01.sunet.se (e-mailfilter01.sunet.se [IPv6:2001:6b0:8:2::201]) by ietfa.amsl.com (Postfix) with ESMTP id 570321A0590 for ; Sat, 1 Feb 2014 04:33:10 -0800 (PST) Received: from smtp1.sunet.se (smtp1.sunet.se [IPv6:2001:6b0:8:2::214]) by e-mailfilter01.sunet.se (8.14.3/8.14.3/Debian-9.4) with ESMTP id s11CX59N012660 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Sat, 1 Feb 2014 13:33:05 +0100 Received: from kerio.sunet.se (kerio.sunet.se [192.36.171.210]) by smtp1.sunet.se (8.14.4/8.14.4) with ESMTP id s11CX2ih024181 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sat, 1 Feb 2014 13:33:05 +0100 (CET) X-Footer: c3VuZXQuc2U= Received: from [172.20.10.5] ([2.65.88.93]) (authenticated user leifj@sunet.se) by kerio.sunet.se (Kerio Connect 8.2.2) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256 bits)) for scim@ietf.org; Sat, 1 Feb 2014 13:33:02 +0100 Message-ID: <52ECE97D.2090707@sunet.se> Date: Sat, 01 Feb 2014 13:33:01 +0100 From: Leif Johansson User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0 MIME-Version: 1.0 To: "scim@ietf.org" X-Enigmail-Version: 1.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Bayes-Prob: 0.0001 (Score 0, tokens from: outbound, sunet-se:default, base:default, @@RPTN) X-CanIt-Geo: ip=192.36.171.210; country=SE; latitude=62.0000; longitude=15.0000; http://maps.google.com/maps?q=62.0000,15.0000&z=6 X-CanItPRO-Stream: outbound-sunet-se:outbound (inherits from outbound-sunet-se:default, sunet-se:default, base:default) X-Canit-Stats-ID: 09Ll0x5Xn - de69c5d08d6e - 20140201 X-CanIt-Archive-Cluster: PfMRe/vJWMiXwM2YIH5BVExnUnw X-Scanned-By: CanIt (www . roaringpenguin . com) Subject: [scim] no Friday this time X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 01 Feb 2014 12:33:11 -0000 Looks like we're scheduled for Monday in Londay. From phil.hunt@oracle.com Tue Feb 4 10:01:18 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D5D41A0155 for ; Tue, 4 Feb 2014 10:01:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.735 X-Spam-Level: X-Spam-Status: No, score=-4.735 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ChIz3mISa1z8 for ; Tue, 4 Feb 2014 10:01:16 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) by ietfa.amsl.com (Postfix) with ESMTP id 74FD41A012A for ; Tue, 4 Feb 2014 10:01:16 -0800 (PST) Received: from ucsinet21.oracle.com (ucsinet21.oracle.com [156.151.31.93]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s14I1FnP021298 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Tue, 4 Feb 2014 18:01:16 GMT Received: from aserz7021.oracle.com (aserz7021.oracle.com [141.146.126.230]) by ucsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s14I1E7o020656 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 4 Feb 2014 18:01:15 GMT Received: from abhmp0002.oracle.com (abhmp0002.oracle.com [141.146.116.8]) by aserz7021.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s14I1EH4006077 for ; Tue, 4 Feb 2014 18:01:14 GMT Received: from [192.168.1.124] (/24.86.29.34) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 04 Feb 2014 10:01:14 -0800 From: Phil Hunt Content-Type: multipart/alternative; boundary="Apple-Mail=_14F0979C-361F-41D2-BA33-97395C6A12BF" Message-Id: <412309D4-510F-413C-8ECC-9A658C15297A@oracle.com> Date: Tue, 4 Feb 2014 10:01:12 -0800 To: "scim@ietf.org WG" Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\)) X-Mailer: Apple Mail (2.1510) X-Source-IP: ucsinet21.oracle.com [156.151.31.93] Subject: [scim] Is externalId modifiable? X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Feb 2014 18:01:18 -0000 --Apple-Mail=_14F0979C-361F-41D2-BA33-97395C6A12BF Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Looking through the draft 2 schema, I see that externalId is marked = readOnly. Is the intent here that it be immutable (spec says it is set by client)? = I had been assuming it is a modifiable attribute and the client may = update it any time. While on the subject of "readOnly": ticket 35 (discussed in Vancouver) = adds a broader attribute quality - mutability. Mutability allows an = attribute to be declared as: readOnly, writeOnly, immutable, or = readWrite. I am assuming that mutability replaces the meta-attribute = readOnly and readOnly should be removed. Is this correct? Phil @independentid www.independentid.com phil.hunt@oracle.com --Apple-Mail=_14F0979C-361F-41D2-BA33-97395C6A12BF Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii

= --Apple-Mail=_14F0979C-361F-41D2-BA33-97395C6A12BF-- From phil.hunt@oracle.com Wed Feb 5 09:01:43 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A62A81A01D1 for ; Wed, 5 Feb 2014 09:01:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.735 X-Spam-Level: X-Spam-Status: No, score=-4.735 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001, TVD_SPACE_RATIO=0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7Y2v111xSgSY for ; Wed, 5 Feb 2014 09:01:42 -0800 (PST) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) by ietfa.amsl.com (Postfix) with ESMTP id B93161A018E for ; Wed, 5 Feb 2014 09:01:42 -0800 (PST) Received: from acsinet22.oracle.com (acsinet22.oracle.com [141.146.126.238]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s15H1eGf026544 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Wed, 5 Feb 2014 17:01:40 GMT Received: from aserz7022.oracle.com (aserz7022.oracle.com [141.146.126.231]) by acsinet22.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s15H1cHW029096 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 5 Feb 2014 17:01:40 GMT Received: from abhmp0010.oracle.com (abhmp0010.oracle.com [141.146.116.16]) by aserz7022.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s15H1cKF029084 for ; Wed, 5 Feb 2014 17:01:38 GMT Received: from [192.168.1.125] (/24.86.29.34) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 05 Feb 2014 09:01:38 -0800 From: Phil Hunt Content-Type: text/plain; charset=us-ascii X-Mailer: iPhone Mail (11B554a) Message-Id: Date: Wed, 5 Feb 2014 09:01:30 -0800 To: "scim@ietf.org WG" Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (1.0) X-Source-IP: acsinet22.oracle.com [141.146.126.238] Subject: [scim] Call today? X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 17:01:43 -0000 Details? Phil From bjorn.aannestad@unboundid.com Wed Feb 5 10:16:32 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A476A1A01CC for ; Wed, 5 Feb 2014 10:16:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vli3xtU26v3Z for ; Wed, 5 Feb 2014 10:16:31 -0800 (PST) Received: from mail-oa0-f51.google.com (mail-oa0-f51.google.com [209.85.219.51]) by ietfa.amsl.com (Postfix) with ESMTP id 292A21A01A9 for ; Wed, 5 Feb 2014 10:16:31 -0800 (PST) Received: by mail-oa0-f51.google.com with SMTP id h16so925138oag.24 for ; Wed, 05 Feb 2014 10:16:30 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:message-id:date:from:user-agent:mime-version:to :subject:references:in-reply-to:content-type :content-transfer-encoding; bh=FPCBLuAsUrhGYlEta05sUGmK9OAFwLkdBTShuad7id4=; b=kKnKx4p1YizAu9qV+u6qTNy1a5yfIWK72p29QXyZSYE35hOZIDiZNwBzNjakESaQbn i14B9fTW2Gdgt+q1M6MPdcUDUve4ouEbdnQGMN3smFLj3QdgSFIkoSM9fudQL4/VJZhU 6u3iln5hLeOIrsB2RkmyrnDFDIp7fBf3Df+KZQh7XPqXHK6PMJ7N9Y867z6kI37XiJ63 MeWA4PtvvBSWEiwBPaIo1GaQNkIEO5XHksfnvQj4cpdiV8VjZ6z9Hxbe7kMaPFBWt7Nk X5OetM/JEeGPfH1v1ScIoVZPS+KCSz3OhFYJ3orY3Cfg23eCq4gFEfV1o7bS9zU0OOlA 814g== X-Gm-Message-State: ALoCoQmbG+jX/jY1JeRt01UAUX5/B3SbVy1YnYTUyDgDB8dVHjDpSoyZ/JSIEZpqWZu5lcjkWvSl X-Received: by 10.60.133.144 with SMTP id pc16mr1587863oeb.83.1391624190052; Wed, 05 Feb 2014 10:16:30 -0800 (PST) Received: from [192.168.241.104] (24-155-184-100.static.grandenetworks.net. [24.155.184.100]) by mx.google.com with ESMTPSA id ii8sm50404930obb.11.2014.02.05.10.16.28 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 05 Feb 2014 10:16:29 -0800 (PST) Message-ID: <52F27FF8.1060206@unboundid.com> Date: Wed, 05 Feb 2014 12:16:24 -0600 From: Bjorn Aannestad User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0 MIME-Version: 1.0 To: scim@ietf.org References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [scim] Call today? X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 18:16:32 -0000 It might be here: https://go.webex.com/go/j.php?ED=153193777&UID=-1&RT=MiM0 11 Pacific. -Bjorn On 2014-02-05 11:01 AM, Phil Hunt wrote: > Details? > > Phil > _______________________________________________ > scim mailing list > scim@ietf.org > https://www.ietf.org/mailman/listinfo/scim From phil.hunt@oracle.com Wed Feb 5 10:36:54 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D78381A016B for ; Wed, 5 Feb 2014 10:36:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.315 X-Spam-Level: X-Spam-Status: No, score=-2.315 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, J_CHICKENPOX_34=0.6, J_CHICKENPOX_54=0.6, J_CHICKENPOX_64=0.6, J_CHICKENPOX_65=0.6, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01, T_HTML_ATTACH=0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e9N6_PA5lt09 for ; Wed, 5 Feb 2014 10:36:46 -0800 (PST) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) by ietfa.amsl.com (Postfix) with ESMTP id 105E51A0192 for ; Wed, 5 Feb 2014 10:36:46 -0800 (PST) Received: from acsinet21.oracle.com (acsinet21.oracle.com [141.146.126.237]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s15Iaipu015226 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Wed, 5 Feb 2014 18:36:45 GMT Received: from userz7022.oracle.com (userz7022.oracle.com [156.151.31.86]) by acsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s15IaghG017962 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 5 Feb 2014 18:36:43 GMT Received: from abhmp0005.oracle.com (abhmp0005.oracle.com [141.146.116.11]) by userz7022.oracle.com (8.14.5+Sun/8.14.4) with ESMTP id s15IafgA005093; Wed, 5 Feb 2014 18:36:41 GMT Received: from [192.168.1.124] (/24.86.29.34) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 05 Feb 2014 10:36:38 -0800 Content-Type: multipart/mixed; boundary="Apple-Mail=_94FF3956-4169-4DAF-8B9C-EE890E260727" Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\)) From: Phil Hunt In-Reply-To: <52F27FF8.1060206@unboundid.com> Date: Wed, 5 Feb 2014 10:36:38 -0800 Message-Id: <89336A8E-953C-4E4E-9D59-FC436575BB49@oracle.com> References: <52F27FF8.1060206@unboundid.com> To: Bjorn Aannestad X-Mailer: Apple Mail (2.1510) X-Source-IP: acsinet21.oracle.com [141.146.126.237] Cc: scim@ietf.org Subject: Re: [scim] Call today? X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 18:36:55 -0000 --Apple-Mail=_94FF3956-4169-4DAF-8B9C-EE890E260727 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 Attached is the current 03 in progress diff against the published 02 = draft. I have also attached the current task items worksheet. Some possible items for today's discussion=85. 1. removal of readOnly meta-attribute (replaced by mutability) 2. indexed -- do we want to go ahead with this? What was the = consensus? 3. update on redirects Phil @independentid www.independentid.com phil.hunt@oracle.com --Apple-Mail=_94FF3956-4169-4DAF-8B9C-EE890E260727 Content-Disposition: inline; filename="SCIM-Ticket-Plan Sheet1.pdf" Content-Type: application/pdf; x-unix-mode=0644; name="SCIM-Ticket-Plan Sheet1.pdf" Content-Transfer-Encoding: base64 JVBERi0xLjMKJcTl8uXrp/Og0MTGCjQgMCBvYmoKPDwgL0xlbmd0aCA1IDAgUiAvRmlsdGVyIC9G bGF0ZURlY29kZSA+PgpzdHJlYW0KeAHtXWuz28aR/Y5fAdkxTZk2RfBNKcnNSrq6edxEVvYmXm/s 7MO1rq1UvFVe//+q7Xmc0wNMAwQIUHZWsqp8SWCmZ6an+/RjHvy+fFN+X+625XG33G5Xq0P5nfu2 266Wq9WqKv9e7k/rZbU3nrDG38v/Lr8o/qd88uKHqvzmh3K13K8Ox+1mLZ8OG/+ffNpsT6vqtC9/ +Kbc7PfL7dE1uT+uVsdyv1uuj+V2t1ket+X//lfx7YSdSoe23xzdULa77XK3l4bKL8qk1+VK/knv vpfOrrf+m/9QHcvq6LixOhTffFc+f5D38mVTPnxTbmWM8k/+VPtVua7Wu/Lhu/LJw0O1rMqqfPi2 /Es5f/TBhz97LN/mH/n/zx6XX5cPvy1uH2SYk3C/cOO4xkB1eOvjqW14Hz8uP1vJcOdfzf2nnXx6 7D9ty/knjwthovvruFrOF5+6D/Lis8CFcgAXilwq6zI4gAuFm7Zz010m0y2TWZvuShlSNOb74+WT T1ZPqjDbVZzuXgMteipbj4EW1Mb+A9XprrYqzs3hreMMfuj+yrTPPsC0P/EfNuW8wvRv/AeZ9234 UMwx/4sdXg1hUBONCuLTxZLg2eMkoehQ/C5JOGyqhmoU0PyPH4mYC4tWIgtO53sJwU9wjOvVat06 xv0hirpM7T/KIFXS1+vDpjE0AvfHj4smss0WMwW344AB/2RUe73bbjHgpmoTypdQTqirCLCH7cUM n061wYvypAboQieiC9eKC+x1VFudbW+lV/t10bDS86fPHpcPf/tH0E8djLfJMhjD5Vh6yRXczSFZ hDYINWFbZlKeiE3G1GLSozgoaJPaz30VsfSoQqoUoYOTGOkBm5n9wndK2uEj2gnW+qWrJRYEXWCL qnWr0N1iPkT9mqCqji0Mh5gScWO7JHCExyj89e604UPYE/jhk08/ujl++AsZq3McP1k8Li7G1rc8 VhXQ4EXYA/xVBBROMGXhn7wIFPMZheI5pI2C86IGPt0RzE8GeSvvKQR2NJEXekQuuJkPiMtHcLhQ NvjUBXWQBTOPans6LFcS1a1Oy8Neorr9drmSyEuilu2y2p1OBy/aaQh3idMYvAR7fMQYKHbi/934 oaZQgRHOopNYzFmGQANuUCYQYrAoSlDEQtvKMJbMiJL76AmIL17OSO6JxzMBK6Ih6dxi9tg7EMKQ yjnLRIIKswKC7creK4jt68tu61FNcIZqCktfNjp5Auvat/MecwA+MVFp8LTeS/S8lmYyM/zq7tmr m7tf3zxLzPH5RhLEkbClOp1OGeGnr+r2XVD/tC63p+1yvxWFWFc7pyBOHZqJgSGRonbE2WbXkdQ2 FyEdgPiJKsEPBLxo4iRchj2kHEUlL+aLrriLlKADCyX5m4ZsFiq/bGUmcYtHHxJSsecjkqT8i5F2 HrOYeKo537Hab6EK1BZqlBp5qCr6jzqkspjN0AZ7zZEpHbqrxy4D2kuneiSGdP4rlx9oCkDMB+lc SM97KVPMOyXkXXzeQn5Cy3pW9YqkS866tXQJs0cLRXxd8NGHLlPkfJ0oeUBcfGfBNutGZa5Zt/0k cYM3bW5wTWCR9J7k9mreMyWeH6BMt9C8oNUK+JTg3/2OlTDul1STBYuxEH1hqhDLKL/YLJSJhYXH Kn/NVGRNKUZw0bu+lqFp4ecoQ1PkhsaSyflAQ5MroNe/zT7Fd6fe86f3amg61CcjGAxGTlAEjME4 541zG2Wj0JCKxgTyA5QkcuLFCy+NonEQiyhVRZK+zajxAazYGRiO5iCB4Rh9sju/h1IoaKOH6HrQ n2LOOrQ8TCcvmnDBFoWIyviQGYkQbk7JxRBuLh0EMM8bmj/6g+RNkZYY1PcAxjlJESdwl0KUgnGc L4gEyja5y7qtYHw4LXfrZqgxKRhv9gYYUz4hO33jDDdwCUHaQwICK3jBojVhEDK7Yl6LEpzEXxgl FFmUoK7VwCjhsuiuA7xN/k8P3rkMTwPeR8n7ZlnA15epmwdvg6Bo2x+cdyAgC3mkGEUVKuZw8Ylu kihrJOT4SpfYgL+fv0FhZqvpBjfbKudUj/xVoxupFSDcUuQ1GuAjkvYp4gRy3QKgvZwa07OiHi3J sarB0xhB5cmxfhCfruJs6p6CT1U1m/MGfSQGN0YQQ4DZgl6duI/KLOeDxWTNVtxYWZBvJGumRFDp moGgOrUEefivfLDgZL8EGn7gIz/JCMN0QODptHDEfKJLgLcQ4lC70Ly10K+zJ11mqLmoZnq26F7Q TyXCdFFr03e1XIgTvOZUDEU5c62jOlarjPDTPyrKOYGLuZDtSXZhXC0XIh1J4TZqcharqhPIGIey RhSkHEYUKyh0iMVYIvMLSYTCRyiUhLPzAgSsiaDwf2apO1lPjLA624QGJQ5rB6SzWtbVf3amQzSK 3VIqGjZzPFmf844h7GQdaiI7wVesPaPe8h2rHeLujry64htrKcX8EeMYvgITE5u1EBzqjwV+U8wF myC6rFGuTGLhL7VGWQgYbVBdUaLByBSFLB+8XNIRRwQMyZI6Dd2NXYJusCd0W1Q6xyd1gEpXS+oY CCmTStCBGXsLcQQsZ1QvTQ+B0/S1qJKoQtajKMyyX69wqCYBCNWW0Eo6t7C/VFIQytYrEtsM3gyM RGSNNerlkNx6eyQSxLO5ojZ5JGJowVAbnau8SyMdtofUNHqv8+mD2ugOhc0I+kjEICgi/cjPscgB kyZw+cNcy4orZ586jSLEZdVtqgjfMU741NkFWQWgxL3wbYtlhStptqTgPmTIIU9jj7kWml9I3mdn bPI/KirbXYLecgYJDTpz41F54xbKrhmbyOCafuuPhMo1ERIgfTeyOzb/J8dUQ4anwdS97CTPsju/ VkxN4p7qJEu/jbhnxHKHroh5LJaOGIKM7A0xlB8Ipgs69MTKnyPG5pNe67T0BWCvQ5SUhCfDF1Pr WXxZjaYrwQFoKEcsYr9/D39DC8EIsT4LszpfaSAEuOMr9gMgR/xDUbJDiqpJuNbqV0c4YYvGxOGE oQgCpHE7tqYlE/eW4eadiz8lJ34f/9L9ZO09zPqfYqj655Slg4y4X7CwO4uJoxxwSsWkTbZgARi4 WqBhTzcVH8qZzAQZTlUAK8QrH7FggajhfaAhW370dM/ZZGAQz6sHGoYWTGQU13IwITue5LY+ez0X fa/jYUwMrjayV+p6BnJdvaMGkqYKWk2A4xsqvoZmX7jYSqI4VKLlY1mS4atWe+k3UYuJSnYBEFzR wE/HXpqSMrW9NHWEFs9A6R/TXpqdxcRRDjilU9pLoML17KU53cwxcFCUe6a1buFdsoy4mdFRIFNm L5md4KTCMJISWEmKoUSSAxPtqIPm212f2qcScL31KWmmCdJDTZK9PrXbHZuExT2lSRLTpNzt8Cez xLWPvYS4Ye+oy5jcfCWIbiWKEEkX/PSFs5oJDkOIkOFiQdl5GhCWggpEpSxn8sbKfIPsje4X0NCJ u4Sz7nJomawTtVBHFYP9nLF1FELP8T1WktRhLZg6O1MufGxb87dFYiTM++aaR7Z9Zs8QkrH7rgyS ItQNnpVzotOEsLw5HpdysuOKuwbs6eEeRQ4K+kBpolNzC3j+l5gmZh2WpeDxA19RaUjvJUAZOpKk uFkN3GfjwPpFCjHXygK0L17Y7Jw80WaI5FAAz9Ya3GHKanuyrjwggMuxi14AnhH3AG4TZ9aBooDJ JRx9SZAnklJCCYVEPH4AHciG7ghQ0WLATsq6KYttfPk534ImbUpOgONg1yi27FoNYHsc79E0ZFgf sVkpye3oF0mLvSYqN+MeRQP5Zmh8bn1ELg8gn557VJDtDnHsxfzFxV3yyaTaiOka6XTEPXYEH51i TD/K1q1eodcbtO1+3Rw27mqTJgpnO5T8+mevHUo6neEoQm1w/sB6MWZ9xPFCd78aUSEFErxgbipb Hynru1+dfImbRCAnbN/CDJA2+J2tOXMlUdfEL15zHnzfg7kvrMZ/Ctco2DbOyDl0bbrHQ2E7V1gP 25vs8F3qd9+nqqdrJZvdUW7OaaSCRKov3WuTSLU7LiVXBjVHK53qs1ZCFPlX55X77bZhBRoiZSw4 UOzgqaAsARrE6CvTnaY00/VmD0iW0M1XAVeS4JFFSJi1sfCuXj66WTv4F7WLhNiW7p/iI2qe0qTl oR2gCUJzitDgz4yDFopqNK7lO6mQREtmSkkNhrRTZyORdLNTsGRyb1WeJO1lyWKc97xhycrRlswc MaaDc9/bkukJaNZttWTQ+HqaJ7Vkhbvy6+Lz4k7pld9EUgwOUki9wA7PW1gP3DOx4PCjciZWjEdF Kd0wYy/JAbQoXkcI11VLGMFTg3SRBtXYHzgPaVMqj28aF6Wc38Hc70oyVRJ/hrvOVV5oo6u0HAkZ +8uYV84YInCo/T+rTzGyFyDPTnxbnRpqzbI4wQchm33toHXcoMgg5HXPEWTEfRBiE5eVzuDYkF+U v/ZwnlBM3DVmBAIdBUhdHtolklGXNX9HE0VBxAxzytl1EoRaQKpnutN/MUsj5QsiEJuPF0cg7Rkd aajpRvTO6OTeko8lDJLnMjpOPGQLHOAAHA0cHoLA2427mbErlhiJwLWJIQJTogDBinkzOv8UJQxP XfcbrFATasAKVoK0kVzNiAv/JBrkSbrEbaJokzTRl7TzDrEM7+3AyEbEEv0juPYUUOB/M3YeFUtY 6Fub5mASJkLfVXYMOo0l/pKibxJLrI/LzfWWlTcr63hoj1iCMkWM/iimKTP5zb12FKn56HVDkWy7 Yn1CNCSSgMzesAgraXKKqgqhp4LgAY+vkHBmOpJ+oReorWWpXlBde6Axp8TG2PmEpxKnpfeE6AI3 C0fzlHRMrSVJa9/4CN1+AU+Oo2cOjmzlgJqtumM3buIkluQrsj6+0nNHLNJkHYmwxYwFIjNfF213 Q07vH4YgStRDvW71D9k54Usvpy+6TB3GOG+otzFOiTeyMP4urcoexUkEQKZtF/4Ie+XLrHn9Szxl uQEKtcc3/krjHvFN7j36G7Za+uiFK1UACpdYV6c/XfdhDTinnlyd1WVdEykneFBkb0Nnk1smoGJq 7mOZhA5Uob91HbHrtsO6moZgeutqyPkkl4yst9k59dS6ylnOIYqaxIku42YTh5Vsv9sjPR1OdM2x DmJCkcID2ElBfSfr4ucRQfOghBidv8rSeupYQ/yy9Xi8QF8o5gS/2Jck0c8ySaVebM82JgT4tfle U9Be5FOEbFyyFk4T2g1tv3q82khKS4DxOeWncL6Z4E7nWX2Vn4DANn14TJywNDbuDIyMZfJW6K42 S1kM6QqMRkK3PTh6WxCkWmD0HrrDbwD0MJgx1m6HbuF/M5AX6Jscuo1pniYwqo61M+/NtNQDVc// DECr6uWOhYNumzgv18P2JIJnQK5ijvQS0Zqwt5gBlqmuLETvRLOidKZRy3bhh+BYgi7+/jx7jONg 0twEZDQ01EtN+u5TRgZJEd4eF3+sT/JrE/ni8QjnSLsWFo+la4ZedeOaQ+0WlzRCHrM4NJYQDMog okYWrU2lcwTeiauTbP5PjmuGBAZce3Z38+yrr/QwXIfZz7DH59urKjux7HxS2ezjheRuHLCZxL+k L0Hxgi8W7HB6YbTu0sQSLkGuXql0l4iL3KVRPnENdQmCMPigkddVdESnoAOoQ2JUCg7MWLJNN+6H BW3Why7Rcab+oil63azztR/sOlkZQ/eI+KgM8ou/XjqZwdO1RaWm9xdaCL9aa5M/t1qbyoo4wCEC 4YS86Dni3LcPwG/KL/jK2SbHNYOFI4soiznAd9ZtW61dH9fL01XPZQu/35uO1l9yybN1U9+6Z/N/ etORyzBNx32/u7lty7GS4xH57gpajr77/TPifqXWJo5sBvGRHyIuyullahahEuCvSEUTQlwlYgBF XTa8NZ8BimyCyA27wjehaALTSGLQ4jDpAozIqINoAI+EFpttGqt8sZIdiobDmUs3PjGXGDJhDCCF Do01HPZk6nQI84cYjvYMtdHQWN/fICn+EThEYSPvRP4cW1uXi426rSZgf5Bf0cuyIhNGDzK49ybg RzQBNv8nNwGGDE9iAk4n8xAyYgf5O0Stk9BWkiI27R4GAKAFFa3veyEMGh56fnVGodcHKsISr4ng JJpgawxFFFsjKqBb6GZvbM23s7i8irDJ0ODh0Bod4FZoNaZjJLIaFM8Bq+PpVldqm6zEd4JyK7Du 1svDNW+0tmeFzgrseS3b7Ab3PiszZPtpa7bZZv/UsGoI8DSoKj+g2+FX36eoqntw1puD/FZvYz// NK6Cg5m1dbaXZ6ToRvM+OvrTzDbD7+UOfGgB1DZbAOT5Ib3bBmWBntnqlHHFKXtAbxktE7djPKD7 M9EOIR4PUDXLyRN0wm7/ZKcLTIDueAExtk9ukQpfeaMU8kUsxeukDKPEiujhgpOD0rqwKsNTC925 6T/dJZ4uxQ3fPCqiZIi3WKxoIPsGA+mSk7UQYIhsb4uV0rZ2qxi0xXbZm1UaHI6bVaiu9c0q0yis 26zS0sWw/UMV6r0Jij8fPnF2x2b/5CYo16VJTNBxb54EhmP/OoWNISsOLrVj0+7h2KcJ9LDjkFhH 2ASyBhCWw+PmQmZEGlanYWBeCHQA9wsNF/Ao1pb8M6uTYEdXn2c5auKzBBYB6NEEAZ/jw7jYUmag YG3s9JWifce02ZGGzNuUkYZGe353iy0VPPoNjiRwRRbcOa6J53wfl6y4IsnaPGX+J1dEdiiNu9vO 7itEhnOVpoQmi1zW6+X2mgvK9iy/j1zk2MbqUF59UcBm/9RmwxDgacyG+B0dkcsfU7ORRC6rw3LT PIk8jSPkzM2q6yAysZcfCObZ5poIteo9M9gB5lLjiU1nYw+9AwgQxw7AXS/nNEtEezaAXnKxQk0P y2iwFMwmvjOMAHShCwzR8u6zd/qLFjHTRWrab5w3Ts77EB3JcI0LIyH0Ar2aKUFcRk4q1x0jqeui EpGQ72JfkjFi2OJ+cJT8wHqYBQwT33+DQAgvwI/LgrWLD5T5NX/RHtVonie7NL1YNo2+qZvnVvxb bhpxTp2Y9hcpyAxyctyKfxhv8/wWZoJiR0VXwQAGoGyYTgUL1m1NSgIG6xFhGnhfPJd+r5g9lxRo iFniYtGToiOK0elhAZ5wIDaBE6wEySa5mvyEafv/fzbQZv8o025cMyKtNL30oaY9d//llpHDJjuI 67aJ3VvbxNS0V6e1bEJvJCUnu2RE+iTg1FRWwAfkmWLIdRtCMJ8IaIgYVuleIiOqUztEWYc+kCSy bkuP4hKV0EmgorHslwh6EZbgO0uEMSiIIPzjmNgRXotgR7w+/kiW/NlCbuHBNxZpuRPL4a1sHgAH IgsFnPGEiMdOstv0Img8pYzGphdlIrtOPGR7TLxxC/JTPnl4qGQkspT5bSkyXQMn7VOHKYnUW9fO jHZ6ZyLznjszZVB8W2tnVOm6mZrGX3eJSxlbE8FcbvV94vLtRKA2+0eZKeMEuyHA0Uw9u3mW/LbH ea1LXEoxU/uDdRaWZmrUnjSbtqKjmgfGa1zUIOABXTVG6IHAcZ0tCTE6sJVomwOxNorrOnn9E0Cb ekb45zEUEtaBxqhG7GYNvztmLXcu3C6GGmsnDzOEuoEo8BM4NeRp+Bm+a4YZYbxNzwVzwI5cI8yo Dodlle99mC7MsOeScgUFeB9mxIUn/Qm9cjXBFSQ2+0fhtxFmGCoV8fvVzav7XsdRciRw+F1ZxwSJ 3313lAXazkOVm6kbC7huDUqa0bQGPb+1QzhxaT9zCuj2xToMlL8b8eXlT/z2KwcY8vXTnznklg8O BOVPfHyIxbxdkMceLOWvswn+j6cFGrVkwHDYNLk13IGN7Gp1YA12jXRgDYpvzYHdr8N95ddyYG0Z vhgAnRRLHMnkCc3wBXmWd+FIns3+UQBoOLCGADsAvL+5Ewf2rhcA5qGdAOBuZ54zFkj1UtByAZMs oS6PzR/8niYkE7SUPhn+E1dX4bbQkWWYT0cGRRw2+jzL5+pDzsxfx3PlJJtLUvmv48XmEqcYrkVs Ra+bbb/8IuKz368v/nJYfqeGkdDXvt+ihVhu0b1c/+ZmRnb7syyddc0N5y4mxwUl1pUCEuKQGUWA jXkHyXs2lTHj311HJcWFFyypU8G4hX1A6hYt43tc7NHMFKiya7eeZcKY/MNfe+d6RohwsP2S1Env rvRpH1ucR/4oRRKGusOMthpTZcCtxAnmmttdVPX7+JfAz9pjtzNYXpG/AsTutb2trdDUmEvXxW1t BKK6cU2ji3T34KCcnV/EsLtIwWXERAVjiEo5ZBkVfAJVj18SUpknRSgxVUrUpM6e1l8SGiHh1jT6 G2NtAZ/aAhozES3gq5tnI84Vbo/mgXSoQ8smgmpTLQ9X20QgfTIsINL1dO34Afr9UTQORMX4Idkd TEFlGYKvHn23BMz7AzQNXF9Gky+CqU0ME7BbxZ6VsEuumGP9Qu2RFgdpDlN7mlnY7pMzwzYPdLCo yWjtNsem+wviioWylWXyFjRVRqWmjSVUc8qUR9wFkR8mKlsOE9Hp6AkZ7WDq9sF1XvnUbhQbWleE tZBLjWIe2zujaGsRzRrmsmYUvb9YzptG0YXkXgH+I0XaQQG0W0cJo27m4Xpc7EK4qdu5EWiuDoS3 czavqHkGr+gnUJihr7JYPyKIbGCPOpAgz4apDqhCS4uigKCFW+53fZJfE6F+URtJ5xY+pDUkJxni kccyRhggi6WXaZTPwq3OXNYeRbzVCNuiNbURDq3UljDVCD9cHoZuBUeMnXz30Sd1N87UeRt+X7aq 9st9c71/GqWQOFQ6ZVhh4geEjDhNqaF7hyLRcKkrB33CXwolHtDU4QFIRWEtdJMe67JZCjQqkRri yURTgjlgXRZVs5WRQ59gvNEMtsuRBjlCEnylJoxNo3OxVqE//ENVJUFWwhYFEjY2UtBr0Y6GIJpT Rx5iaEAOkgU7kl6xMxzdbIPA3Thc1mz8s+a9sq1Oe7sFdlka2wLn2R638GXr2fAM7rktCEY7IzO4 BsW3lsEFylzN+JpA82MY35okiMF7Jy5Vs3F+ctOZm7hoOu9vnt1fbjo3e/NSBKHo/RXZ3KCWs8Nh zfDCrVvZtM8fwy3mRFaCJJy0zg1jhFsCMq834StANPCU6MusTFLZeW2SFIxl1ACTGgMoVqLeaSQX owIOis4k+kJy9A74Iy9v4FTyySP/RFzReCyouH3ovsUzD28clluTI/cRkQvC+V4zn1N3wZNQ73J+ MPA+wRO37JI5F2cUpa/F8weR7Hyd1WcULZ60H5StXZ2PjOKqWu669yuMyyi2dBFSYjCW/KMuQfTT bdExPqE2QN9YKbg07/ql7rZcTw32xiQT7F+NuT9Tbni1AqXXEe3vUp3XfdHH/VJ288mBsnW1W8oG hWq7rPaTxUnSJwMq/hOx29yLtiyuZVpP1HyOIhmwwg9faIIsKexkXnAUOkN6EWgU7onc1AYGEPmT LKRYx4U60tdNeNREvqMdYZt8hWrFnCY0+bVfvO1zQRpJ/hlpjReehbLjI9+GR0jgUNlHckHKXP+X RGS2Wn653RZrKx1IzO7wZdJciXVVQ2itlobrHZ3k1tIl9mwVgHCQywy7da0WMI2yQGl8Z93a1p1k CYy6XY9O0phx3Dme2txwsyS9JChf4gkwQ0eBw2hSgxVzhJROcIKVoPskhxIUX7SNlXSWzIiS8+gJ iPvUYMSRSDcJ8UnnFvaZvQMhHRLLJP0L2ZWLU4PJ9URnk+2WU+TX52oT6HefuR98HmXy6svc6/1q Y6lANHmvb+5kI93D30rv5775P6NybVoKZW5kc3RyZWFtCmVuZG9iago1IDAgb2JqCjczNTUKZW5k b2JqCjIgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAzIDAgUiAvUmVzb3VyY2VzIDYgMCBS IC9Db250ZW50cyA0IDAgUiAvTWVkaWFCb3ggWzAgMCA3OTIgNjEyXQo+PgplbmRvYmoKNiAwIG9i ago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+ IC9Gb250IDw8IC9UVDEuMSA5IDAgUgo+PiA+PgplbmRvYmoKMTAgMCBvYmoKPDwgL0xlbmd0aCAx MSAwIFIgL04gMyAvQWx0ZXJuYXRlIC9EZXZpY2VSR0IgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4K c3RyZWFtCngBnZZ3VFPZFofPvTe90BIiICX0GnoJINI7SBUEUYlJgFAChoQmdkQFRhQRKVZkVMAB R4ciY0UUC4OCYtcJ8hBQxsFRREXl3YxrCe+tNfPemv3HWd/Z57fX2Wfvfde6AFD8ggTCdFgBgDSh WBTu68FcEhPLxPcCGBABDlgBwOFmZgRH+EQC1Py9PZmZqEjGs/buLoBku9ssv1Amc9b/f5EiN0Mk BgAKRdU2PH4mF+UClFOzxRky/wTK9JUpMoYxMhahCaKsIuPEr2z2p+Yru8mYlybkoRpZzhm8NJ6M u1DemiXho4wEoVyYJeBno3wHZb1USZoA5fco09P4nEwAMBSZX8znJqFsiTJFFBnuifICAAiUxDm8 cg6L+TlongB4pmfkigSJSWKmEdeYaeXoyGb68bNT+WIxK5TDTeGIeEzP9LQMjjAXgK9vlkUBJVlt mWiR7a0c7e1Z1uZo+b/Z3x5+U/09yHr7VfEm7M+eQYyeWd9s7KwvvRYA9iRamx2zvpVVALRtBkDl 4axP7yAA8gUAtN6c8x6GbF6SxOIMJwuL7OxscwGfay4r6Df7n4Jvyr+GOfeZy+77VjumFz+BI0kV M2VF5aanpktEzMwMDpfPZP33EP/jwDlpzcnDLJyfwBfxhehVUeiUCYSJaLuFPIFYkC5kCoR/1eF/ GDYnBxl+nWsUaHVfAH2FOVC4SQfIbz0AQyMDJG4/egJ961sQMQrIvrxorZGvc48yev7n+h8LXIpu 4UxBIlPm9gyPZHIloiwZo9+EbMECEpAHdKAKNIEuMAIsYA0cgDNwA94gAISASBADlgMuSAJpQASy QT7YAApBMdgBdoNqcADUgXrQBE6CNnAGXARXwA1wCwyAR0AKhsFLMAHegWkIgvAQFaJBqpAWpA+Z QtYQG1oIeUNBUDgUA8VDiZAQkkD50CaoGCqDqqFDUD30I3Qaughdg/qgB9AgNAb9AX2EEZgC02EN 2AC2gNmwOxwIR8LL4ER4FZwHF8Db4Uq4Fj4Ot8IX4RvwACyFX8KTCEDICAPRRlgIG/FEQpBYJAER IWuRIqQCqUWakA6kG7mNSJFx5AMGh6FhmBgWxhnjh1mM4WJWYdZiSjDVmGOYVkwX5jZmEDOB+YKl YtWxplgnrD92CTYRm40txFZgj2BbsJexA9hh7DscDsfAGeIccH64GFwybjWuBLcP14y7gOvDDeEm 8Xi8Kt4U74IPwXPwYnwhvgp/HH8e348fxr8nkAlaBGuCDyGWICRsJFQQGgjnCP2EEcI0UYGoT3Qi hhB5xFxiKbGO2EG8SRwmTpMUSYYkF1IkKZm0gVRJaiJdJj0mvSGTyTpkR3IYWUBeT64knyBfJQ+S P1CUKCYUT0ocRULZTjlKuUB5QHlDpVINqG7UWKqYup1aT71EfUp9L0eTM5fzl+PJrZOrkWuV65d7 JU+U15d3l18unydfIX9K/qb8uAJRwUDBU4GjsFahRuG0wj2FSUWaopViiGKaYolig+I1xVElvJKB krcST6lA6bDSJaUhGkLTpXnSuLRNtDraZdowHUc3pPvTk+nF9B/ovfQJZSVlW+Uo5RzlGuWzylIG wjBg+DNSGaWMk4y7jI/zNOa5z+PP2zavaV7/vCmV+SpuKnyVIpVmlQGVj6pMVW/VFNWdqm2qT9Qw aiZqYWrZavvVLquNz6fPd57PnV80/+T8h+qwuol6uPpq9cPqPeqTGpoavhoZGlUalzTGNRmabprJ muWa5zTHtGhaC7UEWuVa57VeMJWZ7sxUZiWzizmhra7tpy3RPqTdqz2tY6izWGejTrPOE12SLls3 Qbdct1N3Qk9LL1gvX69R76E+UZ+tn6S/R79bf8rA0CDaYItBm8GooYqhv2GeYaPhYyOqkavRKqNa ozvGOGO2cYrxPuNbJrCJnUmSSY3JTVPY1N5UYLrPtM8Ma+ZoJjSrNbvHorDcWVmsRtagOcM8yHyj eZv5Kws9i1iLnRbdFl8s7SxTLessH1kpWQVYbbTqsPrD2sSaa11jfceGauNjs86m3ea1rakt33a/ 7X07ml2w3Ra7TrvP9g72Ivsm+zEHPYd4h70O99h0dii7hH3VEevo4bjO8YzjByd7J7HTSaffnVnO Kc4NzqMLDBfwF9QtGHLRceG4HHKRLmQujF94cKHUVduV41rr+sxN143ndsRtxN3YPdn9uPsrD0sP kUeLx5Snk+cazwteiJevV5FXr7eS92Lvau+nPjo+iT6NPhO+dr6rfS/4Yf0C/Xb63fPX8Of61/tP BDgErAnoCqQERgRWBz4LMgkSBXUEw8EBwbuCHy/SXyRc1BYCQvxDdoU8CTUMXRX6cxguLDSsJux5 uFV4fnh3BC1iRURDxLtIj8jSyEeLjRZLFndGyUfFRdVHTUV7RZdFS5dYLFmz5EaMWowgpj0WHxsV eyR2cqn30t1Lh+Ps4grj7i4zXJaz7NpyteWpy8+ukF/BWXEqHhsfHd8Q/4kTwqnlTK70X7l35QTX k7uH+5LnxivnjfFd+GX8kQSXhLKE0USXxF2JY0muSRVJ4wJPQbXgdbJf8oHkqZSQlKMpM6nRqc1p hLT4tNNCJWGKsCtdMz0nvS/DNKMwQ7rKadXuVROiQNGRTChzWWa7mI7+TPVIjCSbJYNZC7Nqst5n R2WfylHMEeb05JrkbssdyfPJ+341ZjV3dWe+dv6G/ME17msOrYXWrlzbuU53XcG64fW+649tIG1I 2fDLRsuNZRvfbore1FGgUbC+YGiz7+bGQrlCUeG9Lc5bDmzFbBVs7d1ms61q25ciXtH1YsviiuJP JdyS699ZfVf53cz2hO29pfal+3fgdgh33N3puvNYmWJZXtnQruBdreXM8qLyt7tX7L5WYVtxYA9p j2SPtDKosr1Kr2pH1afqpOqBGo+a5r3qe7ftndrH29e/321/0wGNA8UHPh4UHLx/yPdQa61BbcVh 3OGsw8/rouq6v2d/X39E7Ujxkc9HhUelx8KPddU71Nc3qDeUNsKNksax43HHb/3g9UN7E6vpUDOj ufgEOCE58eLH+B/vngw82XmKfarpJ/2f9rbQWopaodbc1om2pDZpe0x73+mA050dzh0tP5v/fPSM 9pmas8pnS8+RzhWcmzmfd37yQsaF8YuJF4c6V3Q+urTk0p2usK7ey4GXr17xuXKp2737/FWXq2eu OV07fZ19ve2G/Y3WHruell/sfmnpte9tvelws/2W462OvgV95/pd+y/e9rp95Y7/nRsDiwb67i6+ e/9e3D3pfd790QepD14/zHo4/Wj9Y+zjoicKTyqeqj+t/dX412apvfTsoNdgz7OIZ4+GuEMv/5X5 r0/DBc+pzytGtEbqR61Hz4z5jN16sfTF8MuMl9Pjhb8p/rb3ldGrn353+71nYsnE8GvR65k/St6o vjn61vZt52To5NN3ae+mp4req74/9oH9oftj9MeR6exP+E+Vn40/d3wJ/PJ4Jm1m5t/3hPP7CmVu ZHN0cmVhbQplbmRvYmoKMTEgMCBvYmoKMjYxMgplbmRvYmoKNyAwIG9iagpbIC9JQ0NCYXNlZCAx MCAwIFIgXQplbmRvYmoKMTMgMCBvYmoKPDwgL0xlbmd0aCAxNCAwIFIgL0ZpbHRlciAvRmxhdGVE ZWNvZGUgPj4Kc3RyZWFtCngB7Vxtj9y2Ef7OX6HU9VaXddYrrfatl+Ra2+dLY6Nu0ksdJ04/1G1Q FHEBN/8f6PDleUiJI610u+sESOIAty/kkBzOPM/MkNp3xRfFu2LdFPVms9jtllXx1r5bN8vFcinv fig2+3pRbZRP2OOH4t/FS/Pf4uHjH6vizY/FcrFZbnfNqpZX25X7T16tmv2y2m+KH98UKxmr2cmQ 20VVyyCb9aKWt9t60RT/+5f5/oRzSle2We3sSurtSoaVgYqXRTLpYin/ZHLvZK514965F9WuqHZW GcutefO2eHRbNLIw+Sd/qs2yqKt6Xdy+LR7e3laLqqiK2++Lb4vy9y8urKCivLwovituPy+ub2VZ HWWbOypb5t27MHOHhRXdhdW7vVuYyRdW23U1Rbm/KD5qv/id+6Qqyldo85Vtuy5K/96UbLFwTUU7 D92LVVFWELeDlN+4F9KbI90PQz+4MG7k+YxtBuRwUEqGnHtWXmXKITHsPeMQ/AjL/DrM69WF6d3q 6X5lnF8NbfVpbLgKe60Y8XyJXRFFd5dmCAA/Lyt2yLUqbt+kjtoET+0adPnBn5uL4vY/qnse2jPZ oYCOVMWd98wM4E7mntV2VfUBz/3gHHSoT7CHc37kDb8o4QgfWgMWb8R7Npx1LbrZbxdL4Ye68Wyx aRbL3XIpUNgsqvV+v+23SfHZHlzN1ldbiT3AGtDAlA+C183XboEy/dkVXhEXsKIZG7EN4eCe1ZjA FjtBHWza8gNBPQGlJxEPCAwfu+HXpqToa+iesvMJsQ3lYGWfdrXfC/r9WrcbO8hmzl2atrvUwpF9 +q9kBaKsbQIII2xXlCYMWneG2Sy7wxjHn+XTm8vnVzcv5P/onJMcxLr7clN33T0l5qfJCoZY31un iazvyFGEK4A5jteMNyGF12S3hFpJMDDE+W+DrdOMgoea8lP7jfAn+9D2YGmwppehZffz0DM6FO2Q L2b90ucQD0z55MIuT1aBcTghCqFc0ks/A5tyLm4VuWeSFThqa+2Uty8xg5ZL31G8IxXdyoRURAuC SVBPglLUw43dEWnzPPy9cqqTD9h748SIuyGS+tt4XRgJVTXn9uTR0gqj1r137rX/I1sqQ/dywHK/ 2G5s+H5GDtCnGezGlOQ2OkbA4KK8BvSyzesLfBT57UmwxWj9cxgyJcGQKREtaMfipzQh04nxi1Ol HdpeeqDWlXRyoG4N0wHqy2/vDtTVfr8fAmpxD2rXZVC79WJfF82+WWwasb+6WtuYxEYgGyFCMzWt y8MPiYh7JjUO4K3vtxMXn7AADIgApAB8Q5MiNPJFMHETU6V+7KfNUx4GiDESgTrGhZwOJ0hPoaCZ nnUF0GdHxlvsiBmwieZGgoem5JIzF3wMPKQQUGR0bnYSUglMy0AOHGg5xe9R7Ac3z5Uwn82QchJn /gQsiQJmkCCM1zbY3rjtiGRdpu8qNO08xzJej+nee/jg/tXunjUNQfX7H87TWQ7Qaqh6uOG0tMoO 1w2F2mnVSOGdINTxlCZc2HsKTxEnWjxlkeL4ApBLVPrmCAuB4SchAJme9gTbGU5UhNBl79jJG78p ad+ZS2FsiGdLRmXoEiDDMG6DZ80HUp1iONXxqBeXdA2VZKAgUHZ+l+ll0B6PURj0cKJgccWmOqbl mLVNdTRDCanOt1c3UihEHeKww8RsxNYgq/1q03XBNNV5kWp3inCb6vQIR/GLcMkXAZtN+Y8Q174u 3b4LI2bxLHG8zx5tHuHNiPbIpuw8mmxMLDh2PYPCKL7jGTGjgdvN2acrjDJo6JEm0BbisT7pE11g YJNCuDKE/6uNEk+dD/9z45uK/4k529JWj8kBxBiUMMyRECYEIFGrgpWShcJqsr6zVN02Zg+lrWa7 X6zdqUSa1myOYOq4uEAX6vbQfWAfLboI2SSRH8sRbLULl5yxH9nZCbpgUygrWGlMgiCeLWnQ6ELV oymEO7qwc5KiBK2f4RblXIMKODsIyuhCcdrxdNGheWNPbg6d8wQPG6ALZ/Gmc+RzerpQHMtXxl6/ vnoq9as788VO6nv50Q7PrCSZGwVF2YGY4wtd+BfYcBY3wCBfW5poktMhmhITAb6gtRADWqYwAJth rgOwqc87h83kkGdgvNSI1LBZhuui9GjYzFJWHywrIiUMgGNRZfTdmPnBrdHWb0EMBtm3FzYlum7s iXF/lG3s2fB49+vCZmt7WMejZWDmzMKAo9cwPKTLtCHfRc7/nj3JjBLGGWOXVxTExq1qnHCI6U30 OjA0Sg9p4tXJjVzdp2pphDU8BYaOKtC3h2nVfQSGnt+MgqHcYG3YuquWXRdIw9YvUxiyFB0KP81e 7gucrfCjT4qFH1IZK9+0J4ahHzlEs0V5S4Q22w4fwCbxlwSJDwYiyiCKBs++9E2SK4bjBxQLjzfx VD1+x6XxBceQ4x4XZbAxB33o1pie4DNoePOBcz35ji881ifHFZiqV0CMQDhyphlAFVswcoIsWfZ3 pufKxcnKsRGeKld0EbNRKHX6MUPq9Tpv5AON5o1UeAdSAoPkwqeWW+Cd/UTgLgmNIIIw26hpHz/r msYRGYyANhxemBJeed0lBJgYHfnZM/aGuCf0pTnLimyU+yRF0U9mHLZjwMbmKDHceu/HBxaFFcs9 PY2kw5yURrbNdohGXr9O9XswZOuc9FYiXVEP4gNbGvaZJrc8LQ1b0JYslEEJ8ZOtaSAZjD12dhrr fe3Kf7SYgytKL8I4rNIVNh2rPKtLeUYKXipWKbqbilXR+z1CKSIPxbhhE+B3cGmkGXjPneiNcVf2 iCmLcU9YGtA3hvDCwJ3WQwgiurCNVJzCwuPCcNyZnEtDK5QEdVCib5Fk4UfilRm+ZZkmTh2O8mFv ywKYCCh4Nb5Yq9xLsX7fRZVQrP3s6nJcsVaPeje7pis4jXpvj0IrEa6gFeuuNCXsMtDLnupZc5Ei LQMr2g25j/CFeJCGOKPdhTamlOxIBEr0RyAjDFJyBnr8gENJBhYmBlPlUFgEPDkWZHvh2ZQpPNsJ pvBsI0de1j2IqwlT+BhQV/50XM0Cn8peNal08X8I/JNv2x/tNyvJb6nLR25LZI+5b7I3U1as1cQ8 LuuT0w/q3JCGN6JRea32co6fwesRqXPkDh859swR8SB9gYmcnJZb25PyKhUGm4tlSuY7dBMYKjt5 A00O6lo24d1u0jGbGZoQkZsmgZW1imWDkeYRpKbZiEdu0b+CfEcht3bMpmzzVOTOPdA5YC3XE/uv +n820pcy4a5sulGFw9wAuHTl75zVym0JtMgxlfbITpBCw4yw/XdYOhvTC9iaMQKBHIbFTrB09uEk +IJfccYtsxyA3UxxAXZVzbVcbBTG5eI97KriWQSECpLzGtZ9bkLZ5Hn4S6hgbzLzV7aJIHOrpnhY F5qzBUBWp60DclLStqgAQF6u5KLVWQFZn+OvgOwexWrdHDwPINfVewHkfJsjIEu8e+dzrPV6pwGy nF850hb3i44fC8ir3W4hDy20bw4eod8kzLD3JWRSilIfZaHXCDTdOVBOCsiMdImd8eo0og4CLUE5 BNVJCgfSyNtSMIOHGD7Ga3MfIyZnK1ALByV9sAmQstskCWb6daKyRvvqe16K5kjQDecCRTIh4she NSZmLRSSt81vdUQVsdvP8vpgtFnPobrRTufQUBJKxDsO1R2VLAjLaHGoTc7k6bybn5BD9WlP4VBi zdnK4T1z/JVD3xOH6p5z8qRG2WbPoZc3VzfH3AVp9urzy+BQqXRFDj0cj0bHd0mNLpxcSDgGACB9 iDBK3H8GziKwkrzwDY9kAfe8404ppDfcBqA01oVwTsRvwjimjGJD4QgDg00m3qmOyvIgrGtrOgj3 JDK6+GEQtuUPiT/OD8KJLtwVQH2yUDi3kbXAE14BXMkvBGzsBYM2Zp8mQvQPy+7XSojI2ie8IaFD Zo60ZKjiuCuALeOyhSgz9Gjrgfve/iAMlTETn8HK/LyV8Q8Wolz5L/11iREHxwePEMS4FP2fHLMV Gw6YfXl1IwB757zH/riGUogCZgsdRMxO8p71brG251fpE1OnsWqb98ikFKXGC1Q0AqAlLJhAiy+C jScHnuwL12AflqIeu4hHsGoWo3LQSHK5MMNwXIkp+Cwt5kV++WuozYRB5ZlUJjccPptYPIzAV5D7 0oqTcxGeuOCLLIfisjleXDeRz/dOlngTImYxg/alHS6ImQxGhlakxfmvzgjM9D26pBv2kXcwE2px yUhrEB4gDvOgS0ZaPBg9bEpU5GtzrRnw5h4247zkBhA4H7mpOPBTkBusOrhRvF0GTZNV6Rno0vGu +CDBL+F+uzfPs99vV7yA9PhUDlPuTI+rTfZEoj1hBz0+76HHZrVoug8Un44eZVKD9NiLyYR8uhAe GSIrMCgkdMDCadiU8o1lBaHJcKM1KQqyMztFJgU1Qy44DdKCeP14nWNHeRwCAvkBJcWzKbShHBAl +RHToYrY9Jvw6y5wbNb5qDNI5/JnnUVJSBHgICIIR45LQkZJ6OAclMZSVA2pFWTHW8LsR5302sa1 N+V4ln6OG+gJf7rrY7p7tTKJO5Kjo2dd/DA952nqqBkMJAqeqHWn1QuAnZg7HKKtgCpn49ueOQ4W AG0403OrIVx46KdGOg4wgU1bJvCLSSZ1/Z88mVTc4kRsuVQfHgZbvuhhy3q3WNnD4fMkk6ul9gwr rnURxImQhFiCJ6lgAluycy8oxyIgRwT3gEcopPtFd7KmjOSBtqCpTBgoj+yCFoG2kvwPstCCYQI+ 6DYg8/nRk/M4fgNy4+LcqZYv+BAQWELFuuTuGcaUxUdIPlzx6f4057hLoxlTKaYt2TvpVGYeJzWQ xuUXOT1TqUY6zFS9iaT74SBBZf3X2g4zVbpUJrWTmAoefT6mUvVFR4VZJtUVUgttDPb0a9nTFnfk Z4/i79MO2Ii/f6eD6umZKjVFX904DVPVjfrYMphK/o7y5ux4xB1V6cIPP8Nmys9hk7RkWitMGi0A 78mdCkLs3mUEch2ZGJvRHeXOySVsHAutgr42iBNJBDq+yFir9bDDAARmSvNHVrrWpiNsLt4hrC5+ GGGPywUSCnHnUDIDJW3HfnLzSMuxnIy9RlsfLisXNltbYKkRqUO1WsjF5e45VHoh+shnqlvqJWnQ WLgo2h0Dr2ukF2wDzre/5RzMb3bE8yZ8DuEnfz6upSQWaxXUPO4x69Ywfi8Caj69upRS/ohqWB6m 2FvL1U59yhqo+WWKmvGwqN7Lr56f7ylrfVJ/4S+dwmkIb0g2o3/NEZMiwAfYss+oGDV/Ok+J8enn xF26BD9hqMvGsciD6J29YoLB2RKa43fQgl9ZEuL/MxztYMloyFCfUnUdBAeNPsvJT47TDX/3f/zJ 7MAJkG4Y+QnQHaneP0kjgyjnp+eklf572vqCpwTudNWzBe49cwQHwArfQ+AOUg3OEguy8ABmDPRL dCFToSkhxT56Yz1CzmTphGQ6yrnGcunEEIQbD/zV2aSoDt1MvPEQ89/T/GSRt/izH+kojmVJTH7J W248JEc6X/wfK/MagQplbmRzdHJlYW0KZW5kb2JqCjE0IDAgb2JqCjQxNTgKZW5kb2JqCjEyIDAg b2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMyAwIFIgL1Jlc291cmNlcyAxNSAwIFIgL0NvbnRl bnRzIDEzIDAgUiAvTWVkaWFCb3gKWzAgMCA3OTIgNjEyXSA+PgplbmRvYmoKMTUgMCBvYmoKPDwg L1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRm9u dCA8PCAvVFQxLjEgOSAwIFIKPj4gPj4KZW5kb2JqCjMgMCBvYmoKPDwgL1R5cGUgL1BhZ2VzIC9N ZWRpYUJveCBbMCAwIDc5MiA2MTJdIC9Db3VudCAyIC9LaWRzIFsgMiAwIFIgMTIgMCBSIF0gPj4K ZW5kb2JqCjE2IDAgb2JqCjw8IC9UeXBlIC9DYXRhbG9nIC9QYWdlcyAzIDAgUiA+PgplbmRvYmoK OSAwIG9iago8PCAvVHlwZSAvRm9udCAvU3VidHlwZSAvVHJ1ZVR5cGUgL0Jhc2VGb250IC9ZRVJC RkwrQ2FsaWJyaSAvRm9udERlc2NyaXB0b3IKMTcgMCBSIC9Ub1VuaWNvZGUgMTggMCBSIC9GaXJz dENoYXIgMzMgL0xhc3RDaGFyIDEwMCAvV2lkdGhzIFsgNDg3IDIyOSA0MjMKNDU1IDQ5OCAzMzUg MjI2IDQ1OSA1MjUgNzk5IDQ3OSAzNDkgNDUzIDUzMyA1MjcgNTI1IDUyNSA1NzkgMzg2IDYxNSAz MDUgNjYyCjcxNSAzOTEgNTI1IDQ5OCA1MDcgMjI5IDUyNSA0NzEgMzA2IDg5MCAyMjEgNDU5IDQz MyA4OTQgMjUyIDUwNyA1MDcgNTA3IDUyNQo1NDMgMzk1IDUwNyA1MjUgNTQ0IDUwNyA4NTUgNDIw IDUwNyAyNTAgNTA3IDY0NiA0ODggNDUyIDUxNyAyNTIgNDAxIDUwNyA1MDcKMzAzIDMwMyAyNjgg NjMxIDQ2MyAzMTkgNjIzIDUwNyBdID4+CmVuZG9iagoxOCAwIG9iago8PCAvTGVuZ3RoIDE5IDAg UiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAFdlMuO2kAQRff+il5OFiMauxsGybIU TTQSizwUkg8wdpuxFIxlzIK/z7kFmSSzOEiXerhuud2L5+2n7dDPbvFtOjW7NLuuH9opnU+XqUlu nw79kC1z1/bNfFf2X3Osx2xB8e56ntNxO3QnV5aZc4vvlJzn6eoePranffqg/75ObZr64eAefj7v 7J/dZRx/pWMaZuezqnJt6mj3uR6/1MfkFlb6uG2J9/P1kaq/GT+uY3JMRMXyNlJzatN5rJs01cMh ZaX3VfnyUmVpaN+F7gX7rnmtp6zM1xXJfuP4afnJPT+1t8p7zruKolNFruS6dblf/pcc/W2gfXef JF9WpfA+horn5UjwfrWRLJCALCQDEpB7yYgEZJRcIcH7tbV6QgKdrXaDBKKWXCOB2la1eyQgl5IN EkjOJVskIG2qhATvg3XGccFCqe1ILnAjkEkSN4JkdS5wI1iRJeOmMEdBMxe4EdSuJHEjqLVkXkZh L2S9VhRzgqk0RoE5Qa21wlxhBlkgUcwJ75kNiTlBciOJOYF8ksScQOpBAXOCTZrEHF6QnA6imBMM qZlZicFUaoUtgygHoQyYE9RqOVQYTKU9B8wJpCVjLphBfBHFnGAqS8ZcMIPRJOaCGVzXSsacoJXs B8wJppL9gDnBVFbLG2TDStbqIl4FUZ2NiFeB1K54mkGy/HK4DBxZFL+cZLWS/YhXQS1++dz+HPxl ePchRFYhyNT5ZNMGA9tTWEO0VTAYUdYgSNZmImsQzCA7kTUIZrBWrCHeVqH3FVlDNO98HUh8C5K1 txW+BZ2VzNdgENUJZPEGUUvGOx+mktWKc2cwBmv8x6yuGV2Hb9dXc5kmbi67M+1S02XVD+ntWh1P oxoYvwGnQmDACmVuZHN0cmVhbQplbmRvYmoKMTkgMCBvYmoKNjYwCmVuZG9iagoxNyAwIG9iago8 PCAvVHlwZSAvRm9udERlc2NyaXB0b3IgL0ZvbnROYW1lIC9ZRVJCRkwrQ2FsaWJyaSAvRmxhZ3Mg NCAvRm9udEJCb3ggWy01MDMgLTMwNyAxMjQwIDk2NF0KL0l0YWxpY0FuZ2xlIDAgL0FzY2VudCA5 NTIgL0Rlc2NlbnQgLTI2OSAvQ2FwSGVpZ2h0IDYzMiAvU3RlbVYgMCAvWEhlaWdodAo0NjQgL0F2 Z1dpZHRoIDUyMSAvTWF4V2lkdGggMTMyOCAvRm9udEZpbGUyIDIwIDAgUiA+PgplbmRvYmoKMjAg MCBvYmoKPDwgL0xlbmd0aCAyMSAwIFIgL0xlbmd0aDEgMzMxMTYgL0ZpbHRlciAvRmxhdGVEZWNv ZGUgPj4Kc3RyZWFtCngB1b13fFTH2TY8s2d777valXZXWmlVVr0XkBY1kIQACQQSIJDoYHo3YIyN K7bj7sS9xMEFxxYCjDBJjBMSp2E7jmOn2bGfFDtOcOx0F0nfNTM7QjjJ876/3/dPXolrr2vmFJ25 p98zZ9m+dcdKYiIHiEKKl28Y3Ez4T/kZ0EPLd26P8CDJWkOIJnXV5tUbRDjvKkIMgdXrL10lwhV/ JaSjdc3KwRUiTD4DV65BhAjTcnDmmg3bd4tw2UOE0Mj6TcuTxysGEH/bhsHdyb9PfolwZOPghpVg /FwxBR+RzVtXJo/TXtzOTgk5sHH74Hp+Cv840ICoC8AJZAaNEDv5FtERFbiI4I6OW+iVRE0ofpGs B0Zu+scPHEttU/5GUvT8Lqf/sO+HTLx47eM3fPrJ6A2GP+qeRdCAO4gfXKd7YPTnhBgf+vSTTx4y /JHfKXmQ04xhgxIZUV113OCn7RAHpbhSiiukOCDF5VLsl+IyKfZJsVeKPVJcKsVuKXZJsVOKHVJs l2KbFFuk2CzFJik2SrFBivVSXCLFOinWSrFGitVSrJJipRQrpFguxTIpBqUYkGKpFEuk6JdisRSL pFgoRZ8UvVIskGK+FD1SzJNirhTdUnRJMUeK2VLMkqJTiplSdEjRLkWbFDOkmC5FqxQtUjRL0SRF oxTTpEhI0SBFvRRTpZgiRZ0UtVLUSFEtRZUUlVJUSFEuRZkUpVKUSFEsRZEUhVIUSJEvRVyKPCly pciRIluKmBRZUmRKEZUiQ4p0KSJShKUISZEmRaoUQSkCUqRI4ZfCJ4VXCo8UbilcUjilcEhhl8Im hVUKixRmKUxSGKUwSKGXQieFVgqNFGopFClUUlApSFLQcSnGpBiV4jMpPpXiEyk+luKfUvxDir9L 8Tcp/irFX6T4sxQfSfGhFH+S4gMpzkvxRyn+IMX7UvxeivekeFeK30nxWyl+I8WvpfgfKd6R4m0p fiXFW1K8KcUvpfiFFD+X4mdS/FSKN6R4XYqfSPGaFD+W4lUpfiTFK1K8LMVLUpyT4odS/ECK70vx PSm+K8WLUnxHim9LcVaKb0nxTSlekOKMFM9L8Q0pvi7F16Q4LcVzUpySYkSKk1I8K8UJKY5LcUyK YSmOSjEkxTNSPC3FV6V4SoojUjwpxRNSPC7FY1IcluIrUjwqxZeleESKh6V4SIoHpXhAivuluE+K e6W4R4q7pfiSFF+U4i4p7pTiDilul+I2KW6V4hYpbpbiC1LcJMWNUtwgxSEprpfiOimuleIaKa6W 4iopDkpxpRRXSHFAisul2C/FZVLsk2KvFHukuFSK3VLskmKnFDuk2C7FNim2SrFFis1SbJJioxQb pFgvxSVSrJNirRRrpFgtxSopVkqxQorlUiyTYlCKASmWSrFEin4pFkuxSIqFUvRJ0SvFAinmS9Ej xTwp5krRLcUcKWZLMUuKmVJ0SNEuRZsUM6SYLkWrFC1SNEvRdIyNljFqHg7VhzFmHg55QFeK0BXD oVqEDojQ5YL2D4fMiLxMhPYJ2itoj6BLh9Om4ZTdw2lNoF2CdgraIY5tF6FtgraKyC3DaY24YLOg TYI2ilM2CFov6JLh1BacuU7QWkFrBK0WtGo4tRmnrBShFYKWC1omaFDQgKClgpaI6/pFaLGgRYIW CuoT1CtogaD5gnoEzRM0V1C3oC5BcwTNFjRLUKegmYI6BLUPB9uQhjZBM4aD7QhNF9Q6HOxAqGU4 OBPULKhJUKM4Nk1clxDUIK6rFzRV0BRxZp2gWnF5jaBqQVWCKgVViJuVCyoTdykVVCKoWNysSFCh uK5AUL6guKA8QbmCcgRli1vHBGWJe2YKigrKELdOFxQR14UFhQSlCUoVFBQUGA7MgrFSBPmHA7MR 8gnyikiPILeIdAlyCnKIY3ZBNhFpFWQRZBbHTIKMggzimF6QTpB2OGUO/rpmOKULpBakiEiVCFFB hBMdFzTGT6GjIvSZoE8FfSKOfSxC/xT0D0F/F/S3Yf+88Aj967B/LugvIvRnQR8J+lAc+5MIfSDo vKA/imN/EPS+iPy9oPcEvSvod+KU34rQb0To1yL0P4LeEfS2OPYrQW+JyDcF/VLQLwT9XJzyMxH6 qaA3hn0LkJTXh33zQT8R9JqI/LGgVwX9SNAr4pSXBb0kIs8J+qGgHwj6vjjle4K+KyJfFPQdQd8W dFbQt8SZ3xShFwSdEfS8OPYNQV8XkV8TdFrQc4JOCRoRZ54UoWcFnRB0XNCxYW8DEj087F0EOipo SNAzgp4W9FVBTwk6IujJYS9affqEuMvjgh4Txw4L+oqgRwV9WdAjgh4W9JCgB8XNHhB3uV/QfeLY vYLuEXS3oC+JC74oQncJulPQHeLY7eIutwm6VRy7RdDNgr4g6CZBN4ozbxChQ4KuF3SdoGsFXTPs GUTarx72LANdJejgsGcVQlcKumLY04PQgWEPOht6+bCnErRf0GXi8n3iur2C9gx7VuCUS8XluwXt ErRT0A5B2wVtE7feKi7fImjzsGc57rJJ3GyjOHODoPWCLhG0TtBacd0aQavFk60Sl68UtEKcuVzQ MkGDggYELRW0RCS6XzzZYkGLRKIXilv3iT/UK2iBeNz54g/1iLvMEzRXULegrmF3AgmbM+xmZp09 7GYVdtaw+yCoc9hdAJopTukQ1D7sxkCCtonQDEHTRWTrsHs/jrUMu68FNQ+7Lwc1DbsPgBqHna2g aYISghoE1Q87MS6gU0VoyrCjD6E6QbXDDlaPagRVDzumI1Q17OgFVQ47FoIqxLFyQWXDjnxElooz S4YdLGHFww7WIBUJKhSXF4i/kC8oLm6WJyhX3CxHULagmKCsYQezUqagqLhnhrhnurhZRNwlLCgk rksTlCooKCggKGXY3o97+oftS0C+YftSkFeQR5BbkEuQU1zgEBfYRaRNkFWQRZBZnGkSZxpFpEGQ XpBOkFacqRFnqkWkIkgliAoiiXHbsjDDmG15eNS2IvwZ9KfAJ8DHiPsn4v4B/B34G/BXxP8F+DOO fYTwh8CfgA+A84j/I/AHHHsf4d8D7wHvAr+zrg7/1rom/Bvg18D/AO8g7m3wr4C3gDcR/iX4F8DP gZ8BP7VcEn7DUhJ+HfwTy/rwa5ZY+MfAq9A/ssTDrwAvAy/h+DnE/dCyIfwD6O9Dfw/6u5Z14Rct a8PfsawJf9uyOnwW134L9/sm8AKQGD+Dz+eBbwBfN28Jf828NXzavC38nHl7+BQwApxE/LPACRw7 jmPHEDcMHAWGgGdMl4afNu0Jf9W0L/yU6bLwEdP+8JPAE8DjwGPAYeArpoLwo+AvA4/gmofBD5ku CT8I/QD0/cB90PfiXvfgXnfjXl9C3BeBu4A7gTuA24HbcN2tuN8txlnhm42zw18wrg7fZPxK+Ebj Y+GrlazwVUp1+CCtDl/Zc6DniiMHei7vuaxn/5HLekyXUdNlwcs6Ltt72ZHLfnFZwqk17uvZ07P3 yJ6eS3t29ew+sqvnOdU1ZJXq6sSUnp1HdvSod7h3bN+h/HUHPbKDNu+gxTuoiuyw74jsUMzbe7b2 bDuytYdsnbP1wNahreq6oa1vb1WRrdQ4Mn7m2NZgqBWc2LfVYm/d0rOpZ/ORTT0bV23oWYcHXFu9 umfNkdU9q6pX9Kw8sqJnefWynsHqgZ6l1f09S4709yyuXtiz6MjCnr7q3p4FOH9+9byeniPzeuZW d/V0H+nqmV09q2cW4jurO3pmHunoaa+e0dN2ZEbP9OrWnhYknqTaUyOpip09wKxUPAkJ0sbiYCL4 dvDDoJoEh4JngorTFggHVLm2FNo0O4VuSrk85eYUxeZ/2a9K+HPzW22+l32/8v3Jp3YlfLmFrcRr 90a8ioelzds5j6XtmLehWXBJBU9rpzcaa7V5qM0T9qhawh5KHG87PnQonuftL9tVNhu12cZtqoQN p9usYauKfYxblYS1pKrVZglbVOxj3KJ4ExbEsIfPNs+Z12ozhU2qngbTbJMqYWpoak2YCopbiUIj FCs/dpCiZ09DPeHWEUqOeamGjtBbjs6bG493jOhJd8eQfs6iIXrdUNZc9pnoWjikvW6I9Cxc1HuU 0i/0HaWqpnlD7o6uhSJ89U03kca0jqG0ub1DD6X1dQwdgEgwMQ5B0o56SWNffMm2Hdvi8e1L8LFk 2/Y4/4cQ3cFC+MEB/Nu2HWH2C0KYsCP/+UechvOWbsMPv424+3++5P+BI/T/gWf8L3/EowRFtHfa uOoqskJ1ELgSuAI4AFwO7AcuA/YBe4E9wKXAbmAXsBPYAWwHtgFbgM3AJmAjsAFYD1wCrAPWAmuA 1cAqYCWwAlgOLAMGgQFgKbAE6AcWA4uAhUAf0AssAOYDPcA8YC7QDXQBc4DZwCygE5gJdADtQBsw A5gOtAItQDPQBDQC04AE0ADUA1OBKUAdUAvUANVAFVAJVADlQBlQCpQAxUARUAgUAPlAHMgDcoEc IBuIAVlAJhAFMoB0IAKEgRCQBqQCQSAApAB+wAd4AQ/gBlyAE3AAdsAGWAELYAZMgBEwAHpAB2gB DaCeNo5PBVABFCBkBUUcHQNGgc+AT4FPgI+BfwL/AP4O/A34K/AX4M/AR8CHwJ+AD4DzwB+BPwDv A78H3gPeBX4H/Bb4DfBr4H+Ad4C3gV8BbwFvAr8EfgH8HPgZ8FPgDeB14CfAa8CPgVeBHwGvAC8D LwHngB8CPwC+D3wP+C7wIvAd4NvAWeBbwDeBF4AzwPPAN4CvA18DTgPPAaeAEeAk8CxwAjgOHAOG gaPAEPAM8DTwVeAp4AjwJPAE8DjwGHAY+ArwKPBl4BHgYeAh4EHgAeB+4D7gXuAe4G7gS8AXgbuA O4E7gNuB24BbgVuAm4EvADcBNwI3AIeA64HrgGuBa4CryYppB+hVUAeBK4ErgAPA5cB+4DJgH7AX 2ANcCuwGdgE7gR3AdmAbsBXYAmwGNgEbgQ3AeuASYB2wFlgDrAZWASuBFcByYBkwCAwAS4ElQD+w GFgELAT6gF5gATAf6AHmAXOBbmAOMBuYBcwEOoB2oA2YAUwHWoEWoBloIiv+y5vp//bH6/tvf8D/ 8ufzL13CdgwRMnb75E1CZA5ZR7aRA/i9htxEbifPk1+QZeQg1N3kIXKYPEGGyAvke+SNi676/xkY u1SzgZiVk0RLXISMfzJ+fuwwMKKxToq5HSGXOnIhZtw+/sHn4j4Yu33cPjaidRIjv9aiehV3+wsd Hf8E/auWWMYrWVh1LbSN/6WPdA+MPTP22EUJmEO6yEKyiCwm/WSADCL9K8gashaWuYSsJxvIRh7a iGOroVchtBRnoS3h+sJZm8hmsolsJdvJDrITv5uhtyVD7NgWHt5BduF3N7mU7CF7yT5yWfJzF4/Z hyN7eOxuHNlPLkfOXEGu5EqyiDlIriJXI9euJdeR65Fj/zl0/cRZh8gN5Ebk8xfIzeQ/6ZsuOnIL uYXcSm5DebiD3EnuIl9CubiX3Pe52C/y+HvIA+RBlBl2xZ2IeZCru8gXydfId8gJ8jR5hjzLbbkc thUWkXZZxS29GTbYhzQfnPTEwpq7Jqy1H9Zg6T6UTPdu2O/KSVfsTNqRWe8gzmTWOZTMB3aXy5Ix 0hK3IGVCX0gnsxFLw80XpVNe8X+KZSlmdroP9pKWYTa7C3H3/Evs5DMm67vI/aiBD+OTWZWpR6CF epDryfEPTJz7ED/2ZfIo+Qry4jHClGQRcxhxj5HHUbefJEfIU/i9oCcrcfRp8lWec0PkKBkmx8hx 5OSz5CQZ4fH/27Fn0HZ8/ppjyXsNT9zlFHmOnEYJ+QY5g5bmm/iVMV9H3PPJ2LP8LBH+JvZSnuVn saPfRNl6ES3U98kPyA/Jy+TbCL3EP7+L0CvkVfJj8ga1QP2I/B6fo+QVzW+IlUzDxsvnkBv3kSVk SWL6iqVL+hcvWtjX2zNvbnfXnNmzOmd2tLfNmN7a0tzUOC3RUD91Sl1tTXVVZUVRYUF+TiwrM5oR 9rsddpvFZDTodVqNWsHINr8l2joQGYoNDKlj0RkzClg4OoiIwUkRA0MRRLVefM5QhF03iEMXnZnA mas+d2ZCnJmYOJPaI1PIlIL8SEs0MnSuORoZoQu7eqFvao72RYbOc93JtTrGAxYE0tNxRaTFv6Y5 MkQHIi1DrTvXHGoZaC7Ip0dNxqZo00pjQT45ajRBmqCGcqKbj9KcesqFKqel9qiK6C3szw4pWS2D K4bmdPW2NAfT0/t4HGni9xrSNg3p+L0ia4fwzOSGyNH8M4duHLGTZQNx84roisHFvUPKIC46pLQc OnTtkCM+lBttHsrd8xs/DLhyKD/a3DIUj+LBOron/gAd0mTZo5FDfyN4+Oj5P+KpJ8UMJmO0Wfa/ EXaQJXHCTEN0UGqCZ8MTIn3p6exZbhhJkGUIDB3o6hXhCFkWHCaJonjfkGqAHTkjj3h62JED8sjE 5QNRWLYl2jKQ/LdzjX/owLJIQT5ylv/LGlJn4XhkSIkNLFu+hvHgykPRZqQQtiTz4LRphkgMJo3Z crS4COcPDiARa5kZunqHiqKbh9zRRmFtROAmWS1r5/byS0Rsy5C7aYgMLE9eNVTUgmtRRFoOsYxh D8juFe3qPUXKxt8+Wh4JHisj5aSPPceQtwmZEms51Lti1VB4ILgC5XNVpDeYPpTog/n6or0r+1gu Re1DuW/jz+EHGcivQto+d7Y8Gcke0mXpI72qoNLHcgsRkVZ8RBun4IB9SCuCLEcbp0R6aZDI0/BX kmcwddF9EFCymmbgYjAubZoRTEfh5j//yyMFRQLwGEP6iWdS4yE0F55J/J3/+GjibPZAuZGWlc2T HvCimyLAHzB5t3//nCpmi6Qx8Ah6lp0zWBoK8lXQERzWD6mQTh7FctEfGSJzIr3RldG+KMpQYk4v yxxma56/HXOjzDHIcztZSuZdFBLHq8WxIZLeMa9XBpjPZqg1zvOVZSsPT+fhieCMzx1uk4cjh/TR jrmH2B+PJm9IIqhByBxtrG3whmpnOSprKxrKaOtgNGKPtB4aHBk/sOzQ0UTi0OaWgTW1qAaHom0r DkXn9k5BXvJ6f1lwD/vTTtJBO+Y1FuSj7Wk8GqXXdR1N0OvmLuw9ZSckct283mEVnKIDjX1HM3Gs 91SEkASPVbFYFslOibAAu1M3Anp+fvBUAjv3+VE1j+Dh5fDL8jhxEuIoWT6iEnF2eZ4KcWoRl+Bx ffhBDfOvQRagHW6JrGDZs69vzaGBPla5iBdZiX90iEbryZAqWg9XrtY8ZIyubBwyRRtZfAOLbxDx WhavizYOUS+FcUbQJh0aiKKdQpHrhYu8D6XDzkq/KisyMj4+rzf9XPB8XzqqxGJgYe+QIY5+QJPV jvOmMwwgevrQgeWD7DlID6o6q5lty/tQF+QNcUrbkAF3MCTvgDNa+TWsOOKi5cgbZCC//gACQwf6 hvri7I/2rmVPFInYh8iMaC2yXdxTE2N/qKjvkDNaygo2Th0yZl3LyIBnI3BS85gggvhjaHBZinRm PPnyKA4tH4ggB9Rk+VwUddGWGlm+IWYlmkR1bCWHMZg8SFiylCyTxThkKMQN8Y9pUyFuiH+6PhiF JZ6Hrk2egL9tHzLhiWKTTJm8ANbBoTb2LPh3LR6enfoCu03XCOmO7kbTyB6a/ykdDg9ZstoG0fiL 602IiVbLi3EvfRaLYvc4K2J1LOVm2F3Jmjcy/lj0UtYCyJ+C/CjrHFjBJMFTKNik79DnI4YWxQvy 9Z+PtfDoQ4f0ln9/gbCX3jLB7C6RFvQ1hKithMDXRdQPk6h6IXlK3UwG1X8kTynvAV8lT2nMZJH6 M/KUSg3cRHRKP3lK+wbi84CZZLk6A9f08nOnK78jNl2ITFV+Qhary8ndyjKyEDygfEr6VVtIlnKW VLB4+N2uVr7M+W7tCnI3i1NX83OZHlB9H9emky7V0yQd4TuU+0mGZoRUKLtIrvIgyVBySZ9yglwN H2OeKpOchhfyi4qPUHiQW+AxvhrYA5/cDUoFuUGXTYjyGVmAdA6AM8GXAN3ADOBpYCuwGigGVgLs +HKAndONzBDv8RBixjzzNoTTSTNmtmnER0IkhWTjuJPkkAjxkCySj9KaQaI4R0VKiYYEMDPNIzHi J3WkgWABjARJGXGTSrwvFCfVpATZXE+mEy9xkAKMWjPxnlQjseBvNeNdolaMZLUkF+8VGUkVaSIt 6L8rSDHRk0K8U2UgtXgagrnDw7SI/la1TPWy0qEcVy9Sf6pp1RzRfKw9rJumO6Uv1b9peMboNT5m mm/6k3mvxWk5Zq20RW2P2SP25+yjjrecm5yjrjvcBe7DnvWe97y7fUV+nf+L/s9SFqW8GlACHYEN gTsDI0Ea7AruCZ5JfSStMq0z7U+h+8PfiuxML0g/l/FC9JrMusymzP/JfD/ry3giDTwR25RXMWtX kM4a0klmkUVfIxa417yklp444Wlu1hfovgHXmYpE4HzTE0qbEja1ynIyEGiInqzQ3qQ42kZowfEG 3U1wKzeMvjX6UtHoW+edNUXnadGb77z1jv2jlxw1RWXvvPZOSTF1pDs43FaVTufWRjMKVRXZscqy stJ6VUV5LJphVfG48sqqeqWsNKRScKaIqVexMFVe/WyhMntUq9ofbZhfpgkFbG6LVqNK9TsLpmTZ 5y7KmlKYplN0WkWj1+VUNWZ0rG/J+LnOkebxpjn1emea15Pm0I3+QmP95M8a66dN6vWf3qFo6xY3 ZCpfMupVaq12JORPyatLb5tvc9nVJpfd4dXrnA5zTvPi0Ws8qeweqR6PuNdoJ8wSHf9EvV/jRmmK kftPkczx946b7XRmdCQpYiPjHx43IcYkBdZ3P0wEWFSWnX1a+KeZfyZyaBY7nG+inZnRWNZfzSaz PyMtarRQr9pMzHaz6pno89GXo0rUHDU707qdPZoe0tDQ4KypKSrq73f4ahyQjjL7+VJHGSwe7xc+ MawcZnm9Wm7ybCVdsSrRjFissooKO/t0USVdvUNP7VnhcJbLoN40+rt1itEVTU3LslE9HVZbUrJD kbyAVb2X/op+c6o3aFUrOrOB1o19z2AxqDXWoFc9bLLqFUVvM900uhfVGXNaoqYoXSFeh76bCIT9 dtoZttvYhwUffjM+IkgrdhsWJnICngSOexI47vGY8tnJ+ezkfHZyPjs5n52c/5yqFH6kMyegSawM lj6GM8EfHsPJnHE++O/HcAk/jjPLRlT2hOUh0xmTyhTI/mtJiS5zhGIXSFf5CDUd1c0jDecbeLmt oUX973Crlb4WFwLFOR6vERpGdVvV0fSMWIWjvLIsHaXSw8pzSKHlhapo1MEKs+uCVNNw9ezlW9rG nvbl5vpobPsdy0u98Wl5FYtbcsZGA9UL24fPNnVXpszKmn5J10uf1PU2xei2qau76/M84Wz1ldnh /Hl7OgvnTa92Giu6N6po0cyK1LH+aN3s0Tdre6eEx6pTq7rRtg2Of6g2a0KoxcuOpZK6eNIqYG4V 8B+PwSrgD5hV+HFYJf4NVRlaLz8tQlsYo/nDrrnq0zSPNV+08KhhPqr0a+cZaJFIvv31syXFWW6r qLzlvFpqmQFYNWUV2OMOoaqK6qo2qzR6d2Lp3rb9P7i5c+5dP7q8et3C1qBeo6j1Jr21dPaW2fNv WlFVsfyWRZ3busptOqNWOWn3O63u3OzgvEc/uv/hz55Z7InkBa2ugNOd6jJkF2W3XPPCvr1fv3xa rCimdYRQA1kpuxmlzIl2e1cirSGduljJcbGS43IjzS4nEuzyI7Wu06zkkIAoMYGkbTjjPDAvMeD3 juHswGmssxlgG/OwtSs4QmNHNaKUSFu8JktEP4qE6qIioZtUAG6e/5UPD499wLM/6/H37u86Ub7p yWueObrvya01qnse//Qr3SKjF3z5vbvXnriq/TNH/YEXWH+GlCn7kLJ8svNoIDuZo2Ceo5zx1GD+ 1Pw4njp7ROVIGAyuiCuChw+MUH3CciBGz8ToKzEai2lTRpAeS1c26Kh2otT3b9mKLC7izYhdJKuU 5/PFyeIZne6QhT4qpLJPbbToR29nKVSt0lv0Gg0+xrR0WI+mQW2AnqWieotRPd0ZdOpFavXOoNsZ dOjH1hnsqS5nwK4bK9E7gjzd458o85DubLL4qM6VTDeYp5szy9VkuvlxlrdI9wlLGgml6ZC0Yy5X inaE5hzL6EphDWSyRyo660hWY6ROZNrkxMjeRlZsZR4SphuD9XR4eK4Tenck4M9w65HUVh571pWK VMzQ2YMeV9BhGP2tzqLTaPChfjo7jC6HpWjR+Afq3ZoIxhaPJNJSU21+VkL9rIT6WdvmN6KE+u1I hZ/lnoU8n00j2YnsgWwl25ZMP5inH8xrMpjXZH4cV9pGVKXHi8ppuX+EGo9nZNQU1Z+mRvTxRpo7 XDPXPULzjxahPvPajE6CddDJdu61/v6zIs8RnbTLRbW5ssrB2jtW23nWO1gLyDpvUf/V6t1qvVln rl5ycOElT+5saNnzxMopeyvGXnM41Ab0EfeavE6js3bxshUld/3xy/P7nzh/S/uVK1sCRvUSV5pL HyuMzTr0jU37zlzVnJZGL83IhBn1enuqc8wViKVl+M39T314xz2fDA0GormBDFYv0OfOQZ9bREaO N5TQqDlpIjA3EWeYFcyrBj8OE5mZcVN9mSZmfROzvolZ38Ssb2Ltg4n1ET6S8KBjSbjYh91BZ5IE jhMf2ySEA4yfxTFfXjc6kPyE7YyZvmKm5ot746L+LecbKHqN11hPkqxQFypWP1pQMbDBkGhCCmuq PIiTUj1H7073ByJu/egxqBRW8vTuDH9Kuluv6uRlESoA66PImfWq+tFvSq3+uVSjn6i0UifrF+2F /TxkzskG32zfMz6FJE0I5ibkDNuAuQn5cViIPIc20Th+5iQsYbR388EHkjnREF5Il0wB7ZXPbfCk +9hzTzzthSdkT6Ub/4D+Bk+VQ+AKI6KJ/r96nDQ8joN2plmj3YbTtBSDfj/6Lk2y70KrNvF4vMZn FGqT5Zb3U+jFRWflob9Jbd7UnVpVmGHSaVQKeih9SrQwnFEcsYskuAy0tfPAwhKDzWE2O1KcXowl bU6bo7BrmvIArK9mtSDZbncgJQEy4xTxiJRg5xs3LGcYFswNC+adjQdl8zgx2Lo9IzSebJhp0Tlp WG5XMeZIPi1vt5QOtK6G0bO+XFko6CtsONbhDroMaGefltn+6cMGR2oy77VxtK1TyFMJ+0D95nqV pbjYV1RkLPT7eceHqsE7RNQOznhWMH9WfhyFIMDqUSizxGw2sppkZDXJyGqSkdUkI6tJRlZOMEZL pLBCk1nZZfL7LEX+kkJtOKcr3COHrQ1ODFjLUFHkSAujVllLHGWOmqlFZWVsHDupvkQpG7sWqrJp dFLNYXOIkMpHy9iAlkmPNq53h1N86S69aqxMMXnS3J6Q26Qam05Ra1L8EZcuP7gmUpzpN9BdGnqN KRCOpWywBV3mC8Vz9ad36Iw6RY1hCSYKd0tbqg/nZZoDOcHPFiiHQ3kpJoMrzZNslfZrHGQqufpY ts3mTtYozjAQZ9gI/CEbgfEwjOPmxgwZCwtLmTFL/Ti31I8TS+04q5QZs5SdYieh6m5joS1bncL6 NNZ1Y9jvq2HGS7YvF2xXBJvxIiMsFYtlR71ez7+xV0jxlcXYSDZZqtT7LZ6ApSqQHY16xtZEpqWq VCq9K+z3h536/EB3WnY4zUFr0ypLS/wUXbornOKNOPXT3ZgZmdJKs1Vv11xWN+Ou9s/+MtEJPpmT YfTlhke/W758oL9o9pHZqm9g3oBRAaoKRm/Lx8+r39Oko9Jmk32JgJvZwM0KlJsN3dxs6OZmNoCZ yhKGCGbVBzCzCCWNC+a1Csw7RTDvFPlxXBU6jeGtkaSgC7TNjbKaxZoFDPQnhnDJLvBCryfbBj6C mzSeVb/Xfvtbd9z2kxua2+94646bX7up5UT2oi9t3vylpbmxhV/cuuWeJTmqu+7/7OjSBYf//tDd nzyzdP5X/vLExq/fMGvejadXbz1zQ+e8m7/GRqsY27yI+pcKf8Huo5naZELAPCGckXAwr3L8OBKi ZUXA50hj5klj5kmzmy10ZhqbD6Wh5x8mjiz0+8e0WjOSaTrm6TJPGvaIAiIrVjKtF1cf9OvqSYNW 5cXErq/uvt3gSk9hTXZegHryOtdumJl7om5Bf/6D985a3Zqp3D5438YpY4UT9QJZrfM1LL50wex1 5dbRj3OmL2c5zHprE1JcCV/JrYmQvdBRpcdTV7FUVPFUVLFUVbFcrkIun8xls8DcBgczCRRnnMsZ pgFz04B5y+mAaYZTC+0Y6T67OUETCd9UWOBEepcvOTdmY7/+85jWJauJbGsw2E3WEtacKIUKJm8X +mI2tfP6Qkpycudzeb20PJYdiyWneGqT1p0ZCqS7TepdnoL6eXXbpLEwy3OVTAt0bJuVHW1cXBMp L8hxb7fqx0ab56Q0lN36ePPyxjAaGXQXBlTxkvIFDdHRn00YEYNGjWKpnr+padrq2bVua3zKrJKx X2emKVfPXOvTacdmptfNQWszffy8shz1po28e4pMg7PBBlfCNGYymIgzTMcZNQjMTTVtRJWfiJcm XG46szSBPjOzNLPUHPSza4OsAQ/acVWQNTxBlh3B57DTEa34sSAfCZw5lpJkt+BnbWx4ZC48TbPh +DLSWMLkiFTRqoTJTGcif84kjExVOaoc3ikYlZ+YFtTkzvWO0NxkPUQWnHcw10U83m8/b0e1nDRe 4pMROXiaqKBqWUGF02iiM//8JFSrLG/a9XD/tE0L6nwmdMx6a9mcLe3V/U2Zpd1rN67pLqtbe+u8 +ILOKS6tWqVoTTpTUXN/beWc8kDp3HUb180to5cs+gKm6pEMf1YY3iNdRk40VDWnrGpWXUlZ/bwt s7sun19gSwm7TA6/y4m5aWo0La24Maty1pTSsqlztyCPbKjrb6DkZ5CVJ/0JmNfvwIDmzHEowis2 jM0rPEo3ZxwAX1zxWUfqgLMDxxxaJ5vSpCXrdikGXh9xR8W34/az8aSFJo0n0+UQnQ3alTf4ROwO ORobu0NO1JSr+DSNz2M+fWCiIC7TO1JdLuHqYiOHqeOfaN/GqGYKWX0sNoWWjoz/M9HEsjcLD6Jn IqeIwqXFYrJohp+J3AzqjzBRUEILimlBJi2I0qruvO5osUmZ7L5CP9aAbh4/zGWV/M2a6Om5v4r1 +fBZVU7q6S/0+aXwbuk0B9X21NxQOJ5qVY99pPpEsQZyI+n5qTZl7EktdcQi4UyXTkWjlLoVgzsr lJruNig0V0XTFK0rmhaK2qkmZnWw3slhVX70WZHU6iM+uL4UvdX06Vl1rcnGhno206ffUdcZoTXW gI+1dItRJxuU78NznCBDiYitMdxY1KiYDL5yM2pUOatg5axaldtZhYPf6R8JTHKzbYSaCWsNSS2r vzgV/B6rx5xxAWNewWtHVPqE2+H7Nim3l6vqzpRTghlfeeG0vBEaTNheyaAZGeq09wvbp/7S3Kkm RUmfVv95NuHr37KkX3Z8Z+NL+muKRI9QimZwCUZYzDuIsUCF8BLyalZWwfwYE27ZejUfWumEn8db VlpZpTTYU4OBsLXu1q7p27oK6rc/vnaft2RWzdTBthKzHh29Ltg4f1X54HXzYo/e1LyiMdw3Z9qm qX6zGT2VeWFDa1brqmkzN7dntZbPqQimRdP09hRbSlogmubK79k/76yvoCG3dW5jM6x7N6z7E80W +OkxwjrR0ECN6ZXJygLm7R6Yt3MszO1VOUL/mQh64mwYEY/AonFm/zjrb+LM4vERlTFhIB5jZUW6 WlM8QjXPxtqDrfaZNZBHNZ1srMCcBz70HslR1gWbCa8P6zuk/+vCOMoh/KpyEKFzeGGtepXyk7Ll t/TH21pbs+H/8GDYpNW5Iv4UjKFyOmbMyFl2w4Kcpz3l8xOR+kRLdvO+pvreqhT67o7TV7U6YrW5 G1E51WrMNDTVvP/Ax+hvc6uj9lkHh3a0XLliqjOvsXTs7rkLpizfixq7EBaLKN+DM+/6o6ms5WHd KfhtVrbA7x2HMQh3HOEAdyjBJmA+hrrgUBp/n10Ax5IpYSmyUmvKu+GE0TIjjPmv6rirXflDCWvV DJYZJfkjVHvUALONvhZnjob4BSfDWbRUwqX0OdchD0Yz0H6HJhyHSkSl0aVM6egtGrxrZcW0LXf3 xbuaK/wGrcppsWVP6anddXl6on9KzfyGuJkN0R9xpDgsKVlpzsTeYzuufn5PnT2Q4be6/M7scHpO +smnFxzsjWfGo3oXvDEqMgC73IfdjzF4S29IhBvqqClYw2pnDZu/1LA+sIaVjhpWWGpOYy88IUXC akWshOE4mI/XOOMiHo+zi1iBMrrSW0012UG1FdVSM+xvR1VXH7N2YiEOhYkXJ4zaxWhEjt1RBy9M ciZXQQxCJkbnCkYfk4akVcp9Okeqmy1LTL970fIbF+SULrt16eyDCZ07zMqU4XDTZc0NKEEoUdPS pyZas1NkAdrVOb/z4NFl209fNb2lSWWSo/XRFpSdZfsSzVeuRFlqQuevIv2w1t1o1eJY1Xo6kVdU 2VC5qVJxsdrkisBKLld6Phsx5DNrCVc9b99QFj4+0Rx/NK5iTugTrLaVq5OFD8zLGA/jMrBo4NTM funp+S8eUN+iVp1R01fUVK1OLfplrN3//oB1s1VlNbyfygtYv/DXC88lN2bpm3ExnEdjF0d/iAqq jaZPKlaop5MLn8qTXckNqlPuzk4ZHQ61bu5KrGgrMutMWkWl6EyV87ckNj22tXbKloeWr7tzoOCw cumuqYvrMzApyk7v2D2/0BPw6KwpTovLZjal+F31e0b2bD91RUvztnt7XVfeUThzZRXrObOwE/Ya zW70nCuGvXZWAXnFCyZbLca8tYLgfT+YN2PwOX88XJyHFaFXEk7micoynq+cHoidL54RmWmfwSaA 50vZXCZ+towPBM7Gy+CdT3o5hDfew1ts2GHS2BbNvGzd+bRPrbpGrdFrdZ5QbjCrPGL9nt5k0Dht 39OjacJEWX+53c4GUJdHZ2xojzZmmvWKxubyWTUGk8Ff1lW7TOcIuDIjn/0BHhP0iya94olkugIO Xf+Sa+fnWmxmF7y6CqkYu125Xvku1lFnYe/uKwmPs2A6q2XT9Sg80yN2F505vawBowrWA4J5/QK/ /Sw71KCbDZmw2Jx05uyg2laslOl0rDShMsJeZxIWiIIyXTCoKytQMxsnylGwSC/7E70ROy7rzctK mMBZtmKdUt3+c/Pc9zyegWrl91Nm5EUaf1bdvuhnkdnJZaAG3mOef100/fGyc/H42bgPA1U2VHWg P7Cfi+NfXH4wq8PGmGTzGUQsW4v2zOtLzh+kr7QK3SvWNtknM7zXhykGJhUT3SlbOIplZ1sx6RDd xfUu2xXR1NL+A7OqlgedvmmVf2ja3F1YfsnhLRvuXpZvTy+JlBSVZoUzyxdfMTN3epjaHY6xsZX9 xdOLfCsXlcwo8s1d2vX7SK7fcNXOjpX1QWV7NJy5oGjW7rn5aV5nYShaqDKq0qf21dVv7inJSvSV p9dXl6WkzMyfOhDL6m/s3DOvwKBPH/to8epIdVtO36pw1YzRJbUNKn1KQW6OZ1pTWnE9K993Y5z7 EHrmUnLp8YZymnfBJZ8s2JN89byfdrFu2RcSjlfW8ArvK282TOyYUfhc4V3BtE57sqA9szVlJm8+ WW+Mzjjp0xOd8UVtp4OPWLS6SVO5pG/DIYaOHuUhvVP0uf7CtuL6fc0IcoeQ7Iqn39K2cO/M9BRZ nlW2ziXNmb09ozfImMn9b0fb1FXXD7KW8urxT2iXpgh+1XRy48mG6OzopqjiZZUZSQTzys3D8B+D eeEF85LO41FivaexByMVbkNuqX91EyZNCjfhP581htlaKV6Urz+eYm/j9nn9fDzZtSR7FtYO/qtX 1sVW31lhRCmk9Z83gCu/rjbOMGEC5Srp36TFtXm5NYDM+X3I+XJyZ8LcUElzS2hJwkk7MSB4hTdp EHy0AX6f1WseRipLTuPduAxiTqbmP3vsURgC3oICwhIqCoU3w6TJaUttdcgCgXkiLcLwAuNZ3gqW vs0nRWw6IROeTf9NcUiufXvcWh2lXq+yT+/KCASjfpt27KrPW4TO0ztT4HbP8BgstrHn6EaLiU/h FZ3FQP88ZvnXgvHZq3Sn0WJQ0I0YzH772HNjWQ5P0ma0HjbzkAT3vm/i3nee22i2eBlhYzO2AgkW PQNBbh832lt5Fifz99/m67/m5UQWXiizyafQvIJefQ55PxF0sqUnvkIa4/O3bD5529xNWyfVXP5E CHOnDGdkCZgPDnmNDoW8KOihUKnwA7OKLZzBvGIb0ZudnMO8DnPqMbbkCZ00xuS3RZhXBs64PPs0 XkIsJXaqHe5ox3BTm7BMa69vLahuK5g50SAg/ye79GqS/h1sO0k6/ln7wF+dlsUB43Q2rbmokfiX iGSr4UlOOMWA3qN5RTQeLr07v7mwZlsL6yThZdZ585sKa7ZPtCVaZ6rPm2bXzby5rbqvudhe0NUx PXPBzrbwRH6oojWfa1X+NQZTcxOKkMGk39UzO1A0LaekOc+F5mambHWRg6XkjoRN5CDLxmQD/Plc Sra7wuzItWRusulRyMRGvGIpjPWWk9fD6D9PJpti1hAnjAXteSmZbdL0Thh+oi2OJ/2LSWv/b7a+ 2LT/uUGeMOIXO/8PDfJFhoKBBlh7zOY/b8FCzLf8eCK1IZfmOGmug8YsNGamMT2N6Wgen/9zfzGM AOblD8ybLfDF/mQ2PA0VGalxkqOajYQnOaqfwxu48JmdtJHOzcgmrLfTYVs7vLKq5ISSzYmSJVOu wLK2KvkjR2/SzSWnkHJ6pLxVu+2rWzd9ZWNlzbantoGrng7Wr5vdtrY5PdiwbvaMdc0R+tuNp67p aNx/fCu4Hbyv7cplNeVLr+xsv3KwpnzJlbDN3WN3KD+Bbdhs+gCbTadXso1JrKcC88rJwrwRh+DF BTUY3bZHTKT5lJp7DsWc+t/OpNvss//jTPrfTaT/tZX2/OeJ9G1LcpqnJTJlU43C4vYEnbrcmZ1d BcsOsYl0GZ9It2Y372mq76sK0N/v/NrB6faM8uhYvZw/q3+PyoVNSybDpXn1uZ6ZVz2zo+WKFVNc uU0lY/dg5/OKfXzGCGvdl7TWNYkgzBU2xVn7FmczRmEA3sjF2WwxDzv5ebEpSxYnMG8lwXKvEjco 9iRhtujJajNNjYfV9kI2Wwy0V7PZor1Tg7Hov58tMofNhPOhAp4qOb7knjFZcDz/Ols0sHFP2K3L bZ/Rls1MVLr81qU5rS3T89i2NneqQ/cvM8ax49JS9FxuTdQmZ42OrLrcDdJ0Y38T00bhgsC0kY8J VY/BYmVk+fHNFTRmSxYqME86WBQuJlips7HC5Uwuu6OTIKxakQDKXFbCEG+P2TyRNg+bQPPmnnf4 ohJNNgYbSf+bkZ8oRFrVYyqtQa/3pWV6UooraqOTSg5vq7Om1dakWdIz08xqhSrLvCGHwWDQuwtn Vo0OyQ7+QkNzsLI526bojUaDle9a6Ro/r3oJKW4jLyXMRR0NHbM7Lu94pkMzySnPqxUPo5kFnzmG gSAPo+3hjAZ82gj9ZSIsPPOsiAVZEUs65nE4yJro4HN4KZ8trxoRIOYE4jGEOpOI4X4N5mfMKnPh m1XGPzjmOAYcmx2KcMD/gnnf273vCbcWzChc70nHOzYKTloYKUq6J8Qs2sr2KvxfO95VL5UtuXJW 8YKWYq9RzRzr8Yb51XnNpcHsxJyerkR2bvfe7swZtbkenYLRkVFryKhsK8pL5HpyEt09cxPZ1Nqy HvntS3Fnhl3YFxSMBJ3RyqxYeU44I14/f0rFYFu+2emxm21euyPFrvOmeF3R4tTsipxIRt6UeWx0 kz7+J9UG9Vex83bx8VziiBYkKyJn2BTM8wLMKyRnGLGAFUKzz1JwPjojzXLeN6MEdfGojvsBz59j nV1ZchHp3FnhzBL7YByfn1KrPJMn3nwyxyqnaoPeHskt9LWuSKTttznZNqnL5KzjXeYtddrerZru y0x16zUGjXpRWobdatBmYSlJZRVz6tfl4unrYtY9ZuxfajAaNFY/S/cdzLOlfA1jgtvg1yqnpmxW grJZCcpmi27ZvJHKZuMEbAD7+FnChmMknKyCYG4V8D95w88EG4eyE2TEhyKCfpwwuArask2alDYM zDQX3Fusfkrv1kSRYpV0YkQg3VsTfi0H99Fgl5FchoZjy5nm8aU5tJ138a5f5xauCF/RjOL6vS1w cGHG5jRMDKZ29cyasvr6ZaoMOV4a/evspU1ZvT2qHTKG2ScDM9W9sE8++fUpbN1Fb8YWJ8J89SIr TENChCiflCHhfLcGWC7Wy4GTM9mKOWCYRBVOqMKowkGz7TRHQzNyEDE1g2Zm0HQmsSMxM51GeGyE ZkZoto3uTKfpzK1jcHhmpEdQaxF6L2FAM5DOfGosxKZL4A8TZtwjPact3RRoM4kGEPblUxwS7+cj h3g/Vkz645QNIfgBvoISZ0MJ3cR2iYntWiqfy1flEv2qspeqFNXYObUlkBMK5aRg3eQltYYt7PvS otgHPKZWPlXBnxn0hRw65UG1wWjWffYE2+er1luNygKz06DAp4jdMmbDaMBsVv3OAPeQSm9i1q4Y /0RzFazdQt46hQXLM4mpSBo811jdraZVjLMKaSydxiI0FqaxEI2l0exUmqOmuQqtraN1tbSugE7J p/YIthvh66j4hJkx3M+IiOAOdvQfPJpxAmvinTYWbZvWxs9jxmywz7Zvsl9uV9sTTu8Me1lbVlvt Lfk0nx3LZ62m3eWdsTp/V76qBbG+mQZm5J8wS/afbWg4B1sKe3OblxQTZmVuaibYUhUMjSlkcrFK ydZNWq2SnfEkk0+SmqvUmrF/KBZfTiicl2JWvq5SPaNYAljBykZo7GONGrMLX2qGU6/8TKV6UWVw othjJ4bqDRV9XYX15oAfW5CUB3Vu24VMUd1kMIxuu5BFNrfOYEIOYaY6GjAYkEMWNLyYzo/6ZUil x5CVklzUjg7kVxG55hQpgWEcKHlY2qOdhazFqCukfpTHZyHL/RT74HjbwKoKj/JSAyuteThM2DVT CK2O0koTNUXY9ILlislUUpzbFjU50trk7J21Fg4nFQ5bmJYys7N/+MCWdb4oxVbnL+xYv7AG6OKF mC38UaVJ78oOh6Iek/qnb6hNngxsXHdQA/WP/UNPXdmRtKjbqD73itroCAfTspwqw9jH+VaXWYPZ uY6uHLsXpGjMLis9SR+zuixqRWvUjR2ls0GK2uS2jS1hrQdGgftgn0zSfYoEkdYKJLMqSHOD1M+c 3zE/jVkrrapsAw2wLrk2QFOqwXUpNNyWYnS1GTvUs0kH89tiFMPWO5FKVpJY5U1XxLpblQu7dWis fGKd08VdhV63TlW2W1tSGog4VNp9Brsy9rzenhkKZbgNGkqVf2odGZHUTId27ITdoTG7rbRG7TQq iz1+qwZb8i2jharXXSYN+gknUtKHQe0b+O6HOKk7RexIiZftJonx3RhFOF5uaDaoDFkOTFqOpcyw oa/A5AUPztzNWO3tP4d2B9nDfJ1sUxor5VX0oi2ifNsEZQvPqje0eqt+9HVPkDUZ9Kaxy+0utmtN pTY5sJyFuLEd9DCWoLWt2PipS03PsHq9KXbVuvQs7A/Waa1eR8Tq9wXso3dhjy0bjV89/ndlgWYJ vE4zSCxhzcwMG9zHNJpiQ3Mtc4bRo/h+N4yc32RvnnA/rvCJT7xyosRg0uT2gX9Z3fz8/EtZULpw f6cumu0JOfVaanCmOr3TFtcEIonBxtoFiVyjDl5vrbuma7D8kntWFI+dNfhzQ5GcFIMhJScSgutV +VXvdQOVmo9sNlbpKHo1ly63eXFpzdKWWErIr3Wkef0prnDAOXXNjZ/VpceDJlMwjhfzUkymlALk Rd7YW3QbeRtvJBmHTb5UYn/tnNi2otOJJqfKJVsZuk1r9Tmu11hcKS6Hz0jVV5v8mYGUTJ/p5nB5 YUHKSzoj5jrsKVwHghG7VmuPMHueHv8HvUm5k8+Tg0cJtlrtPWkMRTHLt2GR4VzDOTbskRum5Z4C 5OzEbC3ZbdObkOZwJAftij8nEhY2uCisRCL5LH35kYwCxgWjOekiAglG9xHAq26UfBHPsxEpNhHf UbZR4syzaDu0BgXtMh4l/gJL/iT35cai+imFDBumFxW2AOwedOxdxaj5Brxs+qN2DSnCvmZf0lxJ v5/ucbXFneZJSXeqtap+tcUV8mDNTK35yIIlfZ3FZdHutdgMsJbbgvu10OOqQtVUvCdmPU50pvNY XMdoEDnB15iEK5WX9kKnY2yJEz/0EZRpDf04OxSOxUJaRwB3uXrsMfoXzQ148ywj4VFYo6qw4bzC K57iCZuuJg1FsDbaPtxZi5cpnL6J13YKFV7PRMdN/7S0f+kiDbWmpTgDLrNS2V2dGq7pLqPYTe/1 pdpVmmXfG+t7/Y2xhT8wO0wabADWrPrRT9/csuWXP3t1Nd5zQgOHd3Up2YMnehdPlE7KThEnpmJ4 JoxuuBeE8QnWMDjhiDzDGnnMx8QTxkvFI7IRBjMre5eo0llRrspmdQtlw+d10ndTq7sqFTPe3Qik Wahm8ZIlS9Qqe6rPgw3zqtU7VClb3vzpj1Zh5UmlQVPwffrYG6/Tx75nsOMtEK1WfW5sNp7vBmUV rdHsQD4ahjX26SgBojLzKa+SLHg6mqGz+Z3OFKvOZ8QuY3+6x0CVayZmri8zpWBkwko77qi6h98x l1hPaIKx6ey2DecmF/ALN+bLORg6iRivR3VQa/c5nXAS+4xu9pfcBjp27UVxxbHP/2m2eoa3G8QO YT3lj2O3Y02MjFu0uzWF+F4a9t0x645tOejHNr4NiZJCs7+gmuz19/h7SOvy7e+Ec8Il+z9wLPxg zpwOnflg4ZZMjSOM3yVTP1h/VVfHn5agODa8hqURLFFhdaqUtXz8HTC2p+qFsyz6BfuPXsdeq3cA bkI+c8FaU3Jqx7d2+KpEt6NTtGzOgikfc4taL1qbF4uomXwRS8uyWsNXpdXJNasqqt3tiNUv3NWZ 21qZpcO2hpb0eGNZpt9ojVTP3TozUldZGnCoU2PILY2qz17clNtYmuE1Fm19/padIzeuaMnz6sr2 v/Zw284FlZgbalQUGx5qBq+cdXps9MszTOHqvsu/+qubHv3TfTNHvxabU4Z5ZdRrqGjwl1Y3xD79 TKHNX7hm18IyV2ZNVk5Npt2RXozVvfimnVv6qmyR4vReqxXbeXVj5Qvm5rb2r15fuuD+XdPL+7Yf vP7yzdmbRq5pd7iwp9vnsDptZqPbbe199HdfKL/27ge/dO3K2tm3vHwm0Zw7rXt+V7h9jiNak62w N68WjJuUezV/wZpmycnO7k68c5nRjb2IJxdkaRpqyroy2Ps2qIGk6FzZ+YZzZRPzbntyqXaiGa8q 1MiGHDtrYHotr+/JVyE9upBOLC7yLGHvWWmVe6dufmQFvrHUmuL2Be0ala+4O1Hg0avR8liKZ2+d 84XbK/u27NjSW1m4+MZ+N87z40VIm9obmlZT6NCpFTbMMRW3DdQ1La0LVvVt3bW1r4punHNwSbXm Z5i5q/Eai/6nWpfX78kIedFvpUVDmwfqZtfk5lXO2TavafuCKu33tfCfYTev/rsKFoXtVlQNV6pd HwgFAkWN2VPmVOfEy+dsGx/HrguT8qjmL1RLagyEpJ7CK2tnjtlUnYNoW9iLe4yH4TRFw4Jamsn3 zrkxUuknNYm0Od3zp7b9amGFdmG5btGvQnmO0EL8ZjZ1Z/b4LrwA6ShjLz5iDzknDLB4Zx7Fq6Ri XTaaHJlXucQbkIWqKtfEzF0obCRPTo08SnpS6dgNNAhiNx8GzwdztttcWr1Fd3Ue1aI584XsWpo3 9n6eSmNL9flZKJefYdZfk3upzeWyXZdLdY6Qz59qU+dRbzbV20N+X5pVQ3O22VyjR3OwuVbZ6fDb dGPHQxmcn2QDUj44nT82Saexo3o6MxSJhug0nIPdQCbt2Dcm6/DA2HHsyoQNL4E34Ot464iNk+4+ RdoxovfB4APtNL6jga5qoE0NtLyBZjbQhhFVU8JtTk0176mg6ypoRwWtraDxClqBA8/CjR1BQWcT LeQTW5w6iduQYrz1MjL+CXxQqk5z7XhxsSaGL2oYdvU1j1DPUc3S5FI66yfj/djX2d//Dp8xYXeG XSg0uRgAiyaWuZdYG3TRPk7d57y/yb0cytfL1x/e0rVv8dQsu7Nw9q7DG7NmJvKtOrWKYrXNFKvs LOu/pidXCUzrnF+y9pa+2NO+yoWNWe0tDYH0hiUNiSX1afTLPQ9e2pbTvv7Qo0vmPvnADaunGGxO k8XmsuJVNL3VYZ154InFtpDfVrPy+oHapY2ZFl/YecXTawuKu1ay3QzdsO1z2H/LNr5Op1eeIpXM RYI9GpXoNI+zTrOCCRbDBYsplzFcsBjuIIYLhjNs28b6WZZFbbRY3ocLtmFwcszbrJ8uxn8bkkhx 5/DRQw537SQ12xaeM6LyJwIhWzSEVMCFwT9C7pCxmp9fzdwPnjRMyPmFyUh2YfVzqib0TK+xyjkp 088cS+76Te4iO8O8tmxgwDezNOJxE0aWpsZi3JQFuceICx7Nig/u3siKmsPI5kfGiqmagtGUvpbR icKCldzk0gjfCBxPBni/Fo+DxKqB+GSlh6/rocmQxYi/k1Ylhkqsc+LzkJCiiAU/tojiq6xkr+fK XRaVynNTthy+ZMUDG2tzOja2TFmcSC9ZfveqZTf357MtZtM3dWT/NK16bsX6TcGaBVNWrs/LaFnd 3LB0avjqqw4cpDPnHVxYmNe9u3PqqvkdGeGWrsWVzbt6y4q6NjaULZnXFom29yxVLc1rLk5Z1pPd NKUmXL5/9JHCjmlT08P1jW35g+suQT2dgbL0In8HIo7V2JTPLVJlyUUqOCnPJLJY6Sigk5af2Jqr m3n43Czz3Ow1afdpFQbSJCKcmxHkBau4YL4KAeZuPvB7bGQNjxT+a9KChMHIXq9IEIUt/CQMuKLI ONuoItxPhRDe8+EFgnmdIYwE30yFLUpGvFrB3j2Qr1aw2Tzf0c0m8ajoLHPk2iBzJ6MdED+fn2lh pQtjkok3iNXKi0Ubhq7Y89iqePH6oQN7wUPWYHxKZ3HPuqnowVbOqO6ZirmG6tCdfz86uOCJfzx0 xz84PzV4z86eqpQ5N35t/a0/OFCb2bRk69Vovp5GtX1Q48N3Mvw2kZkZoplpNDOVRoM0M0AzUyib vPtoLl8gdDKPBaobdhUxcxdTwkxLcplXDkfA3KCcYX0wNyiYu0Ry2csa1hB2PmPLt4l9muAo5I0n mNcr8Bl2q0nxZ5jDD2GYHlc8hG9KcGG7d8OxaHcu1l514p2w0oZRTIGETePnsCdJbPyKf5tblggX oDBvcnaedPulYyatFRuPqrJEq+rBq+rYF/6gFu+4ji7WmU1aLV7VpdZP2N4u7Ig30Dy12el3wtGq fV9vNWiamTdeZw/gbV2HQfnpnUa1JeRz+O1m7fOKGvv00BV9erMBEx1YeyusfR/KdD1Wpy25lTQe orlpzMeXYGbl3VCCetlGXC9vjrzMTF4Uw2fLsvBLapK2rnkOX1BtgrFgHBNz8ZlQEk2O6ppIpAaF r/DZMq+2cK4dq4w50kJihMXeZWZu0nfi51hx5C0GbzC47+4i4zBn6Oc2OvOBLW87dHzz/H0ag80w WmH12HSK0Wb+dMHaGmdqxZxyvs2Z9cN40d1f13dJ3ZKb+gu906/ZdE5Vhh3imnb2ZoDOHvK6Qz6f hRoX37Z7WTzeWZuRkZOhd4Y8WMKwejKj/orFe1rq9978zNbXDU6+mrQabcJtsF8v1ZzCQvaZRCor iQtpiR4mK2GTxhJutxJmt5IRVUXCOGtubNYsP3zJMPF7iRhOiTEXZwKxsYRiDbIrxeoRvzLIrsTW OV5kg7D8Ce62Q3XHVkzUb2uyyIJ5aQefSbiQDda6BG5bx5ytM4vqKC/KiGAseoA6R53Di63XpoSx bW7+XyIRTRt76cM08dJH0fka+8R7H2i6mWcV7b1YWsH0he+ywza7ZGs/aZSAITG2LIXEm5usTZ9Y +vw3/pwLmehBD3Bb/fYnL5m2pbfWptcqVouhYu6m5sYVzRnxuZd27kVe6bQmq2FL49q27EB5V0Xt 4MxSjI11CmbOrtqeTYmF1y0qiNQvrGvaNKeAbu27eVWVJy1stcKDkJkayYpk1PeUVvUmMlA9PK4U my4j0VeV01YZjuZENbagl00pXMjnwnk7pk9d21VjUukq5rC2vxjj3B/jrYo8tEufJmqZQ7yAZufT zGyaGaNZqTQWpFHeQGX5aRa+P8JLYx4ac9OYHYuqNFNDM9U0HmTDhTMJp2itCrx+CC9rxOCd5e0O 45PIO29qId6UGv8skYYz7Kz62VlZsrNlIjvrROzMKWFn33yQTdSircLm3FdY9WObdRNGHFari4uy g1itRgar4+l2uzG928hG4RjZOWvK2AhceHTjydWyOIbkbLMk2wCOLnuS91z2BXyr7qQtqvLVFfkF Jayt8uLFjXTlx27nbfINztH3zXYLfBtGHX1V4wrlh9JLQvbbHJ6xh1Vji+hjdHN6bOxDuXJL7VoM u12hFJ9FcWIujq+IsRg++05U9ftRfEEPJStR4+7C2zr15IWEJbuKZlfyLSIKb7H4oCxBq5KtEhjf 6oLyX8Vez8mB6XNgyhxWL3Kss0s3lV5eqpT++5f1nsMbieztZlbFkGdsXzQWvaFOsjGey+VHxclP mPNr/xrJwNscmvwuvNA/qer0Y17PtjZR++vJGnO2/zVReYRxmXWTXSufQF5UXTK430x+vwG2vuEr HMSUX7mr9cDR9VPWz6u04Qt1sCFCZ8ybvnZG0+auwuyuffOn9sZS/eE01VS9zahxO8fSom3Fmw5v qqEPrXlkU60jxW81OwJOB97cx9sbkebV7fVLG8LmQJbKlh6Bz9SVmTN2p0ZVMXgIM8HkvATfTM/+ P3d8lxvqwDOwfJi8cQrvOr2XMDrS6UyHHSZFowJTiX6RjTd5GGURjF2iKIvb+cIbinTyKju7igXZ VWC+t4AfNrGlvh2oNdhNxuJxMZbXxHA7nc1ueIcM/ikf0GLpj3c6YL5hgTPuCX77BDLPo4F3vOBY oMvEX7RkL2PhB6Wc5QJz6LOfJE1aieNfujPZU648o2gM2rFCjc2XGciIwblP3x+93eXSGK0G1Z+t HpNWfdaZFkyxfvqSGe5ILRyT6vacTBf6Fex4gTWTMxFYcyqsqeLhw+g5ivENVV9PuHILaZ6G5vI1 tTx8A4iRNiNleDsJ3UkzuhMYVfQkaXtKaE1JW8naEiWObZzsVUEDsVojcE6xMSCaEV5i3z7OSmwd 6zdwKfjDhJP1BDvqaGVda92qOiUTK3cjqnjCWpSFvRt/jkR0lX/Nm4tSrD+qE2/fop3ApJBPB9m+ 6jh/FQlNAZyKF8owL8XMSXXRxoOqSW8nyVdWJ8aMlcphd3HX3ic2x7um5ePVLrgmTDlTu8sGb+jN V1XcMbD+9r7s0nWPbu26bHEi2/FMRuNAw7TFdakp1QsbO25UPTfvqQdvWFNnsjud4YA3YNXg3f6O /YcXh4vrVt04d/69O1tzOzccerj1wDPri4tmr6ioW9acxYbZ+GHfLUa50hJ8U1tfS3dj68x40+D6 tcu2rv3/AFsOUzYKZW5kc3RyZWFtCmVuZG9iagoyMSAwIG9iagoxOTMyMQplbmRvYmoKMjIgMCBv YmoKKE1hYyBPUyBYIDEwLjguNSBRdWFydHogUERGQ29udGV4dCkKZW5kb2JqCjIzIDAgb2JqCihQ aGlsIEh1bnQpCmVuZG9iagoyNCAwIG9iagooRXhjZWwpCmVuZG9iagoyNSAwIG9iagooRDoyMDE0 MDIwNTE4MzUxN1owMCcwMCcpCmVuZG9iagoyNiAwIG9iagooKQplbmRvYmoKMjcgMCBvYmoKWyBd CmVuZG9iagoxIDAgb2JqCjw8IC9BdXRob3IgMjMgMCBSIC9Qcm9kdWNlciAyMiAwIFIgL0NyZWF0 b3IgMjQgMCBSIC9DcmVhdGlvbkRhdGUgMjUgMCBSIC9Nb2REYXRlCjI1IDAgUiAvS2V5d29yZHMg MjYgMCBSIC9BQVBMOktleXdvcmRzIDI3IDAgUiA+PgplbmRvYmoKeHJlZgowIDI4CjAwMDAwMDAw MDAgNjU1MzUgZiAKMDAwMDAzNjA4OSAwMDAwMCBuIAowMDAwMDA3NDcxIDAwMDAwIG4gCjAwMDAw MTQ5MDggMDAwMDAgbiAKMDAwMDAwMDAyMiAwMDAwMCBuIAowMDAwMDA3NDUxIDAwMDAwIG4gCjAw MDAwMDc1NzUgMDAwMDAgbiAKMDAwMDAxMDQxMCAwMDAwMCBuIAowMDAwMDAwMDAwIDAwMDAwIG4g CjAwMDAwMTUwNDggMDAwMDAgbiAKMDAwMDAwNzY3NCAwMDAwMCBuIAowMDAwMDEwMzg5IDAwMDAw IG4gCjAwMDAwMTQ3MDEgMDAwMDAgbiAKMDAwMDAxMDQ0NiAwMDAwMCBuIAowMDAwMDE0NjgwIDAw MDAwIG4gCjAwMDAwMTQ4MDggMDAwMDAgbiAKMDAwMDAxNDk5OCAwMDAwMCBuIAowMDAwMDE2MjM1 IDAwMDAwIG4gCjAwMDAwMTU0NzkgMDAwMDAgbiAKMDAwMDAxNjIxNSAwMDAwMCBuIAowMDAwMDE2 NDcwIDAwMDAwIG4gCjAwMDAwMzU4ODIgMDAwMDAgbiAKMDAwMDAzNTkwNCAwMDAwMCBuIAowMDAw MDM1OTU2IDAwMDAwIG4gCjAwMDAwMzU5ODQgMDAwMDAgbiAKMDAwMDAzNjAwOCAwMDAwMCBuIAow MDAwMDM2MDUwIDAwMDAwIG4gCjAwMDAwMzYwNjkgMDAwMDAgbiAKdHJhaWxlcgo8PCAvU2l6ZSAy OCAvUm9vdCAxNiAwIFIgL0luZm8gMSAwIFIgL0lEIFsgPGI3ZDVhMzIxZjliOGUyMmE4NjgyYTJi NjBlYjQ2OWY0Pgo8YjdkNWEzMjFmOWI4ZTIyYTg2ODJhMmI2MGViNDY5ZjQ+IF0gPj4Kc3RhcnR4 cmVmCjM2MjM0CiUlRU9GCg== --Apple-Mail=_94FF3956-4169-4DAF-8B9C-EE890E260727 Content-Disposition: attachment; filename=draft-ietf-scim-core-schema-02-03.diff.txt.html Content-Type: text/html; x-unix-mode=0644; name="draft-ietf-scim-core-schema-02-03.diff.txt.html" Content-Transfer-Encoding: 7bit Diff: draft-ietf-scim-core-schema-02.txt - draft-ietf-scim-core-schema-03.txt
< draft-ietf-scim-core-schema-02.txt   draft-ietf-scim-core-schema-03.txt >
Network Working Group C. Mortimore, Ed. Network Working Group C. Mortimore, Ed.
Internet-Draft Salesforce Internet-Draft Salesforce
Intended status: Standards Track P. Harding Intended status: Standards Track K. Grizzle
Expires: March 3, 2014 P. Madsen Expires: March 3, 2014 SailPoint
P. Harding
P. Madsen
Ping Ping
T. Drake T. Drake
UnboundID UnboundID
August 30, 2013 August 30, 2013
System for Cross-Domain Identity Management: Core Schema System for Cross-Domain Identity Management: Core Schema
draft-ietf-scim-core-schema-02 draft-ietf-scim-core-schema-03
Abstract Abstract
The System for Cross-Domain Identity Management (SCIM) specification The System for Cross-Domain Identity Management (SCIM) specification
is designed to make managing user identity in cloud based is designed to make managing user identity in cloud based
applications and services easier. The specification suite builds applications and services easier. The specification suite builds
upon experience with existing schemas and deployments, placing upon experience with existing schemas and deployments, placing
specific emphasis on simplicity of development and integration, while specific emphasis on simplicity of development and integration, while
applying existing authentication, authorization, and privacy models. applying existing authentication, authorization, and privacy models.
Its intent is to reduce the cost and complexity of user management Its intent is to reduce the cost and complexity of user management
skipping to change at page 2, line 31 skipping to change at page 2, line 34
Table of Contents Table of Contents
1. Requirements Notation and Conventions . . . . . . . . . . . . 3 1. Requirements Notation and Conventions . . . . . . . . . . . . 3
2. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . 3
2.1. Definitions . . . . . . . . . . . . . . . . . . . . . . . 4 2.1. Definitions . . . . . . . . . . . . . . . . . . . . . . . 4
3. SCIM Schema Structure . . . . . . . . . . . . . . . . . . . . 4 3. SCIM Schema Structure . . . . . . . . . . . . . . . . . . . . 4
3.1. Attribute Data Types . . . . . . . . . . . . . . . . . . 5 3.1. Attribute Data Types . . . . . . . . . . . . . . . . . . 5
3.1.1. String . . . . . . . . . . . . . . . . . . . . . . . 5 3.1.1. String . . . . . . . . . . . . . . . . . . . . . . . 5
3.1.2. Boolean . . . . . . . . . . . . . . . . . . . . . . . 5 3.1.2. Boolean . . . . . . . . . . . . . . . . . . . . . . . 5
3.1.3. Decimal . . . . . . . . . . . . . . . . . . . . . . . 5 3.1.3. Decimal . . . . . . . . . . . . . . . . . . . . . . . 5
3.1.4. Integer . . . . . . . . . . . . . . . . . . . . . . . 5 3.1.4. Integer . . . . . . . . . . . . . . . . . . . . . . . 6
3.1.5. DateTime . . . . . . . . . . . . . . . . . . . . . . 6 3.1.5. DateTime . . . . . . . . . . . . . . . . . . . . . . 6
3.1.6. Binary . . . . . . . . . . . . . . . . . . . . . . . 6 3.1.6. Binary . . . . . . . . . . . . . . . . . . . . . . . 6
3.1.7. Reference . . . . . . . . . . . . . . . . . . . . . . 6 3.1.7. Reference . . . . . . . . . . . . . . . . . . . . . . 6
3.1.8. Complex . . . . . . . . . . . . . . . . . . . . . . . 6 3.1.8. Complex . . . . . . . . . . . . . . . . . . . . . . . 7
3.2. Multi-valued Attributes . . . . . . . . . . . . . . . . . 7 3.2. Multi-valued Attributes . . . . . . . . . . . . . . . . . 7
4. Schema Extension Model . . . . . . . . . . . . . . . . . . . 8 4. Schema Extension Model . . . . . . . . . . . . . . . . . . . 8
5. SCIM Core Schema . . . . . . . . . . . . . . . . . . . . . . 8 5. SCIM Core Schema . . . . . . . . . . . . . . . . . . . . . . 8
5.1. Common Schema Attributes . . . . . . . . . . . . . . . . 8 5.1. Common Schema Attributes . . . . . . . . . . . . . . . . 8
5.2. "schemas" Attribute . . . . . . . . . . . . . . . . . . . 9 5.2. "schemas" Attribute . . . . . . . . . . . . . . . . . . . 9
6. SCIM User Schema . . . . . . . . . . . . . . . . . . . . . . 10 6. SCIM User Schema . . . . . . . . . . . . . . . . . . . . . . 10
6.1. Singular Attributes . . . . . . . . . . . . . . . . . . . 10 6.1. Singular Attributes . . . . . . . . . . . . . . . . . . . 10
6.2. Multi-valued Attributes . . . . . . . . . . . . . . . . . 12 6.2. Multi-valued Attributes . . . . . . . . . . . . . . . . . 12
7. SCIM Enterprise User Schema Extension . . . . . . . . . . . . 14 7. SCIM Enterprise User Schema Extension . . . . . . . . . . . . 14
8. SCIM Group Schema . . . . . . . . . . . . . . . . . . . . . . 15 8. SCIM Group Schema . . . . . . . . . . . . . . . . . . . . . . 15
9. Service Provider Configuration Schema . . . . . . . . . . . . 15 9. Service Provider Configuration Schema . . . . . . . . . . . . 15
10. Resource Type Schema . . . . . . . . . . . . . . . . . . . . 17 10. Resource Type Schema . . . . . . . . . . . . . . . . . . . . 17
11. Schema Schema . . . . . . . . . . . . . . . . . . . . . . . . 18 11. Schema Schema . . . . . . . . . . . . . . . . . . . . . . . . 18
12. JSON Representation . . . . . . . . . . . . . . . . . . . . . 20 12. JSON Representation . . . . . . . . . . . . . . . . . . . . . 21
12.1. Minimal User Representation . . . . . . . . . . . . . . 20 12.1. Minimal User Representation . . . . . . . . . . . . . . 21
12.2. Full User Representation . . . . . . . . . . . . . . . . 20 12.2. Full User Representation . . . . . . . . . . . . . . . . 21
12.3. Enterprise User Extension Representation . . . . . . . . 23 12.3. Enterprise User Extension Representation . . . . . . . . 24
12.4. Group Representation . . . . . . . . . . . . . . . . . . 26 12.4. Group Representation . . . . . . . . . . . . . . . . . . 27
12.5. Service Provider Configuration Representation . . . . . 27 12.5. Service Provider Configuration Representation . . . . . 28
12.6. Resource Type Representation . . . . . . . . . . . . . . 28 12.6. Resource Type Representation . . . . . . . . . . . . . . 29
12.7. Schema Representation . . . . . . . . . . . . . . . . . 29 12.7. Schema Representation . . . . . . . . . . . . . . . . . 30
13. Security Considerations . . . . . . . . . . . . . . . . . . . 34 13. Security Considerations . . . . . . . . . . . . . . . . . . . 35
14. References . . . . . . . . . . . . . . . . . . . . . . . . . 34 14. References . . . . . . . . . . . . . . . . . . . . . . . . . 35
14.1. Normative References . . . . . . . . . . . . . . . . . . 0 14.1. Normative References . . . . . . . . . . . . . . . . . . 0
14.2. URIs . . . . . . . . . . . . . . . . . . . . . . . . . . 34 14.2. URIs . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Appendix A. Contributors . . . . . . . . . . . . . . . . . . . . 35 Appendix A. Contributors . . . . . . . . . . . . . . . . . . . . 36
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 35 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 36
1. Requirements Notation and Conventions 1. Requirements Notation and Conventions
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119] . document are to be interpreted as described in [RFC2119] .
Throughout this document, values are quoted to indicate that they are Throughout this document, values are quoted to indicate that they are
to be taken literally. When using these values in protocol messages, to be taken literally. When using these values in protocol messages,
the quotes MUST NOT be used as part of the value. the quotes MUST NOT be used as part of the value.
skipping to change at page 4, line 17 skipping to change at page 4, line 20
2.1. Definitions 2.1. Definitions
Service Provider: A web application that provides identity Service Provider: A web application that provides identity
information via the SCIM protocol. information via the SCIM protocol.
Consumer: A website or application that uses the SCIM protocol to Consumer: A website or application that uses the SCIM protocol to
manage identity data maintained by the Service Provider. manage identity data maintained by the Service Provider.
Resource: The Service Provider managed artifact containing one or Resource: The Service Provider managed artifact containing one or
more attributes; e.g., User or Group more attributes; e.g., User or Group.
Resource Type: A type of a Resource that is managed by a Service Resource Type: A type of a Resource that is managed by a Service
Provider. The Resource Type defines the Resource name, endpoint Provider. The Resource Type defines the Resource name, endpoint
URL, Schemas, and other meta-data which indicate where a Resource URL, Schemas, and other meta-data which indicate where a Resource
is managed and how it is composed; e.g., User or Group. is managed and how it is composed; e.g., User or Group.
Schema: A collection of Attribute Definitions that describe the Schema: A collection of Attribute Definitions that describe the
contents of an entire or partial Resource; e.g., contents of an entire or partial Resource; e.g.,
urn:scim:schemas:core:User:2.0. urn:scim:schemas:core:2.0:User.
Singular Attribute: A Resource attribute that contains 0..1 values; Singular Attribute: A Resource attribute that contains 0..1 values;
e.g., displayName. e.g., displayName.
Multi-valued Attribute: A Resource attribute that contains 0..n Multi-valued Attribute: A Resource attribute that contains 0..n
values; e.g., emails. values; e.g., emails.
Simple Attribute: A Singular or Multi-valued Attribute whose value Simple Attribute: A Singular or Multi-valued Attribute whose value
is a primitive; e.g., String. is a primitive; e.g., String.
skipping to change at page 8, line 51 skipping to change at page 9, line 9
keyword and MUST NOT be used in the unique identifier. REQUIRED keyword and MUST NOT be used in the unique identifier. REQUIRED
and READ-ONLY. and READ-ONLY.
externalId An identifier for the Resource as defined by the Service externalId An identifier for the Resource as defined by the Service
Consumer. The externalId may simplify identification of the Consumer. The externalId may simplify identification of the
Resource between Service Consumer and Service provider by allowing Resource between Service Consumer and Service provider by allowing
the Consumer to refer to the Resource with its own identifier, the Consumer to refer to the Resource with its own identifier,
obviating the need to store a local mapping between the local obviating the need to store a local mapping between the local
identifier of the Resource and the identifier used by the Service identifier of the Resource and the identifier used by the Service
Provider. Each Resource MAY include a non-empty externalId value. Provider. Each Resource MAY include a non-empty externalId value.
The value of the externalId attribute is always issued be the The value of the externalId attribute is always issued by the
Service Consumer and can never be specified by the Service Service Consumer and can never be specified by the Service
Provider. The Service Provider MUST always interpret the Provider. The Service Provider MUST always interpret the
externalId as scoped to the Service Consumer's tenant. externalId as scoped to the Service Consumer's tenant.
meta A complex attribute containing resource metadata. All sub- meta A complex attribute containing resource metadata. All sub-
attributes are OPTIONAL attributes are OPTIONAL
resourceType The name of the Resource Type of the Resource. resourceType The name of the Resource Type of the Resource.
READ-ONLY. READ-ONLY.
skipping to change at page 9, line 37 skipping to change at page 9, line 43
must be the same as the ETag HTTP response header. READ-ONLY. must be the same as the ETag HTTP response header. READ-ONLY.
attributes The names of the attributes to remove from the attributes The names of the attributes to remove from the
Resource during a PATCH operation. Resource during a PATCH operation.
5.2. "schemas" Attribute 5.2. "schemas" Attribute
SCIM supports resources of different types, with extensible schemas. SCIM supports resources of different types, with extensible schemas.
Each resource MUST be indicated using fully qualified URLs. Each resource MUST be indicated using fully qualified URLs.
When a representation does not explicitly provide support for A "schemas" attribute is used to indicate the version of SCIM schema
indicating a schema, such as JSON, a schemas attribute is used to as well as any schema extensions.
indicate the version of SCIM schema as well as any schema extensions.
schemas The schemas attribute is an array of Strings which allows schemas The schemas attribute is an array of Strings which allows
introspection of the supported schema version for a SCIM introspection of the supported schema version for a SCIM
representation as well any schema extensions supported by that representation as well any schema extensions supported by that
representation. Each String value must be a unique URI. This representation. Each String value must be a unique URI. This
specification defines URIs for User, Group, and a standard specification defines URIs for User, Group, and a standard
"enterprise" extension. All representations of SCIM schema MUST "enterprise" extension. All representations of SCIM schema MUST
include a non-zero value array with value(s) of the URIs supported include a non-zero value array with value(s) of the URIs supported
by that representation. The schemas attribute for a Resource MUST by that representation. The schemas attribute for a Resource MUST
only contain values defined as "schema" and "schemaExtensions" for only contain values defined as "schema" and "schemaExtensions" for
skipping to change at page 12, line 23 skipping to change at page 12, line 29
The following multi-valued attributes are defined. The following multi-valued attributes are defined.
emails E-mail addresses for the User. The value SHOULD be emails E-mail addresses for the User. The value SHOULD be
canonicalized by the Service Provider, e.g. bjensen@example.com canonicalized by the Service Provider, e.g. bjensen@example.com
instead of bjensen@EXAMPLE.COM. Canonical Type values of work, instead of bjensen@EXAMPLE.COM. Canonical Type values of work,
home, and other. home, and other.
phoneNumbers Phone numbers for the User. The value SHOULD be phoneNumbers Phone numbers for the User. The value SHOULD be
canonicalized by the Service Provider according to format in canonicalized by the Service Provider according to format in
RFC3966 [20] e.g. 'tel:+1-201-555-0123'. Canonical Type values of RFC3966 [20] e.g. 'tel:+1-201-555-0123'. Canonical Type values
work, home, mobile, fax, pager and other. of work, home, mobile, fax, pager and other.
ims Instant messaging address for the User. No official ims Instant messaging address for the User. No official
canonicalization rules exist for all instant messaging addresses, canonicalization rules exist for all instant messaging addresses,
but Service Providers SHOULD, when appropriate, remove all but Service Providers SHOULD, when appropriate, remove all
whitespace and convert the address to lowercase. Instead of the whitespace and convert the address to lowercase. Instead of the
standard Canonical Values for type, this attribute defines the standard Canonical Values for type, this attribute defines the
following Canonical Values to represent currently popular IM following Canonical Values to represent currently popular IM
services: aim, gtalk, icq, xmpp, msn, skype, qq, and yahoo. services: aim, gtalk, icq, xmpp, msn, skype, qq, and yahoo.
photos URL of a photo of the User. The value SHOULD be a photos URL of a photo of the User. The value SHOULD be a
skipping to change at page 18, line 32 skipping to change at page 18, line 36
constitute a Schema. Schema Resources are READ-ONLY and identified constitute a Schema. Schema Resources are READ-ONLY and identified
using the following URI: 'urn:scim:schemas:core:2.0:Schema'. Unlike using the following URI: 'urn:scim:schemas:core:2.0:Schema'. Unlike
other core Resources the Schema Resource MAY contain a complex object other core Resources the Schema Resource MAY contain a complex object
within a Sub-Attribute and all Attributes are REQUIRED unless other within a Sub-Attribute and all Attributes are REQUIRED unless other
specified. specified.
The following Singular Attributes are defined: The following Singular Attributes are defined:
id The unique URI of the schema. When applicable Service Providers id The unique URI of the schema. When applicable Service Providers
MUST specify the URI specified in the core schema specification; MUST specify the URI specified in the core schema specification;
e.g., "urn:scim:core:2.0:User". Unlike most other schemas, which e.g., "urn:scim:schemas:core:2.0:User". Unlike most other
use some sort of a GUID for the "id", the Schema "id" is a URI so schemas, which use some sort of a GUID for the "id", the Schema
that it can be registered and is portable between different "id" is a URI so that it can be registered and is portable between
Service Providers and Clients. different Service Providers and Clients.
name The Schema's human readable name. When applicable Service name The Schema's human readable name. When applicable Service
Providers MUST specify the name specified in the core schema Providers MUST specify the name specified in the core schema
specification; e.g., "User" or "Group". OPTIONAL. specification; e.g., "User" or "Group". OPTIONAL.
description The Schema's human readable description. When description The Schema's human readable description. When
applicable Service Providers MUST specify the description applicable Service Providers MUST specify the description
specified in the core schema specification. OPTIONAL. specified in the core schema specification. OPTIONAL.
The following multi-valued attribute is defined: The following multi-valued attribute is defined:
skipping to change at page 19, line 20 skipping to change at page 19, line 24
readOnly A Boolean value that specifies if the attribute is readOnly A Boolean value that specifies if the attribute is
mutable. mutable.
required A Boolean value that specifies if the attribute is required A Boolean value that specifies if the attribute is
required. required.
caseExact A Boolean value that specifies if the String attribute caseExact A Boolean value that specifies if the String attribute
is case sensitive. is case sensitive.
mutability A single keyword indicating what types of
modifications an attribute MAY accept as follows:
readOnly The attribute MAY NOT be modified.
readWrite (DEFAULT) The attribute MAY be updated and read at
any time.
immutable The attribute MAY be defined at resource creation
(e.g. POST) or at record replacement via request (e.g. a
PUT). The attribute MAY NOT be updated.
writeOnly The attribute MAY be updated at any time. Attribute
values MAY NOT be returned (e.g. because the value is a
stored hash). Note: an attribute with mutability of
"writeOnly" usually also has a returned setting of "never".
returned A single keyword that indicates when an attribute and
associated values are returned in response to a GET request or
in response to a PUT, POST, or PATCH request. Valid keywords
are:
always The attribute is always returned regardless of the
contents of the "attributes" parameter. For example, "id"
is always returned to identify a SCIM resource.
never The attribute is never returned. This may occur because
the original attribute value is not retained by the service
provider (e.g. such as with a hashed value). A service
provider MAY allow attributes to be used in a search filter.
default (DEFAULT) The attribute is returned by default in all
SCIM operation responses where attribute values are
returned. If the GET request "attributes" parameter is
specified, attribute values are only returned if the
attribute is named in the attributes parameter.
request The attribute is returned in response to any PUT,
POST, or PATCH operations if the attribute was specified by
the client (for example, the attribute was modified). The
attribute is returned in a GET operation only if specified
in the "attributes" parameter.
uniqueness A single keyword value that specifies how unique
attribute values are. A server MAY reject an invalid value
based on uniqueness by returning HTTP Response code 400 (Bad
Request). Valid keywords are:
none (DEFAULT) The values are not intended to be unique in any
way.
server The value SHOULD be unique within the context of the
current SCIM endpoint but MAY not be globally unique (e.g. a
user-id, email address, or other server generated key or
counter). No two resources on the same server SHOULD
possess the same value.
global The value SHOULD be globally unique (e.g. an email
address, a GUID, or other value). No two resources on any
server SHOULD possess the same value.
referenceTypes The names of the Resource Types that may be referenceTypes The names of the Resource Types that may be
referenced; e.g., User. This is only applicable for attributes referenced; e.g., User. This is only applicable for attributes
that are of the "reference" data type. that are of the "reference" data type.
The following multi-valued attributes are defined. There are The following multi-valued attributes are defined. There are
no canonical type values defined and the primary value serves no canonical type values defined and the primary value serves
no useful purpose. no useful purpose.
subAttributes A list specifying the contained attributes.
OPTIONAL.
name The attribute's name. name The attribute's name.
type The attribute's data type; e.g., String. type The attribute's data type; e.g., String.
description The attribute's human readable description. description The attribute's human readable description. When
When applicable Service Providers MUST specify the applicable Service Providers MUST specify the description
description specified in the core schema specification. specified in the core schema specification.
readOnly A Boolean value that specifies if the attribute is readOnly A Boolean value that specifies if the attribute is
mutable. mutable.
required A Boolean value that specifies if the attribute is required A Boolean value that specifies if the attribute is
required. required.
caseExact A Boolean value that specifies if the String caseExact A Boolean value that specifies if the String
attribute is case sensitive. attribute is case sensitive.
skipping to change at page 36, line 4 skipping to change at page 37, line 4
Special thanks to Joeseph Smarr, who's excellent work on the Portable Special thanks to Joeseph Smarr, who's excellent work on the Portable
Contacts Specification [PortableContacts] provided a basis for the Contacts Specification [PortableContacts] provided a basis for the
SCIM schema structure and text. SCIM schema structure and text.
Authors' Addresses Authors' Addresses
Chuck Mortimore (editor) Chuck Mortimore (editor)
Salesforce.com Salesforce.com
Email: cmortimore@salesforce.com Email: cmortimore@salesforce.com
Kelly Grizzle
SailPoint
Email: kelly.grizzle@sailpoint.com
Patrick Harding Patrick Harding
Ping Identity Ping Identity
Email: pharding@pingidentity.com Email: pharding@pingidentity.com
Paul Madsen Paul Madsen
Ping Identity Ping Identity
Email: pmadsen@pingidentity.com Email: pmadsen@pingidentity.com
 End of changes. 16 change blocks. 
36 lines changed or deleted 100 lines changed or added

This html diff was produced by rfcdiff 1.41. The latest version is available from http://tools.ietf.org/tools/rfcdiff/
--Apple-Mail=_94FF3956-4169-4DAF-8B9C-EE890E260727 Content-Disposition: attachment; filename=draft-ietf-scim-api-02-03.diff.txt.html Content-Type: text/html; x-unix-mode=0644; name="draft-ietf-scim-api-02-03.diff.txt.html" Content-Transfer-Encoding: 7bit Diff: draft-ietf-scim-api-02.txt - draft-ietf-scim-api-03.txt
< draft-ietf-scim-api-02.txt   draft-ietf-scim-api-03.txt >
skipping to change at page 1, line 16 skipping to change at page 1, line 16
Expires: March 3, 2014 SalesForce Expires: March 3, 2014 SalesForce
M. Ansari M. Ansari
Cisco Cisco
K. Grizzle K. Grizzle
SailPoint SailPoint
E. Wahlstroem E. Wahlstroem
Technology Nexus Technology Nexus
August 30, 2013 August 30, 2013
System for Cross-Domain Identity Management:Protocol System for Cross-Domain Identity Management:Protocol
draft-ietf-scim-api-02 draft-ietf-scim-api-03
Abstract Abstract
The System for Cross-Domain Identity Management (SCIM) specification The System for Cross-Domain Identity Management (SCIM) specification
is designed to make managing user identity in cloud based is designed to make managing user identity in cloud based
applications and services easier. The specification suite seeks to applications and services easier. The specification suite seeks to
build upon experience with existing schemas and deployments, placing build upon experience with existing schemas and deployments, placing
specific emphasis on simplicity of development and integration, while specific emphasis on simplicity of development and integration, while
applying existing authentication, authorization, and privacy models. applying existing authentication, authorization, and privacy models.
It's intent is to reduce the cost and complexity of user management It's intent is to reduce the cost and complexity of user management
skipping to change at page 2, line 33 skipping to change at page 2, line 33
1.1. Intended Audience . . . . . . . . . . . . . . . . . . . . 3 1.1. Intended Audience . . . . . . . . . . . . . . . . . . . . 3
1.2. Notational Conventions . . . . . . . . . . . . . . . . . 3 1.2. Notational Conventions . . . . . . . . . . . . . . . . . 3
1.3. Definitions . . . . . . . . . . . . . . . . . . . . . . . 3 1.3. Definitions . . . . . . . . . . . . . . . . . . . . . . . 3
2. Authentication and Authorization . . . . . . . . . . . . . . 3 2. Authentication and Authorization . . . . . . . . . . . . . . 3
3. API . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 3. API . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
3.1. Creating Resources . . . . . . . . . . . . . . . . . . . 6 3.1. Creating Resources . . . . . . . . . . . . . . . . . . . 6
3.1.1. Resource Types . . . . . . . . . . . . . . . . . . . 7 3.1.1. Resource Types . . . . . . . . . . . . . . . . . . . 7
3.2. Retrieving Resources . . . . . . . . . . . . . . . . . . 7 3.2. Retrieving Resources . . . . . . . . . . . . . . . . . . 7
3.2.1. Retrieving a known Resource . . . . . . . . . . . . . 7 3.2.1. Retrieving a known Resource . . . . . . . . . . . . . 7
3.2.2. List/Query Resources . . . . . . . . . . . . . . . . 9 3.2.2. List/Query Resources . . . . . . . . . . . . . . . . 9
3.2.3. Querying Resources Using HTTP POST . . . . . . . . . 16 3.2.3. Querying Resources Using HTTP POST . . . . . . . . . 18
3.3. Modifying Resources . . . . . . . . . . . . . . . . . . . 19 3.3. Modifying Resources . . . . . . . . . . . . . . . . . . . 20
3.3.1. Modifying with PUT . . . . . . . . . . . . . . . . . 20 3.3.1. Modifying with PUT . . . . . . . . . . . . . . . . . 21
3.3.2. Modifying with PATCH . . . . . . . . . . . . . . . . 21 3.3.2. Modifying with PATCH . . . . . . . . . . . . . . . . 22
3.4. Deleting Resources . . . . . . . . . . . . . . . . . . . 29 3.4. Deleting Resources . . . . . . . . . . . . . . . . . . . 30
3.5. Bulk . . . . . . . . . . . . . . . . . . . . . . . . . . 30 3.5. Bulk . . . . . . . . . . . . . . . . . . . . . . . . . . 31
3.6. Data Input/Output Formats . . . . . . . . . . . . . . . . 45 3.6. Data Input/Output Formats . . . . . . . . . . . . . . . . 46
3.7. Additional retrieval query parameters . . . . . . . . . . 46 3.7. Additional retrieval query parameters . . . . . . . . . . 47
3.8. Attribute Notation . . . . . . . . . . . . . . . . . . . 47 3.8. Attribute Notation . . . . . . . . . . . . . . . . . . . 48
3.9. HTTP Response Codes . . . . . . . . . . . . . . . . . . . 47 3.9. HTTP Response Codes . . . . . . . . . . . . . . . . . . . 48
3.10. API Versioning . . . . . . . . . . . . . . . . . . . . . 50 3.10. API Versioning . . . . . . . . . . . . . . . . . . . . . 51
3.11. Versioning Resources . . . . . . . . . . . . . . . . . . 50 3.11. Versioning Resources . . . . . . . . . . . . . . . . . . 51
3.12. HTTP Method Overloading . . . . . . . . . . . . . . . . . 52 3.12. HTTP Method Overloading . . . . . . . . . . . . . . . . . 53
4. Multi-Tenancy . . . . . . . . . . . . . . . . . . . . . . . . 52 4. Multi-Tenancy . . . . . . . . . . . . . . . . . . . . . . . . 53
4.1. Associating Consumers to Tenants . . . . . . . . . . . . 53 4.1. Associating Consumers to Tenants . . . . . . . . . . . . 54
4.1.1. URL Prefix Example . . . . . . . . . . . . . . . . . 53 4.1.1. URL Prefix Example . . . . . . . . . . . . . . . . . 54
4.1.2. Subdomain Example . . . . . . . . . . . . . . . . . . 53 4.1.2. Subdomain Example . . . . . . . . . . . . . . . . . . 54
4.1.3. HTTP Header . . . . . . . . . . . . . . . . . . . . . 54 4.1.3. HTTP Header . . . . . . . . . . . . . . . . . . . . . 55
4.2. SCIM Identifiers with Multiple Tenants . . . . . . . . . 54 4.2. SCIM Identifiers with Multiple Tenants . . . . . . . . . 55
5. Security Considerations . . . . . . . . . . . . . . . . . . . 54 5. Security Considerations . . . . . . . . . . . . . . . . . . . 55
6. Contributors . . . . . . . . . . . . . . . . . . . . . . . . 54 6. Contributors . . . . . . . . . . . . . . . . . . . . . . . . 55
7. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 54 7. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 55
8.1. URIs . . . . . . . . . . . . . . . . . . . . . . . . . . 55 8.1. URIs . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 55 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 56
1. Introduction and Overview 1. Introduction and Overview
The SCIM Protocol is an application-level, REST protocol for The SCIM Protocol is an application-level, REST protocol for
provisioning and managing identity data on the web. The protocol provisioning and managing identity data on the web. The protocol
supports creation, modification, retrieval, and discovery of core supports creation, modification, retrieval, and discovery of core
identity Resources; i.e., Users and Groups, as well as custom identity Resources; i.e., Users and Groups, as well as custom
Resource extensions. Resource extensions.
1.1. Intended Audience 1.1. Intended Audience
skipping to change at page 10, line 46 skipping to change at page 10, line 46
"userName":"bjensen" "userName":"bjensen"
}, },
{ {
"userName":"jsmith" "userName":"jsmith"
} }
] ]
} }
3.2.2.1. Query Endpoints 3.2.2.1. Query Endpoints
Queries MAY be performed against a SCIM: Queries MAY be performed against a SCIM resources or resource
endpoints. For example:
Resource (e.g. /Users/{userid}), /Users/{userid}
/Users
Resource Type endpoint (e.g. /Users or /Groups), or /Groups
Server Root (e.g. /).
A search against a server root indicates that ALL resources within A server MAY support searches against the server root (e.g. "/"). A
the server SHALL be included subject to filtering. For example, a search against a server root indicates that ALL resources within the
filter against 'meta.resourceType' could be used to restrict results server SHALL be included subject to filtering. A filter expression
to one or more specific resource types. using 'meta.resourceType' could be used to restrict results to one or
more specific resource types.
When processing search operations across endpoints that include more When processing search operations across endpoints that include more
than one SCIM resource type (e.g. a search from the server root than one SCIM resource type (e.g. a search from the server root
endpoint), filters MUST be processed in the same fashion as outlined endpoint), filters MUST be processed in the same fashion as outlined
in Section 3.2.2.2. For filtered attributes that are not part of a in Section 3.2.2.2. For filtered attributes that are not part of a
particular resource type, the service provider SHALL treat the particular resource type, the service provider SHALL treat the
attribute as if there is no attribute value. For example, a presence attribute as if there is no attribute value. For example, a presence
or equality filter for an undefined attribute evaluates as FALSE. or equality filter for an undefined attribute evaluates as FALSE.
3.2.2.2. Filtering 3.2.2.2. Filtering
skipping to change at page 12, line 5 skipping to change at page 12, line 8
expressions can be grouped together using "()". expressions can be grouped together using "()".
The operators supported in the expression are listed in the following The operators supported in the expression are listed in the following
table. table.
+----------+-------------+------------------------------------------+ +----------+-------------+------------------------------------------+
| Operator | Description | Behavior | | Operator | Description | Behavior |
+----------+-------------+------------------------------------------+ +----------+-------------+------------------------------------------+
| eq | equal | The attribute and operator values must | | eq | equal | The attribute and operator values must |
| | | be identical for a match. | | | | be identical for a match. |
| ne | not equal | The attribute and operator values are |
| | | not identical. |
| co | contains | The entire operator value must be a | | co | contains | The entire operator value must be a |
| | | substring of the attribute value for a | | | | substring of the attribute value for a |
| | | match. | | | | match. |
| sw | starts with | The entire operator value must be a | | sw | starts with | The entire operator value must be a |
| | | substring of the attribute value, | | | | substring of the attribute value, |
| | | starting at the beginning of the | | | | starting at the beginning of the |
| | | attribute value. This criterion is | | | | attribute value. This criterion is |
| | | satisfied if the two strings are | | | | satisfied if the two strings are |
| | | identical. | | | | identical. |
| ew | ends with | The entire operator value must be a |
| | | substring of the attribute value, |
| | | matching at the end of the attribute |
| | | value. This criterion is satisfied if |
| | | the two strings are identical. |
| pr | present | If the attribute has a non-empty value, | | pr | present | If the attribute has a non-empty value, |
| | (has value) | or if it contains a non-empty node for | | | (has value) | or if it contains a non-empty node for |
| | | complex attributes there is a match. | | | | complex attributes there is a match. |
| gt | greater | If the attribute value is greater than | | gt | greater | If the attribute value is greater than |
| | than | operator value, there is a match. The | | | than | operator value, there is a match. The |
| | | actual comparison is dependent on the | | | | actual comparison is dependent on the |
| | | attribute type. For string attribute | | | | attribute type. For string attribute |
| | | types, this is a lexicographical | | | | types, this is a lexicographical |
| | | comparison and for DateTime types, it is | | | | comparison and for DateTime types, it is |
| | | a chronological comparison. | | | | a chronological comparison. |
skipping to change at page 13, line 12 skipping to change at page 13, line 20
Table 2: Attribute Operators Table 2: Attribute Operators
+----------+-------------+------------------------------------------+ +----------+-------------+------------------------------------------+
| Operator | Description | Behavior | | Operator | Description | Behavior |
+----------+-------------+------------------------------------------+ +----------+-------------+------------------------------------------+
| and | Logical And | The filter is only a match if both | | and | Logical And | The filter is only a match if both |
| | | expressions evaluate to true. | | | | expressions evaluate to true. |
| or | Logical or | The filter is a match if either | | or | Logical or | The filter is a match if either |
| | | expression evaluates to true. | | | | expression evaluates to true. |
| not | Not | The filter is a match if the expression |
| | function | evaluates to false. |
+----------+-------------+------------------------------------------+ +----------+-------------+------------------------------------------+
Table 3: Logical Operators Table 3: Logical Operators
+----------+-------------+------------------------------------------+ +----------+-------------+------------------------------------------+
| Operator | Description | Behavior | | Operator | Description | Behavior |
+----------+-------------+------------------------------------------+ +----------+-------------+------------------------------------------+
| () | Precedence | Boolean expressions may be grouped using | | () | Precedence | Boolean expressions may be grouped using |
| | grouping | parentheses to change the standard order | | | grouping | parentheses to change the standard order |
| | | of operations; i.e., evaluate OR logical | | | | of operations; i.e., evaluate OR logical |
| | | operators before logical AND operators. | | | | operators before logical AND operators. |
| [] | Complex | Service providers MAY support complex |
| | attribute | filters where expressions MUST be |
| | filter | applied to the same value of a parent |
| | grouping | attribute specified immediately before |
| | | the left square bracket ("["). The |
| | | expression within square brackets ("[" |
| | | and "]") MUST be a valid filter |
| | | expression based upon sub-attributes of |
| | | the parent attribute. Nested expressions |
| | | MAY be used. See examples below. |
+----------+-------------+------------------------------------------+ +----------+-------------+------------------------------------------+
Table 4: Grouping Operators Table 4: Grouping Operators
Filters MUST be evaluated using standard order of operations [6]. Filters MUST be evaluated using standard order of operations [6].
Attribute operators have the highest precedence, followed by the Attribute operators have the highest precedence, followed by the
grouping operator (i.e, parentheses), followed by the logical AND grouping operator (i.e, parentheses), followed by the logical AND
operator, followed by the logical OR operator. operator, followed by the logical OR operator.
If the specified attribute in a filter expression is a multi-valued If the specified attribute in a filter expression is a multi-valued
skipping to change at page 14, line 7 skipping to change at page 14, line 28
specified an unsupported operator named 'regex' the Service Provider specified an unsupported operator named 'regex' the Service Provider
should specify an error response description identifying the Consumer should specify an error response description identifying the Consumer
error; e.g., 'The operator 'regex' is not supported.' error; e.g., 'The operator 'regex' is not supported.'
String type attributes are case insensitive by default unless the String type attributes are case insensitive by default unless the
attribute type is defined as a caseExact string. Attribute operators attribute type is defined as a caseExact string. Attribute operators
'eq', 'co', and 'sw' MUST perform caseIgnore matching for all string 'eq', 'co', and 'sw' MUST perform caseIgnore matching for all string
attributes unless the attribute is defined as caseExact. By default attributes unless the attribute is defined as caseExact. By default
all string attributes are caseIgnore. all string attributes are caseIgnore.
Clients MAY search by schema or schema extensions by using a filter
expression including the "schemas" attribute.
Examples: Examples:
filter=userName eq "bjensen" filter=userName eq "bjensen"
filter=name.familyName co "O'Malley" filter=name.familyName co "O'Malley"
filter=userName sw "J" filter=userName sw "J"
filter=title pr filter=title pr
skipping to change at page 14, line 29 skipping to change at page 15, line 25
filter=meta.lastModified ge "2011-05-13T04:42:34Z" filter=meta.lastModified ge "2011-05-13T04:42:34Z"
filter=meta.lastModified lt "2011-05-13T04:42:34Z" filter=meta.lastModified lt "2011-05-13T04:42:34Z"
filter=meta.lastModified le "2011-05-13T04:42:34Z" filter=meta.lastModified le "2011-05-13T04:42:34Z"
filter=title pr and userType eq "Employee" filter=title pr and userType eq "Employee"
filter=title pr or userType eq "Intern" filter=title pr or userType eq "Intern"
filter=schemas eq "urn:scim:schemas:extension:enterprise:2.0:User"
filter=userType eq "Employee" and (emails co "example.com" or emails filter=userType eq "Employee" and (emails co "example.com" or emails
co "example.org") co "example.org")
filter=userType ne "Employee" and not (emails co "example.com" or
emails co "example.org")
filter=userType eq "Employee" and (emails.type eq "work")
filter=userType eq "Employee" and emails[type eq "work" and
value co "@example.com"]
filter=emails[type eq "work" and value co "@example.com"] or ims[type
eq "xmpp" and value co "@foo.com"]
filter=addresses[state eq "CA" and rooms[type eq "bedroom" and
number gt 2]]
3.2.2.3. Sorting 3.2.2.3. Sorting
Sort is OPTIONAL. Sorting allows Consumers to specify the order in Sort is OPTIONAL. Sorting allows Consumers to specify the order in
which Resources are returned by specifying a combination of sortBy which Resources are returned by specifying a combination of sortBy
and sortOrder URL parameters. and sortOrder URL parameters.
sortBy: The sortBy parameter specifies the attribute whose value sortBy: The sortBy parameter specifies the attribute whose value
SHALL be used to order the returned responses. If the sortBy SHALL be used to order the returned responses. If the sortBy
attribute corresponds to a Singular Attribute, Resources are attribute corresponds to a Singular Attribute, Resources are
sorted according to that attribute's value; if it's a Multi-valued sorted according to that attribute's value; if it's a Multi-valued
skipping to change at page 30, line 10 skipping to change at page 31, line 10
deleted resource in conflict calculation. For example if a User deleted resource in conflict calculation. For example if a User
resource is deleted, a CREATE request for a User resource with the resource is deleted, a CREATE request for a User resource with the
same userName as the previously deleted resource should not fail with same userName as the previously deleted resource should not fail with
a 409 error due to userName conflict. a 409 error due to userName conflict.
DELETE /Users/2819c223-7f76-453a-919d-413861904646 DELETE /Users/2819c223-7f76-453a-919d-413861904646
Host: example.com Host: example.com
Authorization: Bearer h480djs93hd8 Authorization: Bearer h480djs93hd8
If-Match: W/"c310cd84f0281b7" If-Match: W/"c310cd84f0281b7"
Server Response: In response to a successful delete, the server SHALL respond with
successful HTTP status 204 (No Content). A non-normative example
response:
HTTP/1.1 200 OK HTTP/1.1 204 No Content
Example: Consumer attempt to retrieve the previously deleted User Example: Consumer attempt to retrieve the previously deleted User
GET /Users/2819c223-7f76-453a-919d-413861904646 GET /Users/2819c223-7f76-453a-919d-413861904646
Host: example.com Host: example.com
Authorization: Bearer h480djs93hd8 Authorization: Bearer h480djs93hd8
Server Response: Server Response:
HTTP/1.1 404 NOT FOUND HTTP/1.1 404 NOT FOUND
skipping to change at page 35, line 40 skipping to change at page 36, line 40
"method": "PATCH", "method": "PATCH",
"version": "W\/\"huJj29dMNgu3WXPD\"", "version": "W\/\"huJj29dMNgu3WXPD\"",
"status": { "status": {
"code": "200" "code": "200"
} }
}, },
{ {
"location": "https://example.com/v1/Users/e9025315-6bea-44e1-899c-1e07454e468b", "location": "https://example.com/v1/Users/e9025315-6bea-44e1-899c-1e07454e468b",
"method": "DELETE", "method": "DELETE",
"status": { "status": {
"code": "200" "code": "204"
} }
} }
] ]
} }
The following response is returned if an error occurred when The following response is returned if an error occurred when
attempting to create the User 'Alice'. The Service Provider stops attempting to create the User 'Alice'. The Service Provider stops
processing the bulk operation and immediately returns a response to processing the bulk operation and immediately returns a response to
the Consumer. The response contains the error and any successful the Consumer. The response contains the error and any successful
results prior to the error. results prior to the error.
skipping to change at page 47, line 35 skipping to change at page 48, line 35
All operations share a common scheme for referencing simple and All operations share a common scheme for referencing simple and
complex attributes. In general, attributes are identified by complex attributes. In general, attributes are identified by
prefixing the attribute name with its schema URN separated by a ':' prefixing the attribute name with its schema URN separated by a ':'
character; e.g., the core User Resource attribute 'userName' is character; e.g., the core User Resource attribute 'userName' is
identified as 'urn:scim:schemas:core:2.0:userName'. Consumers MAY identified as 'urn:scim:schemas:core:2.0:userName'. Consumers MAY
omit core schema attribute URN prefixes though MUST fully qualify omit core schema attribute URN prefixes though MUST fully qualify
extended attributes with the associated Resource URN; e.g., the extended attributes with the associated Resource URN; e.g., the
attribute 'age' defined in 'urn:hr:schemas:user' is fully encoded as attribute 'age' defined in 'urn:hr:schemas:user' is fully encoded as
'urn:hr:schemas:user:age'. A Complex attributes' Sub-Attributes are 'urn:hr:schemas:user:age'. A Complex attributes' Sub-Attributes are
referenced via nested, dot ('.') notation; i.e., {urn}:{Attribute referenced via nested, dot ('.') notation; i.e., {urn}:{Attribute
name}.{Sub-Attribute name}. For example, the fully qualified path name}.{Sub-Attribute name}. For example, the fully qualified path for
for a User's givenName is urn:scim:schemas:core:2.0:name.givenName a User's givenName is urn:scim:schemas:core:2.0:name.givenName All
All facets (URN, attribute and Sub-Attribute name) of the fully facets (URN, attribute and Sub-Attribute name) of the fully encoded
encoded Attribute name are case insensitive. Attribute name are case insensitive.
3.9. HTTP Response Codes 3.9. HTTP Response Codes
The SCIM Protocol uses the response status codes defined in HTTP [12] The SCIM Protocol uses the response status codes defined in HTTP [12]
to indicate operation success or failure. In addition to returning a to indicate operation success or failure. In addition to returning a
HTTP response code implementers MUST return the errors in the body of HTTP response code implementers MUST return the errors in the body of
the response in the client requested format containing the error the response in the client requested format containing the error
response and, per the HTTP specification, human-readable response and, per the HTTP specification, human-readable
explanations. Error responses are identified using the following explanations. Error responses are identified using the following
URI: 'urn:scim:schemas:core:2.0:Error'. The following multi-valued URI: 'urn:scim:schemas:core:2.0:Error'. The following multi-valued
 End of changes. 17 change blocks. 
40 lines changed or deleted 82 lines changed or added

This html diff was produced by rfcdiff 1.41. The latest version is available from http://tools.ietf.org/tools/rfcdiff/
--Apple-Mail=_94FF3956-4169-4DAF-8B9C-EE890E260727 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On 2014-02-05, at 10:16 AM, Bjorn Aannestad = wrote: > It might be here: > https://go.webex.com/go/j.php?ED=3D153193777&UID=3D-1&RT=3DMiM0 >=20 > 11 Pacific. >=20 > -Bjorn >=20 > On 2014-02-05 11:01 AM, Phil Hunt wrote: >> Details? >>=20 >> Phil >> _______________________________________________ >> scim mailing list >> scim@ietf.org >> https://www.ietf.org/mailman/listinfo/scim >=20 > _______________________________________________ > scim mailing list > scim@ietf.org > https://www.ietf.org/mailman/listinfo/scim --Apple-Mail=_94FF3956-4169-4DAF-8B9C-EE890E260727-- From leifj@mnt.se Wed Feb 5 10:39:32 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C3861A0138 for ; Wed, 5 Feb 2014 10:39:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8mQkRKE0dxGF for ; Wed, 5 Feb 2014 10:39:30 -0800 (PST) Received: from mail-la0-f54.google.com (mail-la0-f54.google.com [209.85.215.54]) by ietfa.amsl.com (Postfix) with ESMTP id 566531A0174 for ; Wed, 5 Feb 2014 10:39:30 -0800 (PST) Received: by mail-la0-f54.google.com with SMTP id y1so638990lam.41 for ; Wed, 05 Feb 2014 10:39:28 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:cc:content-transfer-encoding:message-id:references :to; bh=XNDf+6EAD9N8LXuVwCq68U8nDG2PTsStX1A7ksfYa5A=; b=SdHpvh460WFFvNpER1o49Rt16SAbeduVazhuJmdphDIK5BFoF+VZeajOFkL+C52Ltc R9cPa4m7vnuOQ8Wga2N7t1NT4Teh63ZVQn2/dzsr2Xw5NdlpgseFhsDDzBeIYfZGE3pv oLSdaZ9nfm39UvczM19V71zivhH/SQBf5iFSBUUthONR2baTHkuxJT0VEeklLXXr8peh jVT+s/gPyTeR1msbL4VTt7dPNaZYXf/wl71F4GkO0BFsyYuSD71zQamB8aAszT4Olqgt yFzJu1Do++icE2Q/cm3KaB2bxMaAMCY4NIXN5mITQgIPqj98Si/5XBwV4ecbSeItzJMr 2Xow== X-Gm-Message-State: ALoCoQmOYBK8jaqK7oOD7PyLidSHp1rKLE158dTxppjL7GadYcwFsjJ519BzRmG3yAODbV/FQFXI X-Received: by 10.112.72.170 with SMTP id e10mr1934244lbv.43.1391625568850; Wed, 05 Feb 2014 10:39:28 -0800 (PST) Received: from [10.0.0.143] (tb62-102-145-131.cust.teknikbyran.com. [62.102.145.131]) by mx.google.com with ESMTPSA id e1sm15146554laa.8.2014.02.05.10.39.27 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 05 Feb 2014 10:39:28 -0800 (PST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Leif Johansson X-Mailer: iPhone Mail (11B601) In-Reply-To: Date: Wed, 5 Feb 2014 19:39:29 +0100 Content-Transfer-Encoding: 7bit Message-Id: <7F7F895E-455D-450D-876E-B6AB466599D6@mnt.se> References: To: Phil Hunt Cc: "scim@ietf.org WG" Subject: Re: [scim] Call today? X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 18:39:32 -0000 > 5 feb 2014 kl. 18:01 skrev Phil Hunt : > > Details? > its next week right? > Phil > _______________________________________________ > scim mailing list > scim@ietf.org > https://www.ietf.org/mailman/listinfo/scim From phil.hunt@oracle.com Wed Feb 5 11:12:07 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7DDEE1A00EB for ; Wed, 5 Feb 2014 11:12:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.735 X-Spam-Level: X-Spam-Status: No, score=-4.735 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EeZzv_y7iWCo for ; Wed, 5 Feb 2014 11:12:05 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) by ietfa.amsl.com (Postfix) with ESMTP id C21E31A0122 for ; Wed, 5 Feb 2014 11:12:05 -0800 (PST) Received: from ucsinet22.oracle.com (ucsinet22.oracle.com [156.151.31.94]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s15JC49T005181 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Wed, 5 Feb 2014 19:12:05 GMT Received: from userz7021.oracle.com (userz7021.oracle.com [156.151.31.85]) by ucsinet22.oracle.com (8.14.5+Sun/8.14.5) with ESMTP id s15JC4eJ010712 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Wed, 5 Feb 2014 19:12:04 GMT Received: from abhmp0012.oracle.com (abhmp0012.oracle.com [141.146.116.18]) by userz7021.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s15JC3mC010381 for ; Wed, 5 Feb 2014 19:12:04 GMT Received: from [192.168.1.124] (/24.86.29.34) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 05 Feb 2014 11:12:03 -0800 From: Phil Hunt Content-Type: multipart/alternative; boundary="Apple-Mail=_8BB6F91D-3D23-4459-9DF9-13DFA48696A3" Message-Id: <77B9AB0F-9387-4320-AB97-F3CBF9F3776E@oracle.com> Date: Wed, 5 Feb 2014 11:12:04 -0800 To: "scim@ietf.org WG" Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\)) X-Mailer: Apple Mail (2.1510) X-Source-IP: ucsinet22.oracle.com [156.151.31.94] Subject: [scim] ResourceTypes endpoint X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 19:12:07 -0000 --Apple-Mail=_8BB6F91D-3D23-4459-9DF9-13DFA48696A3 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 Should objects returned from ResourceTypes endpoint not have an "id". =46rom draft 02=85 { "schemas": ["urn:scim:schemas:core:2.0:ResourceType"], "name": "User", "endpoint": "/Users", "description": "Core User", "schema": "urn:scim:schemas:core:2.0:User", "schemaExtensions": [ { "schema": = "urn:scim:schemas:extension:enterprise:2.0:EnterpriseUser", "required": true } ], "meta": { "resourceType": "ResourceType", "created": "2010-01-23T04:56:22Z", "lastModified": "2011-05-13T04:42:34Z", "version": "W\/\"3694e05e9dff595\"" } } Should this item have a location of: "location":"https://example.com/v2/ResourceTypes/User" Phil @independentid www.independentid.com phil.hunt@oracle.com --Apple-Mail=_8BB6F91D-3D23-4459-9DF9-13DFA48696A3 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=windows-1252
=46rom draft = 02=85

{
  "schemas": = ["urn:scim:schemas:core:2.0:ResourceType"],
  "name": = "User",
  "endpoint": "/Users",
  = "description": "Core User",
  "schema": = "urn:scim:schemas:core:2.0:User",
  "schemaExtensions": = [
    {
      "schema": = "urn:scim:schemas:extension:enterprise:2.0:EnterpriseUser",
&nbs= p;     "required": true
    = }
  ],
  "meta": {
    = "resourceType": "ResourceType",
    "created": = "2010-01-23T04:56:22Z",
    "lastModified": = "2011-05-13T04:42:34Z",
    "version": = "W\/\"3694e05e9dff595\""
  = }
}

Should this item have a location = of:

= --Apple-Mail=_8BB6F91D-3D23-4459-9DF9-13DFA48696A3-- From leifj@mnt.se Wed Feb 5 11:21:56 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3F2CB1A00EB for ; Wed, 5 Feb 2014 11:21:56 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KgxzWxLFqbts for ; Wed, 5 Feb 2014 11:21:54 -0800 (PST) Received: from mail-lb0-f181.google.com (mail-lb0-f181.google.com [209.85.217.181]) by ietfa.amsl.com (Postfix) with ESMTP id 504191A0117 for ; Wed, 5 Feb 2014 11:21:53 -0800 (PST) Received: by mail-lb0-f181.google.com with SMTP id z5so670915lbh.40 for ; Wed, 05 Feb 2014 11:21:51 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:message-id:date:from:user-agent:mime-version:to :subject:references:in-reply-to:content-type; bh=STwRxHX6Xh0qFqPVa5Nhpc0RH+Kpi+7fKFXCiS0uKOg=; b=HnP0+cf7woDpQpolguuRswIbaWjwHQ4ZGQ9itvgBZDmkU5PlZ+7p6YWEcvHaHn3zWb 7hlyQMjvukKkHA/I5a0sVuyaBeW8eHxvydqv7iE0uPgpzc5BD1PieN+roeid52eObRkN t/ergQyPSiRJ1imZeKSK/k6EYsugg7FtU0/jR5yo6ktgMUuII2EcGJq4sHPeet3F9bYI KWKYU0TozRCBskKd5Bor5g25u5blBqbv2r/q2P5Og+cFgof/Ij+gpPdEt0VxYkEMZ+p8 8lclkH8BkDLkm7nQ64GvXQqT0BE4T3M/JSTJdXy7uBixO2pwaJeG3GWMV8ruxSIF49fA Igzg== X-Gm-Message-State: ALoCoQnidS9rAhm16D6Gi3Te5R4V1qMz/PELHJKVehuhKPhKwvxEaZJ4yeWXljYUYF7DV8bwXUkn X-Received: by 10.152.170.135 with SMTP id am7mr2240656lac.23.1391628111791; Wed, 05 Feb 2014 11:21:51 -0800 (PST) Received: from [10.0.0.112] (tb62-102-145-131.cust.teknikbyran.com. [62.102.145.131]) by mx.google.com with ESMTPSA id mo3sm30147062lbb.17.2014.02.05.11.21.51 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 05 Feb 2014 11:21:51 -0800 (PST) Message-ID: <52F28F4E.8060305@mnt.se> Date: Wed, 05 Feb 2014 20:21:50 +0100 From: Leif Johansson User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0 MIME-Version: 1.0 To: scim@ietf.org References: <77B9AB0F-9387-4320-AB97-F3CBF9F3776E@oracle.com> In-Reply-To: <77B9AB0F-9387-4320-AB97-F3CBF9F3776E@oracle.com> X-Enigmail-Version: 1.6 Content-Type: multipart/alternative; boundary="------------050201060402040404040304" Subject: Re: [scim] ResourceTypes endpoint X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 19:21:56 -0000 This is a multi-part message in MIME format. --------------050201060402040404040304 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit On 2014-02-05 20:12, Phil Hunt wrote: > Should objects returned from ResourceTypes endpoint not have an "id". > consistency is always nice... > From draft 02... > > { > "schemas": ["urn:scim:schemas:core:2.0:ResourceType"], > "name": "User", > "endpoint": "/Users", > "description": "Core User", > "schema": "urn:scim:schemas:core:2.0:User", > "schemaExtensions": [ > { > "schema": > "urn:scim:schemas:extension:enterprise:2.0:EnterpriseUser", > "required": true > } > ], > "meta": { > "resourceType": "ResourceType", > "created": "2010-01-23T04:56:22Z", > "lastModified": "2011-05-13T04:42:34Z", > "version": "W\/\"3694e05e9dff595\"" > } > } > > Should this item have a location of: > "location":"https://example.com/v2/ResourceTypes/User" > > Phil > > @independentid > www.independentid.com > phil.hunt@oracle.com > > > > _______________________________________________ > scim mailing list > scim@ietf.org > https://www.ietf.org/mailman/listinfo/scim --------------050201060402040404040304 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit
On 2014-02-05 20:12, Phil Hunt wrote:
Should objects returned from ResourceTypes endpoint not have an "id".

consistency is always nice...
From draft 02…

{
  "schemas": ["urn:scim:schemas:core:2.0:ResourceType"],
  "name": "User",
  "endpoint": "/Users",
  "description": "Core User",
  "schema": "urn:scim:schemas:core:2.0:User",
  "schemaExtensions": [
    {
      "schema": "urn:scim:schemas:extension:enterprise:2.0:EnterpriseUser",
      "required": true
    }
  ],
  "meta": {
    "resourceType": "ResourceType",
    "created": "2010-01-23T04:56:22Z",
    "lastModified": "2011-05-13T04:42:34Z",
    "version": "W\/\"3694e05e9dff595\""
  }
}

Should this item have a location of:




_______________________________________________
scim mailing list
scim@ietf.org
https://www.ietf.org/mailman/listinfo/scim

--------------050201060402040404040304-- From evzijst@atlassian.com Wed Feb 5 15:35:26 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 987F11A0258 for ; Wed, 5 Feb 2014 15:35:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.579 X-Spam-Level: X-Spam-Status: No, score=-3.579 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l-jRJ11cec2M for ; Wed, 5 Feb 2014 15:35:24 -0800 (PST) Received: from na3sys009aog104.obsmtp.com (na3sys009aog104.obsmtp.com [74.125.149.73]) by ietfa.amsl.com (Postfix) with SMTP id 4E3911A0141 for ; Wed, 5 Feb 2014 15:35:24 -0800 (PST) Received: from mail-la0-f50.google.com ([209.85.215.50]) (using TLSv1) by na3sys009aob104.postini.com ([74.125.148.12]) with SMTP ID DSNKUvLKu0UGT2vgiXiA9ZhlCfrKdBShQHUx@postini.com; Wed, 05 Feb 2014 15:35:24 PST Received: by mail-la0-f50.google.com with SMTP id ec20so883390lab.37 for ; Wed, 05 Feb 2014 15:35:22 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:date:message-id:subject:from:to :content-type; bh=K/cZVMhn99xu/JgifnFxGdCCRThuncgAAn1rUwGhEL4=; b=hkpgQarpYxwqmbPEwgypC3hyCIj0EF4npxFRZV1kEDhjtjr1d8TR+Bn4x4mI2fMmeN hTAbLRWjNBdJ8ZLJflaHh0zdfcuzEvSLO25AAw/oOV5vzinbmUMbE+lDcPwi0N42ceEV mdZREhruU2kfBSM8L7PeckRmEbUKA2zERZDD5UkLd8Bxb/V16fsAjk4OtOV5I6lQdufF 6SdOXx4oJjqZn2hyHTio32IYPNPR0eBBg4wOStv5yArNBt+kunkSZfvgQuDKRg5p+c0j VW4NFbQowR19P1xXb5C13PBTn1Lp4hADgQrDAHlBv9gwTP3kQrs0ksli/RLBeTEvWOrH fAhA== X-Gm-Message-State: ALoCoQne/npSAgHJySRr5hn7b8CaDtTEHgPfZ1YHgIVlP2evp/In2UZu7WnqBf2KS+vz+rpXHPZ6PKqdFL0aGH+u9CgAanIytfZRkZKNV3cUwo5GqE1C67KL9B4LRVWXygX/PX0D4UcVrNjAHJMqNZ6wi5xbujLGHQ== X-Received: by 10.112.205.5 with SMTP id lc5mr38483lbc.40.1391643322102; Wed, 05 Feb 2014 15:35:22 -0800 (PST) MIME-Version: 1.0 X-Received: by 10.112.205.5 with SMTP id lc5mr38479lbc.40.1391643321974; Wed, 05 Feb 2014 15:35:21 -0800 (PST) Received: by 10.114.61.111 with HTTP; Wed, 5 Feb 2014 15:35:21 -0800 (PST) Date: Wed, 5 Feb 2014 15:35:21 -0800 Message-ID: From: Erik van Zijst To: scim@ietf.org Content-Type: text/plain; charset=UTF-8 Subject: [scim] Python-based SCIM Filter Query Parser X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 23:37:26 -0000 Hi folks, We're looking at incorporating SCIM at Atlassian and not wanting to reinvent the wheel I noticed that the list of open source implementations for languages other than Java is currently rather lacking. We do a fair bit in Python and took it upon ourselves to roll an open source server-side implementation. It currently offers only a limited set of features, but it does include a parser for the query filter language and a few REST endpoints. As I spent quite a bit of time looking for existing code and then writing our own library, I figured I'd share it here. It's aimed at being used with Django, but it should be easy enough to butcher it up for use elsewhere. The project is called django_scim and is released under the MIT license. The code lives at https://bitbucket.org/atlassian/django_scim Cheers, Erik From kelly.grizzle@sailpoint.com Wed Feb 5 18:53:16 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9F5C91A0340 for ; Wed, 5 Feb 2014 18:53:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z3qD-0VgA7SG for ; Wed, 5 Feb 2014 18:53:14 -0800 (PST) Received: from na01-by2-obe.outbound.protection.outlook.com (mail-by2lp0239.outbound.protection.outlook.com [207.46.163.239]) by ietfa.amsl.com (Postfix) with ESMTP id F09411A0214 for ; Wed, 5 Feb 2014 18:53:13 -0800 (PST) Received: from BN1PR04MB392.namprd04.prod.outlook.com (10.141.60.151) by BN1PR04MB277.namprd04.prod.outlook.com (10.141.64.141) with Microsoft SMTP Server (TLS) id 15.0.868.8; Thu, 6 Feb 2014 02:53:12 +0000 Received: from BN1PR04MB392.namprd04.prod.outlook.com (10.141.60.151) by BN1PR04MB392.namprd04.prod.outlook.com (10.141.60.151) with Microsoft SMTP Server (TLS) id 15.0.868.8; Thu, 6 Feb 2014 02:53:11 +0000 Received: from BN1PR04MB392.namprd04.prod.outlook.com ([169.254.10.68]) by BN1PR04MB392.namprd04.prod.outlook.com ([169.254.10.222]) with mapi id 15.00.0868.013; Thu, 6 Feb 2014 02:53:11 +0000 From: Kelly Grizzle To: Leif Johansson , "scim@ietf.org" Thread-Topic: [scim] ResourceTypes endpoint Thread-Index: AQHPIqYt11xxl/ENDku2Sv5P6n2WG5qnCb0AgAB9EzA= Date: Thu, 6 Feb 2014 02:53:09 +0000 Message-ID: <98ce8fe094564bf0b0535f87bdeac751@BN1PR04MB392.namprd04.prod.outlook.com> References: <77B9AB0F-9387-4320-AB97-F3CBF9F3776E@oracle.com> <52F28F4E.8060305@mnt.se> In-Reply-To: <52F28F4E.8060305@mnt.se> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [72.182.10.254] x-forefront-prvs: 0114FF88F6 x-forefront-antispam-report: SFV:NSPM; SFS:(10009001)(24454002)(377424004)(189002)(199002)(377454003)(85306002)(74706001)(76482001)(74502001)(74316001)(51856001)(2656002)(63696002)(79102001)(15202345003)(54356001)(19300405004)(31966008)(76786001)(56776001)(54316002)(76576001)(19580395003)(76796001)(19580405001)(95416001)(83322001)(53806001)(80976001)(74876001)(46102001)(47446002)(33646001)(94946001)(74662001)(77096001)(87936001)(16236675002)(15975445006)(87266001)(80022001)(83072002)(59766001)(65816001)(81342001)(81542001)(94316002)(81686001)(93136001)(16601075003)(77982001)(66066001)(92566001)(74366001)(56816005)(93516002)(81816001)(4396001)(47736001)(86362001)(69226001)(49866001)(90146001)(85852003)(47976001)(50986001)(24736002); DIR:OUT; SFP:1101; SCL:1; SRVR:BN1PR04MB392; H:BN1PR04MB392.namprd04.prod.outlook.com; CLIP:72.182.10.254; FPR:6CCEC526.8C327CC0.C1D2BD47.48E8FB40.20286; InfoNoRecordsMX:1; A:1; LANG:en; Content-Type: multipart/alternative; boundary="_000_98ce8fe094564bf0b0535f87bdeac751BN1PR04MB392namprd04pro_" MIME-Version: 1.0 X-OriginatorOrg: sailpoint.com Subject: Re: [scim] ResourceTypes endpoint X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Feb 2014 02:53:16 -0000 --_000_98ce8fe094564bf0b0535f87bdeac751BN1PR04MB392namprd04pro_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable The reason the ID was left off of the configuration-related objects was to = promote interoperability and normative definitions. Currently, neither Sch= emas, ResourceTypes, or ServiceProviderConfigs have IDs. ServiceProviderCo= nfigs is a bit strange because it is really more of a singleton object. Re= sourceTypes and Schemas both use names for their IDs so they can easily be = exchanged between servers. Not sure if this is a good thing or not, but th= at is the reasoning behind why it is the way that it is. --Kelly From: scim [mailto:scim-bounces@ietf.org] On Behalf Of Leif Johansson Sent: Wednesday, February 05, 2014 1:22 PM To: scim@ietf.org Subject: Re: [scim] ResourceTypes endpoint On 2014-02-05 20:12, Phil Hunt wrote: Should objects returned from ResourceTypes endpoint not have an "id". consistency is always nice... >From draft 02... { "schemas": ["urn:scim:schemas:core:2.0:ResourceType"], "name": "User", "endpoint": "/Users", "description": "Core User", "schema": "urn:scim:schemas:core:2.0:User", "schemaExtensions": [ { "schema": "urn:scim:schemas:extension:enterprise:2.0:EnterpriseUser", "required": true } ], "meta": { "resourceType": "ResourceType", "created": "2010-01-23T04:56:22Z", "lastModified": "2011-05-13T04:42:34Z", "version": "W\/\"3694e05e9dff595\"" } } Should this item have a location of: "location":"https://example.com/v2/ResourceTypes/User" Phil @independentid www.independentid.com phil.hunt@oracle.com _______________________________________________ scim mailing list scim@ietf.org https://www.ietf.org/mailman/listinfo/scim --_000_98ce8fe094564bf0b0535f87bdeac751BN1PR04MB392namprd04pro_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

The reason the ID was lef= t off of the configuration-related objects was to promote interoperability = and normative definitions.  Currently, neither Schemas, ResourceTypes, or ServiceProviderConfigs have IDs.  ServiceProviderCo= nfigs is a bit strange because it is really more of a singleton object.&nbs= p; ResourceTypes and Schemas both use names for their IDs so they can easil= y be exchanged between servers.  Not sure if this is a good thing or not, but that is the reasoning behind why it is= the way that it is.

 <= /p>

--Kelly=

 <= /p>

From: scim [mailto:scim-bounces@ietf.org] On Behalf Of Leif Johansson
Sent: Wednesday, February 05, 2014 1:22 PM
To: scim@ietf.org
Subject: Re: [scim] ResourceTypes endpoint

 

On 2014-02-05 20:12, Phil Hunt wrote:

Should objects returned from ResourceTypes endpoint = not have an "id".

 

consistency is always nice...

From draft 02…

 

{

  "schemas": ["urn:scim:schemas:= core:2.0:ResourceType"],

  "name": "User",

  "endpoint": "/Users",

  "description": "Core User"= ;,

  "schema": "urn:scim:schemas:co= re:2.0:User",

  "schemaExtensions": [

    {

      "schema": "urn:s= cim:schemas:extension:enterprise:2.0:EnterpriseUser",

      "required": true=

    }

  ],

  "meta": {

    "resourceType": "Resour= ceType",

    "created": "2010-01-23T= 04:56:22Z",

    "lastModified": "2011-0= 5-13T04:42:34Z",

    "version": "W\/\"3= 694e05e9dff595\""

  }

}

 

Should this item have a location of:

 

 




_______________________________________________
scim mailing list
scim@ietf.org
https://www.iet=
f.org/mailman/listinfo/scim

 

--_000_98ce8fe094564bf0b0535f87bdeac751BN1PR04MB392namprd04pro_-- From phil.hunt@oracle.com Wed Feb 5 18:59:03 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6CB251A0343 for ; Wed, 5 Feb 2014 18:59:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.734 X-Spam-Level: X-Spam-Status: No, score=-4.734 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G0l7GC-HT9t1 for ; Wed, 5 Feb 2014 18:59:01 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) by ietfa.amsl.com (Postfix) with ESMTP id A76A31A0238 for ; Wed, 5 Feb 2014 18:59:01 -0800 (PST) Received: from ucsinet21.oracle.com (ucsinet21.oracle.com [156.151.31.93]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s162x0pZ013511 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Thu, 6 Feb 2014 02:59:00 GMT Received: from aserz7021.oracle.com (aserz7021.oracle.com [141.146.126.230]) by ucsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s162wwe8007865 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 6 Feb 2014 02:58:59 GMT Received: from abhmp0019.oracle.com (abhmp0019.oracle.com [141.146.116.25]) by aserz7021.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s162wwXC028363; Thu, 6 Feb 2014 02:58:58 GMT Received: from [10.98.86.121] (/24.244.23.176) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 05 Feb 2014 18:58:58 -0800 References: <77B9AB0F-9387-4320-AB97-F3CBF9F3776E@oracle.com> <52F28F4E.8060305@mnt.se> <98ce8fe094564bf0b0535f87bdeac751@BN1PR04MB392.namprd04.prod.outlook.com> Mime-Version: 1.0 (1.0) In-Reply-To: <98ce8fe094564bf0b0535f87bdeac751@BN1PR04MB392.namprd04.prod.outlook.com> Content-Type: multipart/alternative; boundary=Apple-Mail-3FF0A3E6-D5B2-4C13-906D-A47C5C538048 Content-Transfer-Encoding: 7bit Message-Id: X-Mailer: iPhone Mail (11B554a) From: Phil Hunt Date: Wed, 5 Feb 2014 18:58:53 -0800 To: Kelly Grizzle X-Source-IP: ucsinet21.oracle.com [156.151.31.93] Cc: Leif Johansson , "scim@ietf.org" Subject: Re: [scim] ResourceTypes endpoint X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Feb 2014 02:59:03 -0000 --Apple-Mail-3FF0A3E6-D5B2-4C13-906D-A47C5C538048 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hmmm. When i checked all the others, they had id's. Some used simple name ot= hers used the fully qualified schema name. Go figure.=20 Phil > On Feb 5, 2014, at 18:53, Kelly Grizzle wrot= e: >=20 > The reason the ID was left off of the configuration-related objects was to= promote interoperability and normative definitions. Currently, neither Sch= emas, ResourceTypes, or ServiceProviderConfigs have IDs. ServiceProviderCon= figs is a bit strange because it is really more of a singleton object. Reso= urceTypes and Schemas both use names for their IDs so they can easily be exc= hanged between servers. Not sure if this is a good thing or not, but that i= s the reasoning behind why it is the way that it is. > =20 > --Kelly > =20 > From: scim [mailto:scim-bounces@ietf.org] On Behalf Of Leif Johansson > Sent: Wednesday, February 05, 2014 1:22 PM > To: scim@ietf.org > Subject: Re: [scim] ResourceTypes endpoint > =20 > On 2014-02-05 20:12, Phil Hunt wrote: > Should objects returned from ResourceTypes endpoint not have an "id". > =20 > consistency is always nice... >=20 > =46rom draft 02=E2=80=A6 > =20 > { > "schemas": ["urn:scim:schemas:core:2.0:ResourceType"], > "name": "User", > "endpoint": "/Users", > "description": "Core User", > "schema": "urn:scim:schemas:core:2.0:User", > "schemaExtensions": [ > { > "schema": "urn:scim:schemas:extension:enterprise:2.0:EnterpriseUser"= , > "required": true > } > ], > "meta": { > "resourceType": "ResourceType", > "created": "2010-01-23T04:56:22Z", > "lastModified": "2011-05-13T04:42:34Z", > "version": "W\/\"3694e05e9dff595\"" > } > } > =20 > Should this item have a location of: > "location":"https://example.com/v2/ResourceTypes/User" > =20 > Phil > =20 > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 >=20 >=20 >=20 > _______________________________________________ > scim mailing list > scim@ietf.org > https://www.ietf.org/mailman/listinfo/scim > =20 > _______________________________________________ > scim mailing list > scim@ietf.org > https://www.ietf.org/mailman/listinfo/scim --Apple-Mail-3FF0A3E6-D5B2-4C13-906D-A47C5C538048 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Hmmm. When i checked all the others, t= hey had id's. Some used simple name others used the fully qualified schema n= ame. Go figure. 

Phil

On Feb 5, 2014, at 18:53, Ke= lly Grizzle <kelly.grizzle= @sailpoint.com> wrote:

=

The reason the ID was left o= ff of the configuration-related objects was to promote interoperability and n= ormative definitions.  Currently, neither Schemas, ResourceTypes, or ServiceProviderConfigs have IDs.  ServiceProviderCon= figs is a bit strange because it is really more of a singleton object. = ResourceTypes and Schemas both use names for their IDs so they can easily b= e exchanged between servers.  Not sure if this is a good thing or not, but that is the reasoning behind why it is t= he way that it is.

 

--Kelly

 

From: scim [mailto:= scim-bounces@ietf.org] On Behalf Of Leif Johansson
Sent: Wednesday, February 05, 2014 1:22 PM
To: scim@ietf.org
Subject: Re: [scim] ResourceTypes endpoint

 

On 2014-02-05 20:12, Phil Hunt wrote:

Should objects returned from ResourceTypes endpoint n= ot have an "id".

 

consistency is always nice...

=46rom draft 02=E2=80=A6

 

{

  "schemas": ["urn:scim:schemas:core:2.0:Resourc= eType"],

  "name": "User",

  "endpoint": "/Users",

  "description": "Core User",

  "schema": "urn:scim:schemas:core:2.0:User",

  "schemaExtensions": [

    {

      "schema": "urn:scim:schemas:exte= nsion:enterprise:2.0:EnterpriseUser",

      "required": true

    }

  ],

  "meta": {

    "resourceType": "ResourceType",

    "created": "2010-01-23T04:56:22Z",=

    "lastModified": "2011-05-13T04:42:34Z",=

    "version": "W\/\"3694e05e9dff595\""

  }

}

 

Should this item have a location of:

 

 




_______________________________________________
scim mailing list
scim@ietf.org
https://www.ietf=
.org/mailman/listinfo/scim

 

____________________= ___________________________
scim mailing list
scim@ietf.org
https://www.ietf.org/mailman= /listinfo/scim
= --Apple-Mail-3FF0A3E6-D5B2-4C13-906D-A47C5C538048-- From phil.hunt@oracle.com Thu Feb 6 14:27:37 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 26C211A03C4 for ; Thu, 6 Feb 2014 14:27:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.735 X-Spam-Level: X-Spam-Status: No, score=-4.735 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uEX2Ws2hS_ON for ; Thu, 6 Feb 2014 14:27:34 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) by ietfa.amsl.com (Postfix) with ESMTP id A3B061A01CA for ; Thu, 6 Feb 2014 14:27:34 -0800 (PST) Received: from acsinet21.oracle.com (acsinet21.oracle.com [141.146.126.237]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s16MRV6x019260 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Thu, 6 Feb 2014 22:27:33 GMT Received: from userz7021.oracle.com (userz7021.oracle.com [156.151.31.85]) by acsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s16MRRsL001661 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Thu, 6 Feb 2014 22:27:28 GMT Received: from abhmp0006.oracle.com (abhmp0006.oracle.com [141.146.116.12]) by userz7021.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s16MRQMo007535; Thu, 6 Feb 2014 22:27:26 GMT Received: from [192.168.1.124] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 06 Feb 2014 14:27:26 -0800 Content-Type: multipart/alternative; boundary="Apple-Mail=_0357964A-083F-4860-96F3-23D170FE72D9" Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\)) From: Phil Hunt In-Reply-To: <98ce8fe094564bf0b0535f87bdeac751@BN1PR04MB392.namprd04.prod.outlook.com> Date: Thu, 6 Feb 2014 14:27:25 -0800 Message-Id: <790F492B-02E7-4BC6-934D-87173B769649@oracle.com> References: <77B9AB0F-9387-4320-AB97-F3CBF9F3776E@oracle.com> <52F28F4E.8060305@mnt.se> <98ce8fe094564bf0b0535f87bdeac751@BN1PR04MB392.namprd04.prod.outlook.com> To: Kelly Grizzle X-Mailer: Apple Mail (2.1510) X-Source-IP: acsinet21.oracle.com [141.146.126.237] Cc: Leif Johansson , "scim@ietf.org WG" Subject: Re: [scim] ResourceTypes endpoint X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Feb 2014 22:27:37 -0000 --Apple-Mail=_0357964A-083F-4860-96F3-23D170FE72D9 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 Kelly, I see more clearly what the issue is now. Except in one case, all the = examples had an "id". Reading the text, it says ResourceType and = ServiceProviderConfig do not require ids. The way I interpret that is = that "id"s are still acceptable. However, I think for consistency, it would be ok for = ServiceProviderConfig not to have an id since it is a singleton (it is = references by simply /ServiceProviderConfig ). But, ResourceTypes like = other resources and is addressed as /ResourceTypes/{identifier} Would it be ok, in an effort to be consistent, to allow use of {id}? = What I have done is leave the text in saying 'id' is not required, but = the name is. I've also said they are often the same. The examples can = stay with the id and there is no requirement to upgrade.=20 Will this work for everyone? In these situations, sometimes it is hard to tell what is consistent and = what is inconsistent. 8-) Phil @independentid www.independentid.com phil.hunt@oracle.com On 2014-02-05, at 6:53 PM, Kelly Grizzle = wrote: > The reason the ID was left off of the configuration-related objects = was to promote interoperability and normative definitions. Currently, = neither Schemas, ResourceTypes, or ServiceProviderConfigs have IDs. = ServiceProviderConfigs is a bit strange because it is really more of a = singleton object. ResourceTypes and Schemas both use names for their = IDs so they can easily be exchanged between servers. Not sure if this = is a good thing or not, but that is the reasoning behind why it is the = way that it is. > =20 > --Kelly > =20 > From: scim [mailto:scim-bounces@ietf.org] On Behalf Of Leif Johansson > Sent: Wednesday, February 05, 2014 1:22 PM > To: scim@ietf.org > Subject: Re: [scim] ResourceTypes endpoint > =20 > On 2014-02-05 20:12, Phil Hunt wrote: > Should objects returned from ResourceTypes endpoint not have an "id". > =20 > consistency is always nice... >=20 > =46rom draft 02=85 > =20 > { > "schemas": ["urn:scim:schemas:core:2.0:ResourceType"], > "name": "User", > "endpoint": "/Users", > "description": "Core User", > "schema": "urn:scim:schemas:core:2.0:User", > "schemaExtensions": [ > { > "schema": = "urn:scim:schemas:extension:enterprise:2.0:EnterpriseUser", > "required": true > } > ], > "meta": { > "resourceType": "ResourceType", > "created": "2010-01-23T04:56:22Z", > "lastModified": "2011-05-13T04:42:34Z", > "version": "W\/\"3694e05e9dff595\"" > } > } > =20 > Should this item have a location of: > "location":"https://example.com/v2/ResourceTypes/User" > =20 > Phil > =20 > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 >=20 >=20 >=20 > _______________________________________________ > scim mailing list > scim@ietf.org > https://www.ietf.org/mailman/listinfo/scim > =20 > _______________________________________________ > scim mailing list > scim@ietf.org > https://www.ietf.org/mailman/listinfo/scim --Apple-Mail=_0357964A-083F-4860-96F3-23D170FE72D9 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=windows-1252

However, I think for consistency, = it would be ok for ServiceProviderConfig not to have an id since it is a = singleton (it is references by simply /ServiceProviderConfig ). = But, ResourceTypes like other resources and is addressed as = /ResourceTypes/{identifier}

Would it be ok, in = an effort to be consistent, to allow use of {id}?  What I have done = is leave the text in saying 'id' is not required, but the name is. =  I've also said they are often the same. The examples can stay with = the id and there is no requirement to = upgrade. 

Will this work for = everyone?

In these situations, sometimes it is = hard to tell what is consistent and what is inconsistent. =  8-)


On 2014-02-05, at 6:53 PM, Kelly Grizzle <kelly.grizzle@sailpoint.com> wrote:

Should objects returned from ResourceTypes endpoint not have an = "id".
=46rom draft 02=85
 
{
  "schemas": = ["urn:scim:schemas:core:2.0:ResourceType"],
  "name": = "User",
  "description": "Core = User",
  "schemaExtensions": = [
    = {
    =   "schema": = "urn:scim:schemas:extension:enterprise:2.0:EnterpriseUser",
      = "required": true
    "lastModified": = "2011-05-13T04:42:34Z",
    "version": = "W\/\"3694e05e9dff595\""
  }
 "location":"



scim mailing list
scim@ietf.org
, "scim@ietf.org WG" 
Subject: Re: [scim] ResourceTypes endpoint
X-BeenThere: scim@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Simple Cloud Identity Management BOF 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Fri, 07 Feb 2014 03:23:36 -0000

--_000_B227BDC74226445D8E7BAFFF1E25EB41sailpointcom_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

I'm happy with that. Sounds like a good plan. Thanks Phil.

--Kelly

On Feb 6, 2014, at 4:27 PM, "Phil Hunt" > wrote:

Kelly,

I see more clearly what the issue is now.  Except in one case, all the exam=
ples had an "id". Reading the text, it says ResourceType and ServiceProvide=
rConfig do not require ids.  The way I interpret that is that "id"s are sti=
ll acceptable.

However, I think for consistency, it would be ok for ServiceProviderConfig =
not to have an id since it is a singleton (it is references by simply /Serv=
iceProviderConfig ). But, ResourceTypes like other resources and is address=
ed as /ResourceTypes/{identifier}

Would it be ok, in an effort to be consistent, to allow use of {id}?  What =
I have done is leave the text in saying 'id' is not required, but the name =
is.  I've also said they are often the same. The examples can stay with the=
 id and there is no requirement to upgrade.

Will this work for everyone?

In these situations, sometimes it is hard to tell what is consistent and wh=
at is inconsistent.  8-)

Phil

@independentid
www.independentid.com
phil.hunt@oracle.com

On 2014-02-05, at 6:53 PM, Kelly Grizzle > wrote:

The reason the ID was left off of the configuration-related objects was to =
promote interoperability and normative definitions.  Currently, neither Sch=
emas, ResourceTypes, or ServiceProviderConfigs have IDs.  ServiceProviderCo=
nfigs is a bit strange because it is really more of a singleton object.  Re=
sourceTypes and Schemas both use names for their IDs so they can easily be =
exchanged between servers.  Not sure if this is a good thing or not, but th=
at is the reasoning behind why it is the way that it is.

--Kelly

From: scim [mailto:scim-bounces@ietf.org] On Behal=
f Of Leif Johansson
Sent: Wednesday, February 05, 2014 1:22 PM
To: scim@ietf.org
Subject: Re: [scim] ResourceTypes endpoint

On 2014-02-05 20:12, Phil Hunt wrote:
Should objects returned from ResourceTypes endpoint not have an "id".

consistency is always nice...

>From draft 02...

{
  "schemas": ["urn:scim:schemas:core:2.0:ResourceType"],
  "name": "User",
  "endpoint": "/Users",
  "description": "Core User",
  "schema": "urn:scim:schemas:core:2.0:User",
  "schemaExtensions": [
    {
      "schema": "urn:scim:schemas:extension:enterprise:2.0:EnterpriseUser",
      "required": true
    }
  ],
  "meta": {
    "resourceType": "ResourceType",
    "created": "2010-01-23T04:56:22Z",
    "lastModified": "2011-05-13T04:42:34Z",
    "version": "W\/\"3694e05e9dff595\""
  }
}

Should this item have a location of:
 "location":"https://example.com/v2/ResourceTypes/User"

Phil

@independentid
www.independentid.com
phil.hunt@oracle.com





_______________________________________________

scim mailing list

scim@ietf.org

https://www.ietf.org/mailman/listinfo/scim


_______________________________________________
scim mailing list
scim@ietf.org
https://www.ietf.org/mailman/listinfo/scim


--_000_B227BDC74226445D8E7BAFFF1E25EB41sailpointcom_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable







I'm happy with that. Sounds like a good plan. Thanks Phil.



--Kelly





Kelly,






I see more clearly what the issue is now.  Except in one case, al=
l the examples had an "id". Reading the text, it says ResourceTyp=
e and ServiceProviderConfig do not require ids.  The way I interpret t=
hat is that "id"s are still acceptable.







However, I think for consistency, it would be ok for ServiceProviderCo=
nfig not to have an id since it is a singleton (it is references by simply =
/ServiceProviderConfig ). But, ResourceTypes like other resources and =
is addressed as /ResourceTypes/{identifier}







Would it be ok, in an effort to be consistent, to allow use of {id}? &=
nbsp;What I have done is leave the text in saying 'id' is not required, but=
 the name is.  I've also said they are often the same. The examples ca=
n stay with the id and there is no requirement
 to upgrade. 







Will this work for everyone?







In these situations, sometimes it is hard to tell what is consistent a=
nd what is inconsistent.  8-)














On 2014-02-05, at 6:53 PM, Kelly Grizzle <kelly.grizzle@sailpoint.com> wrote:











The reason the ID was left off of the configuration-relat=
ed objects was to promote interoperability and normative definitions. =
 Currently, neither Schemas, ResourceTypes,
 or ServiceProviderConfigs have IDs.  ServiceProviderConfigs is a bit =
strange because it is really more of a singleton object.  ResourceType=
s and Schemas both use names for their IDs so they can easily be exchanged =
between servers.  Not sure if this is a good
 thing or not, but that is the reasoning behind why it is the way that it i=
s.



 



--Kelly



 







From: scim [mailto:scim-bounces@ietf.org] On
 Behalf Of Leif Johan=
sson

Sent: Wednesday, F=
ebruary 05, 2014 1:22 PM

To: sc=
im@ietf.org

Subject: Re: [scim=
] ResourceTypes endpoint







 





On 2014-02-05 20:12, Phil Hunt wrote:







Should objects returned from ResourceTypes endpoint not have an "id&qu=
ot;.





 







consistency is always nice...









>From draft 02…







 









{







  "schemas": ["urn:scim:schemas:core:2.0:ResourceType&q=
uot;],







  "name": "User",







  "endpoint": "/Users",







  "description": "Core User",







  "schema": "urn:scim:schemas:core:2.0:User",=








  "schemaExtensions": [







    {







      "schema": "urn:scim:schemas:extension:e=
nterprise:2.0:EnterpriseUser",







      "required": true







    }







  ],







  "meta": {







    "resourceType": "ResourceType",







    "created": "2010-01-23T04:56:22Z",







    "lastModified": "2011-05-13T04:42:34Z",







    "version": "W\/\"3694e05e9dff595\"&q=
uot;







  }







}







 







Should this item have a location of:








 











Phil







 =








@indep=
endentid











 














_______________________________________________

scim mailing list


scim@ietf.org


https://www.ietf.org/mailman/=
listinfo/scim



 



_______________________________________________

scim mailing list

scim@ietf.org

https://www.ietf.org/mailman/listinfo/sci=
m


















--_000_B227BDC74226445D8E7BAFFF1E25EB41sailpointcom_--

From wmills_92105@yahoo.com  Thu Feb  6 19:44:25 2014
Return-Path: 
X-Original-To: scim@ietfa.amsl.com
Delivered-To: scim@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6DDBB1A05A7 for ; Thu,  6 Feb 2014 19:44:25 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 1.213
X-Spam-Level: *
X-Spam-Status: No, score=1.213 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, FREEMAIL_REPLYTO_END_DIGIT=0.25, HTML_MESSAGE=0.001, RCVD_IN_BL_SPAMCOP_NET=1.347, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.535] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AZU4vUWUCtG3 for ; Thu,  6 Feb 2014 19:44:24 -0800 (PST)
Received: from nm12-vm0.bullet.mail.bf1.yahoo.com (nm12-vm0.bullet.mail.bf1.yahoo.com [98.139.213.140]) by ietfa.amsl.com (Postfix) with ESMTP id 6ABF41A05A5 for ; Thu,  6 Feb 2014 19:44:24 -0800 (PST)
Received: from [98.139.215.140] by nm12.bullet.mail.bf1.yahoo.com with NNFMP; 07 Feb 2014 03:44:23 -0000
Received: from [98.139.212.194] by tm11.bullet.mail.bf1.yahoo.com with NNFMP; 07 Feb 2014 03:44:23 -0000
Received: from [127.0.0.1] by omp1003.mail.bf1.yahoo.com with NNFMP; 07 Feb 2014 03:44:23 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 94645.64278.bm@omp1003.mail.bf1.yahoo.com
Received: (qmail 12444 invoked by uid 60001); 7 Feb 2014 03:44:23 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1391744662; bh=wc5aBeRCkIiOWkeVvMo/rAqBDywcumQIiPdswcenT9E=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=I3GFydSKDvZrpnN4cLhF9RSGWAFFNifp+cXcZcmbEy0xt/JO2xplaTvAHv4dkgcxam4fsgYzzVQP0t8CaRyKIf9SNFTCtXNI5IRp6RvhG7S5xMJgqw660cPqsVMPtmwqm3bammVQ4bgneYS+WBgOVDD/y/IgecVXUGJiAi733jQ=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=pCQMtrJTEzTaYEPreB75vRKsmOzPx4W47CNCqZ2SJmUW863GkKM0Ki7qj/+wPLTlkkZB3JPvPAhohUBP4xtRD75TLerQPLe40/2XXKmW3nTWXWaAWPH3sLwXW6UkgKV/f6lXw5VpMLGX/CwgiH//S2aauJPhuAw6iMvJfi/h4wU=;
X-YMail-OSG: CACpJ6gVM1nquTcMYEu_VbgOQ3JVDJltsubfxKs00uavm6m uPCB9bP57OB26nw3YsBowmkjLKP7x94uEIkUZcYer.y2Mvy5AVmLJ5e2ee0v UTdG1Q6stDC3ah01fEV3Z3A1Ezh_FZ7peCchL2Cr2w_mfJ5ULv4PnX6.gv0V OARbaMVFwmm4lag9KnyGlD.dAkdRqaN7fHztyQo5tqasjlU6LlfueRGokKQ2 6xnbOLWbhBFmjBMLji.ZXaMu66W4XDArPHsHja5lXphOvbK7Vx1zPMQU22AF nfpA65qcAdrITxhTXhSD9tiXgHHgsd4oXbR3pxPAzMf1mWiIPI6cJdLAWtrg FSbEbyd92Ja785r1nx71WnQAiRCXafFUhrRsUVD7y1s87COEphHS6LSjM8BT qX7_l0HGIZipaUHx2wV_brw3l0SSZCW9XyapRXKNl.g1kzpy5eBKV1YGVhQl NjFtx1kEprQFA2JJwsaBxFugnzPOFrbceP3N2C69Ui1AWayR0r_BRLx_SLeh ZbGBWsAPmcG3F9CtiV3wYmkyU6ewaGjwgqQAjSapOlGx8L84.ZFquYWiXC6s psWVI.FOG4BfOaTg-
Received: from [99.31.212.42] by web142804.mail.bf1.yahoo.com via HTTP; Thu, 06 Feb 2014 19:44:22 PST
X-Rocket-MIMEInfo: 002.001, SG93IGRvZXMgU0NJTSBoYW5kbGUgc2l0dWF0aW9ucyB3aGVyZSBzb21ldGhpbmcgbGlrZSBwYXNzd29yZCBjYW4gc2V0IGJ1dCBzaG91ZGwgbm90IGJlIGRpc3BsYXllZD8gwqBJcyB0aGF0IGp1c3Qgc29tZXRoaW5nIGhhbmRsZWQgaW4gdGhlIHNjaGVtYSB0aGF0IHRoZSBwYXNzd29yZCBlbGVtZW50IGV4aXN0cyBidXQgaXMgcmV0dXJuZWQgZW1wdHk_CgpUaGFua3MsCgotYmlsbAEwAQEBAQ--
X-Mailer: YahooMailWebService/0.8.175.632
Message-ID: <1391744662.89568.YahooMailNeo@web142804.mail.bf1.yahoo.com>
Date: Thu, 6 Feb 2014 19:44:22 -0800 (PST)
From: Bill Mills 
To: "scim@ietf.org" 
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="-2129327256-713036416-1391744662=:89568"
Subject: [scim] Password updates and SCIM
X-BeenThere: scim@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Bill Mills 
List-Id: Simple Cloud Identity Management BOF 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Fri, 07 Feb 2014 03:44:25 -0000

---2129327256-713036416-1391744662=:89568
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

How does SCIM handle situations where something like password can set but s=
houdl not be displayed? =A0Is that just something handled in the schema tha=
t the password element exists but is returned empty?=0A=0AThanks,=0A=0A-bil=
l
---2129327256-713036416-1391744662=:89568
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable


How does SCIM handle situations where something like pas=
sword can set but shoudl not be displayed?  Is that just something han=
dled in the schema that the password element exists but is returned empty?<=
/div>


-bill

---2129327256-713036416-1391744662=:89568--

From phil.hunt@oracle.com  Thu Feb  6 23:36:22 2014
Return-Path: 
X-Original-To: scim@ietfa.amsl.com
Delivered-To: scim@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A4BF51A05C8 for ; Thu,  6 Feb 2014 23:36:22 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.735
X-Spam-Level: 
X-Spam-Status: No, score=-4.735 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id utDggbG_QJQx for ; Thu,  6 Feb 2014 23:36:19 -0800 (PST)
Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) by ietfa.amsl.com (Postfix) with ESMTP id 1508D1A05C2 for ; Thu,  6 Feb 2014 23:36:19 -0800 (PST)
Received: from ucsinet22.oracle.com (ucsinet22.oracle.com [156.151.31.94]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s177aHTG008901 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Fri, 7 Feb 2014 07:36:17 GMT
Received: from userz7021.oracle.com (userz7021.oracle.com [156.151.31.85]) by ucsinet22.oracle.com (8.14.5+Sun/8.14.5) with ESMTP id s177aGWh028265 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Fri, 7 Feb 2014 07:36:17 GMT
Received: from abhmp0019.oracle.com (abhmp0019.oracle.com [141.146.116.25]) by userz7021.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s177aGsp024016; Fri, 7 Feb 2014 07:36:16 GMT
Received: from [192.168.1.124] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 06 Feb 2014 23:36:16 -0800
Content-Type: multipart/alternative; boundary="Apple-Mail=_4AB6E556-6B95-4008-9826-C7B258A8A85B"
Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\))
From: Phil Hunt 
In-Reply-To: <1391744662.89568.YahooMailNeo@web142804.mail.bf1.yahoo.com>
Date: Thu, 6 Feb 2014 23:36:14 -0800
Message-Id: <2C38D8E3-6881-4E04-8E80-63F982A0D47E@oracle.com>
References: <1391744662.89568.YahooMailNeo@web142804.mail.bf1.yahoo.com>
To: Bill Mills 
X-Mailer: Apple Mail (2.1510)
X-Source-IP: ucsinet22.oracle.com [156.151.31.94]
Cc: "scim@ietf.org" 
Subject: Re: [scim] Password updates and SCIM
X-BeenThere: scim@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Simple Cloud Identity Management BOF 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Fri, 07 Feb 2014 07:36:23 -0000

--Apple-Mail=_4AB6E556-6B95-4008-9826-C7B258A8A85B
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=iso-8859-1

Bill,

Typically the password attribute would be marked in the schema with =
"returned" set to "never" and "mutability" set to "writeOnly". See =
tickets 10 and 35.

If the client requests the password attribute, nothing would be =
returned. Effectively meaning a client can only set a password if =
permitted by the service provider.

Because any attribute could have returnability or mutability set =
specifically, it is possible to get similar behaviour from other =
attributes such as ones you might define in an extension.  For example, =
you might make security questions as not returnable either (or for that =
matter anything stored as a hash).

These changes are planned to be included in the next draft. =20

Phil

@independentid
www.independentid.com
phil.hunt@oracle.com

On 2014-02-06, at 7:44 PM, Bill Mills  wrote:

> How does SCIM handle situations where something like password can set =
but shoudl not be displayed?  Is that just something handled in the =
schema that the password element exists but is returned empty?
>=20
> Thanks,
>=20
> -bill
> _______________________________________________
> scim mailing list
> scim@ietf.org
> https://www.ietf.org/mailman/listinfo/scim


--Apple-Mail=_4AB6E556-6B95-4008-9826-C7B258A8A85B
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=iso-8859-1



If the =
client requests the password attribute, nothing would be returned. =
Effectively meaning a client can only set a password if permitted by the =
service provider.

Because any attribute could =
have returnability or mutability set specifically, it is possible to get =
similar behaviour from other attributes such as ones you might define in =
an extension.  For example, you might make security questions as =
not returnable either (or for that matter anything stored as a =
hash).



These changes =
are planned to be included in the next draft.  
www.independentid.com
phil.hunt@oracle.com
=





On 2014-02-06, at 7:44 PM, Bill Mills <wmills_92105@yahoo.com> =
wrote:

How does SCIM handle =
situations where something like password can set but shoudl not be =
displayed?  Is that just something handled in the schema that the =
password element exists but is returned empty?

Thanks,

scim@ietf.org
https://www.ietf.org/ma=
ilman/listinfo/scim

=

--Apple-Mail=_4AB6E556-6B95-4008-9826-C7B258A8A85B--

From erik.wahlstrom@nexusgroup.com  Fri Feb  7 06:40:24 2014
Return-Path: 
X-Original-To: scim@ietfa.amsl.com
Delivered-To: scim@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B66EE1A1F78 for ; Fri,  7 Feb 2014 06:40:24 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.135
X-Spam-Level: 
X-Spam-Status: No, score=-2.135 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BMQaQk_GPphJ for ; Fri,  7 Feb 2014 06:40:22 -0800 (PST)
Received: from smtp.nexusgroup.com (smtp.nexusgroup.com [83.241.133.121]) by ietfa.amsl.com (Postfix) with ESMTP id AAEBE1A1F65 for ; Fri,  7 Feb 2014 06:40:21 -0800 (PST)
Received: from NG-EX04.ad.nexusgroup.com (10.75.28.9) by NG-EX02.ad.nexusgroup.com (10.75.28.43) with Microsoft SMTP Server (TLS) id 15.0.775.38; Fri, 7 Feb 2014 15:40:05 +0100
Received: from NG-EX02.ad.nexusgroup.com (10.75.28.43) by NG-EX04.ad.nexusgroup.com (10.75.28.9) with Microsoft SMTP Server (TLS) id 15.0.775.38; Fri, 7 Feb 2014 15:40:04 +0100
Received: from NG-EX02.ad.nexusgroup.com ([fe80::2839:3494:59f1:44d]) by NG-EX02.ad.nexusgroup.com ([fe80::2839:3494:59f1:44d%12]) with mapi id 15.00.0775.031; Fri, 7 Feb 2014 15:40:04 +0100
From: =?Windows-1252?Q?Erik_Wahlstr=F6m?= 
To: Phil Hunt 
Thread-Topic: [scim] Is externalId modifiable?
Thread-Index: AQHPIdMpeYGAqNnfg0uyWvNPTnYXOZqp0I6A
Date: Fri, 7 Feb 2014 14:40:04 +0000
Message-ID: <2D00FF6B-C46A-40A6-BC3E-182A46FEBB0A@nexusgroup.com>
References: <412309D4-510F-413C-8ECC-9A658C15297A@oracle.com>
In-Reply-To: <412309D4-510F-413C-8ECC-9A658C15297A@oracle.com>
Accept-Language: en-US, sv-SE
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [10.75.28.12]
Content-Type: multipart/alternative; boundary="_000_2D00FF6BC46A40A6BC3E182A46FEBB0Anexusgroupcom_"
MIME-Version: 1.0
Cc: "scim@ietf.org WG" 
Subject: Re: [scim] Is externalId modifiable?
X-BeenThere: scim@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Simple Cloud Identity Management BOF 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Fri, 07 Feb 2014 14:40:24 -0000

--_000_2D00FF6BC46A40A6BC3E182A46FEBB0Anexusgroupcom_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

Hi,

I agree, externalID could be updated by client if it want=92s to. It only m=
ake sense to the client anyway. But I do not think it=92s required. Some cl=
ient=92s don=92t care keeping there own ID.

+1 on removing readOnly.

/ Erik


On 04 Feb 2014, at 19:01, Phil Hunt > wrote:

Looking through the draft 2 schema, I see that externalId is marked readOnl=
y.

Is the intent here that it be immutable (spec says it is set by client)?  I=
 had been assuming it is a modifiable attribute and the client may update i=
t any time.

While on the subject of "readOnly":  ticket 35 (discussed in Vancouver) add=
s a broader attribute quality - mutability. Mutability allows an attribute =
to be declared as: readOnly, writeOnly, immutable, or readWrite.  I am assu=
ming that mutability replaces the meta-attribute readOnly and readOnly shou=
ld be removed. Is this correct?

Phil

@independentid
www.independentid.com
phil.hunt@oracle.com

_______________________________________________
scim mailing list
scim@ietf.org
https://www.ietf.org/mailman/listinfo/scim


--_000_2D00FF6BC46A40A6BC3E182A46FEBB0Anexusgroupcom_
Content-Type: text/html; charset="Windows-1252"
Content-ID: <5CA7E23F9AF4174283FDD649CBA7410A@nexusgroup.com>
Content-Transfer-Encoding: quoted-printable







Hi,







I agree, externalID could be updated by client if it want=92s to. It o=
nly make sense to the client anyway. But I do not think it=92s required. So=
me client=92s don=92t care keeping there own ID.







+1 on removing readOnly.







/ Erik


 






On 04 Feb 2014, at 19:01, Phil Hunt <phil.hunt@oracle.com> wrote:







Looking through the draft 2 schema, I see that externalId is marked readOnl=
y.






Is the intent here that it be immutable (spec says it is set by client=
)?  I had been assuming it is a modifiable attribute and the client ma=
y update it any time.







While on the subject of "readOnly":  ticket 35 (discuss=
ed in Vancouver) adds a broader attribute quality - mutability. Mutability =
allows an attribute to be declared as: readOnly, writeOnly, immutable, or r=
eadWrite.  I am assuming that mutability replaces
 the meta-attribute readOnly and readOnly should be removed. Is this correc=
t?





_______________________________________________

scim mailing list

scim@ietf.org

https://www.ietf.org/mailman/listinfo/scim










--_000_2D00FF6BC46A40A6BC3E182A46FEBB0Anexusgroupcom_--

From kelly.grizzle@sailpoint.com  Fri Feb  7 06:58:20 2014
Return-Path: 
X-Original-To: scim@ietfa.amsl.com
Delivered-To: scim@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 61FAE1A1F77 for ; Fri,  7 Feb 2014 06:58:20 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.301
X-Spam-Level: 
X-Spam-Status: No, score=-2.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CegR7vw1kpII for ; Fri,  7 Feb 2014 06:58:17 -0800 (PST)
Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1lp0157.outbound.protection.outlook.com [207.46.163.157]) by ietfa.amsl.com (Postfix) with ESMTP id 202841A1F65 for ; Fri,  7 Feb 2014 06:58:16 -0800 (PST)
Received: from BN1PR04MB392.namprd04.prod.outlook.com (10.141.60.151) by BN1PR04MB344.namprd04.prod.outlook.com (10.141.62.26) with Microsoft SMTP Server (TLS) id 15.0.868.8; Fri, 7 Feb 2014 14:58:16 +0000
Received: from BN1PR04MB392.namprd04.prod.outlook.com (10.141.60.151) by BN1PR04MB392.namprd04.prod.outlook.com (10.141.60.151) with Microsoft SMTP Server (TLS) id 15.0.868.8; Fri, 7 Feb 2014 14:58:15 +0000
Received: from BN1PR04MB392.namprd04.prod.outlook.com ([169.254.10.68]) by BN1PR04MB392.namprd04.prod.outlook.com ([169.254.10.222]) with mapi id 15.00.0868.013; Fri, 7 Feb 2014 14:58:14 +0000
From: Kelly Grizzle 
To: =?iso-8859-1?Q?Erik_Wahlstr=F6m?= , "Phil Hunt" 
Thread-Topic: [scim] Is externalId modifiable?
Thread-Index: AQHPIdMeUSjYdAvzvEOw2LuR/dkJh5qp4VMAgAAE/dA=
Date: Fri, 7 Feb 2014 14:58:14 +0000
Message-ID: <559a933f36bf49e8ab703975f89a2d1e@BN1PR04MB392.namprd04.prod.outlook.com>
References: <412309D4-510F-413C-8ECC-9A658C15297A@oracle.com> <2D00FF6B-C46A-40A6-BC3E-182A46FEBB0A@nexusgroup.com>
In-Reply-To: <2D00FF6B-C46A-40A6-BC3E-182A46FEBB0A@nexusgroup.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [2605:6000:0:8::f:9]
x-forefront-prvs: 011579F31F
x-forefront-antispam-report: SFV:NSPM; SFS:(10009001)(24454002)(189002)(199002)(377454003)(74502001)(76482001)(74316001)(85306002)(31966008)(16236675002)(19300405004)(74706001)(54356001)(15202345003)(76786001)(56776001)(19580395003)(54316002)(95416001)(76796001)(19580405001)(83322001)(53806001)(80976001)(76576001)(46102001)(74876001)(47446002)(87936001)(74662001)(77096001)(51856001)(63696002)(15975445006)(80022001)(59766001)(83072002)(87266001)(65816001)(81342001)(81542001)(81686001)(94316002)(93136001)(77982001)(81816001)(4396001)(56816005)(79102001)(94946001)(2656002)(33646001)(19609705001)(74366001)(49866001)(50986001)(90146001)(47976001)(93516002)(92566001)(47736001)(86362001)(85852003)(69226001)(3826001)(24736002); DIR:OUT; SFP:1101; SCL:1; SRVR:BN1PR04MB392; H:BN1PR04MB392.namprd04.prod.outlook.com; CLIP:2605:6000:0:8::f:9; FPR:B88FD13D.2F1CF510.31F0B5DC.86E0FA6C.20234; InfoNoRecordsMX:1; A:1; LANG:en;
Content-Type: multipart/alternative; boundary="_000_559a933f36bf49e8ab703975f89a2d1eBN1PR04MB392namprd04pro_"
MIME-Version: 1.0
X-OriginatorOrg: sailpoint.com
Cc: "scim@ietf.org WG" 
Subject: Re: [scim] Is externalId modifiable?
X-BeenThere: scim@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Simple Cloud Identity Management BOF 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Fri, 07 Feb 2014 14:58:20 -0000

--_000_559a933f36bf49e8ab703975f89a2d1eBN1PR04MB392namprd04pro_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

+1 for removing readOnly.

From: scim [mailto:scim-bounces@ietf.org] On Behalf Of Erik Wahlstr=F6m
Sent: Friday, February 07, 2014 8:40 AM
To: Phil Hunt
Cc: scim@ietf.org WG
Subject: Re: [scim] Is externalId modifiable?

Hi,

I agree, externalID could be updated by client if it want's to. It only mak=
e sense to the client anyway. But I do not think it's required. Some client=
's don't care keeping there own ID.

+1 on removing readOnly.

/ Erik


On 04 Feb 2014, at 19:01, Phil Hunt > wrote:


Looking through the draft 2 schema, I see that externalId is marked readOnl=
y.

Is the intent here that it be immutable (spec says it is set by client)?  I=
 had been assuming it is a modifiable attribute and the client may update i=
t any time.

While on the subject of "readOnly":  ticket 35 (discussed in Vancouver) add=
s a broader attribute quality - mutability. Mutability allows an attribute =
to be declared as: readOnly, writeOnly, immutable, or readWrite.  I am assu=
ming that mutability replaces the meta-attribute readOnly and readOnly shou=
ld be removed. Is this correct?

Phil

@independentid
www.independentid.com
phil.hunt@oracle.com

_______________________________________________
scim mailing list
scim@ietf.org
https://www.ietf.org/mailman/listinfo/scim


--_000_559a933f36bf49e8ab703975f89a2d1eBN1PR04MB392namprd04pro_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable











+1 for removing readO=
nly.


 <=
/p>





From: scim [ma=
ilto:scim-bounces@ietf.org]
On Behalf Of Erik Wahlstr=F6m

Sent: Friday, February 07, 2014 8:40 AM

To: Phil Hunt

Cc: scim@ietf.org WG

Subject: Re: [scim] Is externalId modifiable?






 




Hi,






 






I agree, externalID could be updated by client if it=
 want’s to. It only make sense to the client anyway. But I do not thi=
nk it’s required. Some client’s don’t care keeping there =
own ID.






 






+1 on removing readOnly.






 






/ Erik






 




 






On 04 Feb 2014, at 19:01, Phil Hunt <phil.hunt@oracle.com> wrote:<=
/p>












Looking through the draft 2 schema, I see that exter=
nalId is marked readOnly.





 






Is the intent here that it be immutable (spec says i=
t is set by client)?  I had been assuming it is a modifiable attribute=
 and the client may update it any time.






 






While on the subject of "readOnly":  =
ticket 35 (discussed in Vancouver) adds a broader attribute quality - mutab=
ility. Mutability allows an attribute to be declared as: readOnly, writeOnl=
y, immutable, or readWrite.  I am assuming that mutability
 replaces the meta-attribute readOnly and readOnly should be removed. Is th=
is correct?






 



 






_______________________________________________

scim mailing list

scim@ietf.org

https://www.ietf.org=
/mailman/listinfo/scim




 






--_000_559a933f36bf49e8ab703975f89a2d1eBN1PR04MB392namprd04pro_--

From mdiodati@pingidentity.com  Fri Feb  7 07:01:40 2014
Return-Path: 
X-Original-To: scim@ietfa.amsl.com
Delivered-To: scim@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3A5CD1A802B for ; Fri,  7 Feb 2014 07:01:40 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.612
X-Spam-Level: 
X-Spam-Status: No, score=-2.612 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-2.3, SPF_SOFTFAIL=0.665] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j-nVf0rUXp22 for ; Fri,  7 Feb 2014 07:01:38 -0800 (PST)
Received: from na3sys009aog114.obsmtp.com (na3sys009aog114.obsmtp.com [74.125.149.211]) by ietfa.amsl.com (Postfix) with ESMTP id C165D1A3BDF for ; Fri,  7 Feb 2014 07:01:37 -0800 (PST)
Received: from mail-ie0-f177.google.com ([209.85.223.177]) (using TLSv1) by na3sys009aob114.postini.com ([74.125.148.12]) with SMTP ID DSNKUvT1USLcgXTtbz05iqVP9etU1goaRoC9@postini.com; Fri, 07 Feb 2014 07:01:38 PST
Received: by mail-ie0-f177.google.com with SMTP id at1so1667953iec.36 for ; Fri, 07 Feb 2014 07:01:32 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:references:in-reply-to:mime-version :thread-index:date:message-id:subject:to:cc:content-type; bh=Ck5dgyu9rRa+Ng0pC9mFHm02jxAh8sCub6cAVV7sORw=; b=m3uOmzbDKl0/f4ksaMPhaV4R+raiK9525TQ6z1kRIXAqyefBTSffi1InwXurWkV74F j07SMRV/aPSqst/bGKOrVdOHUH8Nn5gM9Bwdg+FV/UfjiMaWJHESB6GXbZUBTPx+6X+q h/nU5hu249OeDBR6aKqY/plPpMMF4W6SSuUE/FZk9stWfdaf02Rcx2vsTeBDNQ30Xjep rNkMYHR051Wp/FjNIu4KSjs2n01K8L/IKGOLczi5OlXfYyW9o3UR5JmO9ciBondFzQrA rJtNyhwoE4pFJCtAKDzsMEegLQOi0ikIQSVTzm2QCc0/5Yxbds6iqOjg1LF4ViVnvYVv KCww==
X-Gm-Message-State: ALoCoQm1ZKL62At2k2wYxqavZlAmqvvXGkwOcu3BK69sjC0Oe5ZAw3m/4iHihMKFZ+IYzZZW+kkyQt27/5Gm61L90EWSESItnHhvJ3cO0o6uH/SIKzmGsSLB+RuyrZuRqrVzRrOH4GMAEHhzf1s9zfB29BegeEDkzw==
X-Received: by 10.43.69.83 with SMTP id yb19mr3944412icb.45.1391785292667; Fri, 07 Feb 2014 07:01:32 -0800 (PST)
X-Received: by 10.43.69.83 with SMTP id yb19mr3944399icb.45.1391785292537; Fri, 07 Feb 2014 07:01:32 -0800 (PST)
From: Mark Diodati 
References: <412309D4-510F-413C-8ECC-9A658C15297A@oracle.com> <2D00FF6B-C46A-40A6-BC3E-182A46FEBB0A@nexusgroup.com> <559a933f36bf49e8ab703975f89a2d1e@BN1PR04MB392.namprd04.prod.outlook.com>
In-Reply-To: <559a933f36bf49e8ab703975f89a2d1e@BN1PR04MB392.namprd04.prod.outlook.com>
MIME-Version: 1.0
X-Mailer: Microsoft Outlook 14.0
Thread-Index: AQFTp+rnUJOfVAq6p57OCugACzaOWgLGwzOkAxAaWeGbciRHgA==
Date: Fri, 7 Feb 2014 09:01:56 -0600
Message-ID: <14e25b9e16cc0a5ae6ccf296aebf5580@mail.gmail.com>
To: Kelly Grizzle ,  =?ISO-8859-1?Q?Erik_Wahlstr=F6m?= ,  Phil Hunt 
Content-Type: multipart/alternative; boundary=bcaec51b1ea3f737ce04f1d243fc
Cc: scim@ietf.org
Subject: Re: [scim] Is externalId modifiable?
X-BeenThere: scim@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Simple Cloud Identity Management BOF 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Fri, 07 Feb 2014 15:01:40 -0000

--bcaec51b1ea3f737ce04f1d243fc
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

+1



*From:* Kelly Grizzle [mailto:kelly.grizzle@sailpoint.com]
*Sent:* Friday, February 07, 2014 8:58 AM
*To:* Erik Wahlstr=F6m; Phil Hunt
*Cc:* scim@ietf.org WG
*Subject:* Re: [scim] Is externalId modifiable?



+1 for removing readOnly.



*From:* scim [mailto:scim-bounces@ietf.org ] *On
Behalf Of *Erik Wahlstr=F6m
*Sent:* Friday, February 07, 2014 8:40 AM
*To:* Phil Hunt
*Cc:* scim@ietf.org WG
*Subject:* Re: [scim] Is externalId modifiable?



Hi,



I agree, externalID could be updated by client if it want's to. It only
make sense to the client anyway. But I do not think it's required. Some
client's don't care keeping there own ID.



+1 on removing readOnly.



/ Erik





On 04 Feb 2014, at 19:01, Phil Hunt  wrote:




Looking through the draft 2 schema, I see that externalId is marked
readOnly.



Is the intent here that it be immutable (spec says it is set by client)?  I
had been assuming it is a modifiable attribute and the client may update it
any time.



While on the subject of "readOnly":  ticket 35 (discussed in Vancouver)
adds a broader attribute quality - mutability. Mutability allows an
attribute to be declared as: readOnly, writeOnly, immutable, or readWrite.
 I am assuming that mutability replaces the meta-attribute readOnly and
readOnly should be removed. Is this correct?



Phil



@independentid

www.independentid.com

phil.hunt@oracle.com



_______________________________________________
scim mailing list
scim@ietf.org
https://www.ietf.org/mailman/listinfo/scim

--bcaec51b1ea3f737ce04f1d243fc
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable



+1

 
From: Kelly Grizzle [mailto:kelly.grizzle@sailpoint.com] 

Sent: Friday, February 07, 2014 8:58 AM
To: Erik Wahlstr=
=F6m; Phil Hunt
Cc: scim@ietf.or=
g WG
Subject: Re: [scim] Is externalId modifiable?
=



 
+1 for removing readOnly.
=
 


From: scim [mailto:scim-bounces@ie=
tf.org] On Behalf Of Erik Wahlstr=F6m

Sent: Friday, February 07, 2014 8:40 AM
To: Phil Hunt
<=
b>Cc: scim@ietf.org WG
Subje=
ct: Re: [scim] Is externalId modifiable?

 
Hi,
 
I agree, externalID could b=
e updated by client if it want’s to. It only make sense to the client=
 anyway. But I do not think it’s required. Some client’s don&rs=
quo;t care keeping there own ID.


 
+1 on removing readOnly.
 
=

/ Erik
 

 
On 04 Feb 2014, at 19:01, Phil H=
unt <phil.hunt@oracle.com>=
; wrote:




Looking through the draft 2 schema, I see that externalId is marked readOnl=
y. 
 
Is the intent here that it be immutable (spec says it is set by client)=
?  I had been assuming it is a modifiable attribute and the client may=
 update it any time.


 
While on the subject of "readOnly":  ticket 35 (discussed=
 in Vancouver) adds a broader attribute quality - mutability. Mutability al=
lows an attribute to be declared as: readOnly, writeOnly, immutable, or rea=
dWrite.  I am assuming that mutability replaces the meta-attribute rea=
dOnly and readOnly should be removed. Is this correct?


 
<=
div>
Phil

 
@independentid



phil.hunt@oracle.com
 

_______________________________________________
scim mailing list
scim@ietf.org
https://www.ietf.org/mailman/listinfo/scim


 


--bcaec51b1ea3f737ce04f1d243fc--

From phil.hunt@oracle.com  Tue Feb 11 13:26:59 2014
Return-Path: 
X-Original-To: scim@ietfa.amsl.com
Delivered-To: scim@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BBA501A06DD for ; Tue, 11 Feb 2014 13:26:59 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.678
X-Spam-Level: 
X-Spam-Status: No, score=-0.678 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, GB_I_LETTER=-2, HTML_MESSAGE=0.001, HTML_TAG_BALANCE_BODY=1.157, J_CHICKENPOX_38=0.6, MANY_SPAN_IN_TEXT=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001, TVD_PH_BODY_ACCOUNTS_PRE=2.393, T_FILL_THIS_FORM_SHORT=0.01, T_HTML_ATTACH=0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e0Po2WqbKyE9 for ; Tue, 11 Feb 2014 13:26:50 -0800 (PST)
Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) by ietfa.amsl.com (Postfix) with ESMTP id EEDC81A042A for ; Tue, 11 Feb 2014 13:26:49 -0800 (PST)
Received: from ucsinet22.oracle.com (ucsinet22.oracle.com [156.151.31.94]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s1BLQjRm025864 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Tue, 11 Feb 2014 21:26:46 GMT
Received: from userz7022.oracle.com (userz7022.oracle.com [156.151.31.86]) by ucsinet22.oracle.com (8.14.5+Sun/8.14.5) with ESMTP id s1BLQjpM005166 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 11 Feb 2014 21:26:45 GMT
Received: from abhmp0011.oracle.com (abhmp0011.oracle.com [141.146.116.17]) by userz7022.oracle.com (8.14.5+Sun/8.14.4) with ESMTP id s1BLQiEL005125 for ; Tue, 11 Feb 2014 21:26:44 GMT
Received: from [192.168.1.124] (/24.86.29.34) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 11 Feb 2014 13:26:25 -0800
From: Phil Hunt 
Content-Type: multipart/alternative; boundary="Apple-Mail=_969C6006-3A48-4536-A407-770E2B51470E"
Message-Id: <0A4561AF-9771-4081-A8DC-429AEB964E18@oracle.com>
Date: Tue, 11 Feb 2014 13:26:32 -0800
To: "scim@ietf.org WG" 
Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\))
X-Mailer: Apple Mail (2.1510)
X-Source-IP: ucsinet22.oracle.com [156.151.31.94]
Subject: [scim] Prelim changes for draft 03 for tomorrows call
X-BeenThere: scim@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Simple Cloud Identity Management BOF 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Tue, 11 Feb 2014 21:27:00 -0000

--Apple-Mail=_969C6006-3A48-4536-A407-770E2B51470E
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii

Please find attached the current spreadsheet on ticket plan and diffs =
for the new 03 drafts for tomorrows WG call.

Comments appreciated. =20

Note: AFAIK, we need to publish this week for IETF London. (submission =
closes friday)

Phil

@independentid
www.independentid.com
phil.hunt@oracle.com

--Apple-Mail=_969C6006-3A48-4536-A407-770E2B51470E
Content-Type: multipart/mixed;
	boundary="Apple-Mail=_9FD4E9DF-4C58-462A-8317-37413A5F3BBA"


--Apple-Mail=_9FD4E9DF-4C58-462A-8317-37413A5F3BBA
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=us-ascii




=

--Apple-Mail=_9FD4E9DF-4C58-462A-8317-37413A5F3BBA
Content-Disposition: inline;
	filename="SCIM-Ticket-Plan Sheet1.pdf"
Content-Type: application/pdf;
	x-unix-mode=0644;
	name="SCIM-Ticket-Plan Sheet1.pdf"
Content-Transfer-Encoding: base64

JVBERi0xLjMKJcTl8uXrp/Og0MTGCjQgMCBvYmoKPDwgL0xlbmd0aCA1IDAgUiAvRmlsdGVyIC9G
bGF0ZURlY29kZSA+PgpzdHJlYW0KeAHtXWuz28aR/Y5fAdkxTZk2RfBNKcnNSrq6edxEVvYmXm/s
7MO1rq1UvFVe//+q7Xmc0wNMAwQIUHZWsqp8SWCmZ6an+/RjHvy+fFN+X+625XG33G5Xq0P5nfu2
266Wq9WqKv9e7k/rZbU3nrDG38v/Lr8o/qd88uKHqvzmh3K13K8Ox+1mLZ8OG/+ffNpsT6vqtC9/
+Kbc7PfL7dE1uT+uVsdyv1uuj+V2t1ket+X//lfx7YSdSoe23xzdULa77XK3l4bKL8qk1+VK/knv
vpfOrrf+m/9QHcvq6LixOhTffFc+f5D38mVTPnxTbmWM8k/+VPtVua7Wu/Lhu/LJw0O1rMqqfPi2
/Es5f/TBhz97LN/mH/n/zx6XX5cPvy1uH2SYk3C/cOO4xkB1eOvjqW14Hz8uP1vJcOdfzf2nnXx6
7D9ty/knjwthovvruFrOF5+6D/Lis8CFcgAXilwq6zI4gAuFm7Zz010m0y2TWZvuShlSNOb74+WT
T1ZPqjDbVZzuXgMteipbj4EW1Mb+A9XprrYqzs3hreMMfuj+yrTPPsC0P/EfNuW8wvRv/AeZ9234
UMwx/4sdXg1hUBONCuLTxZLg2eMkoehQ/C5JOGyqhmoU0PyPH4mYC4tWIgtO53sJwU9wjOvVat06
xv0hirpM7T/KIFXS1+vDpjE0AvfHj4smss0WMwW344AB/2RUe73bbjHgpmoTypdQTqirCLCH7cUM
n061wYvypAboQieiC9eKC+x1VFudbW+lV/t10bDS86fPHpcPf/tH0E8djLfJMhjD5Vh6yRXczSFZ
hDYINWFbZlKeiE3G1GLSozgoaJPaz30VsfSoQqoUoYOTGOkBm5n9wndK2uEj2gnW+qWrJRYEXWCL
qnWr0N1iPkT9mqCqji0Mh5gScWO7JHCExyj89e604UPYE/jhk08/ujl++AsZq3McP1k8Li7G1rc8
VhXQ4EXYA/xVBBROMGXhn7wIFPMZheI5pI2C86IGPt0RzE8GeSvvKQR2NJEXekQuuJkPiMtHcLhQ
NvjUBXWQBTOPans6LFcS1a1Oy8Neorr9drmSyEuilu2y2p1OBy/aaQh3idMYvAR7fMQYKHbi/934
oaZQgRHOopNYzFmGQANuUCYQYrAoSlDEQtvKMJbMiJL76AmIL17OSO6JxzMBK6Ih6dxi9tg7EMKQ
yjnLRIIKswKC7creK4jt68tu61FNcIZqCktfNjp5Auvat/MecwA+MVFp8LTeS/S8lmYyM/zq7tmr
m7tf3zxLzPH5RhLEkbClOp1OGeGnr+r2XVD/tC63p+1yvxWFWFc7pyBOHZqJgSGRonbE2WbXkdQ2
FyEdgPiJKsEPBLxo4iRchj2kHEUlL+aLrriLlKADCyX5m4ZsFiq/bGUmcYtHHxJSsecjkqT8i5F2
HrOYeKo537Hab6EK1BZqlBp5qCr6jzqkspjN0AZ7zZEpHbqrxy4D2kuneiSGdP4rlx9oCkDMB+lc
SM97KVPMOyXkXXzeQn5Cy3pW9YqkS866tXQJs0cLRXxd8NGHLlPkfJ0oeUBcfGfBNutGZa5Zt/0k
cYM3bW5wTWCR9J7k9mreMyWeH6BMt9C8oNUK+JTg3/2OlTDul1STBYuxEH1hqhDLKL/YLJSJhYXH
Kn/NVGRNKUZw0bu+lqFp4ecoQ1PkhsaSyflAQ5MroNe/zT7Fd6fe86f3amg61CcjGAxGTlAEjME4
541zG2Wj0JCKxgTyA5QkcuLFCy+NonEQiyhVRZK+zajxAazYGRiO5iCB4Rh9sju/h1IoaKOH6HrQ
n2LOOrQ8TCcvmnDBFoWIyviQGYkQbk7JxRBuLh0EMM8bmj/6g+RNkZYY1PcAxjlJESdwl0KUgnGc
L4gEyja5y7qtYHw4LXfrZqgxKRhv9gYYUz4hO33jDDdwCUHaQwICK3jBojVhEDK7Yl6LEpzEXxgl
FFmUoK7VwCjhsuiuA7xN/k8P3rkMTwPeR8n7ZlnA15epmwdvg6Bo2x+cdyAgC3mkGEUVKuZw8Ylu
kihrJOT4SpfYgL+fv0FhZqvpBjfbKudUj/xVoxupFSDcUuQ1GuAjkvYp4gRy3QKgvZwa07OiHi3J
sarB0xhB5cmxfhCfruJs6p6CT1U1m/MGfSQGN0YQQ4DZgl6duI/KLOeDxWTNVtxYWZBvJGumRFDp
moGgOrUEefivfLDgZL8EGn7gIz/JCMN0QODptHDEfKJLgLcQ4lC70Ly10K+zJ11mqLmoZnq26F7Q
TyXCdFFr03e1XIgTvOZUDEU5c62jOlarjPDTPyrKOYGLuZDtSXZhXC0XIh1J4TZqcharqhPIGIey
RhSkHEYUKyh0iMVYIvMLSYTCRyiUhLPzAgSsiaDwf2apO1lPjLA624QGJQ5rB6SzWtbVf3amQzSK
3VIqGjZzPFmf844h7GQdaiI7wVesPaPe8h2rHeLujry64htrKcX8EeMYvgITE5u1EBzqjwV+U8wF
myC6rFGuTGLhL7VGWQgYbVBdUaLByBSFLB+8XNIRRwQMyZI6Dd2NXYJusCd0W1Q6xyd1gEpXS+oY
CCmTStCBGXsLcQQsZ1QvTQ+B0/S1qJKoQtajKMyyX69wqCYBCNWW0Eo6t7C/VFIQytYrEtsM3gyM
RGSNNerlkNx6eyQSxLO5ojZ5JGJowVAbnau8SyMdtofUNHqv8+mD2ugOhc0I+kjEICgi/cjPscgB
kyZw+cNcy4orZ586jSLEZdVtqgjfMU741NkFWQWgxL3wbYtlhStptqTgPmTIIU9jj7kWml9I3mdn
bPI/KirbXYLecgYJDTpz41F54xbKrhmbyOCafuuPhMo1ERIgfTeyOzb/J8dUQ4anwdS97CTPsju/
VkxN4p7qJEu/jbhnxHKHroh5LJaOGIKM7A0xlB8Ipgs69MTKnyPG5pNe67T0BWCvQ5SUhCfDF1Pr
WXxZjaYrwQFoKEcsYr9/D39DC8EIsT4LszpfaSAEuOMr9gMgR/xDUbJDiqpJuNbqV0c4YYvGxOGE
oQgCpHE7tqYlE/eW4eadiz8lJ34f/9L9ZO09zPqfYqj655Slg4y4X7CwO4uJoxxwSsWkTbZgARi4
WqBhTzcVH8qZzAQZTlUAK8QrH7FggajhfaAhW370dM/ZZGAQz6sHGoYWTGQU13IwITue5LY+ez0X
fa/jYUwMrjayV+p6BnJdvaMGkqYKWk2A4xsqvoZmX7jYSqI4VKLlY1mS4atWe+k3UYuJSnYBEFzR
wE/HXpqSMrW9NHWEFs9A6R/TXpqdxcRRDjilU9pLoML17KU53cwxcFCUe6a1buFdsoy4mdFRIFNm
L5md4KTCMJISWEmKoUSSAxPtqIPm212f2qcScL31KWmmCdJDTZK9PrXbHZuExT2lSRLTpNzt8Cez
xLWPvYS4Ye+oy5jcfCWIbiWKEEkX/PSFs5oJDkOIkOFiQdl5GhCWggpEpSxn8sbKfIPsje4X0NCJ
u4Sz7nJomawTtVBHFYP9nLF1FELP8T1WktRhLZg6O1MufGxb87dFYiTM++aaR7Z9Zs8QkrH7rgyS
ItQNnpVzotOEsLw5HpdysuOKuwbs6eEeRQ4K+kBpolNzC3j+l5gmZh2WpeDxA19RaUjvJUAZOpKk
uFkN3GfjwPpFCjHXygK0L17Y7Jw80WaI5FAAz9Ya3GHKanuyrjwggMuxi14AnhH3AG4TZ9aBooDJ
JRx9SZAnklJCCYVEPH4AHciG7ghQ0WLATsq6KYttfPk534ImbUpOgONg1yi27FoNYHsc79E0ZFgf
sVkpye3oF0mLvSYqN+MeRQP5Zmh8bn1ELg8gn557VJDtDnHsxfzFxV3yyaTaiOka6XTEPXYEH51i
TD/K1q1eodcbtO1+3Rw27mqTJgpnO5T8+mevHUo6neEoQm1w/sB6MWZ9xPFCd78aUSEFErxgbipb
Hynru1+dfImbRCAnbN/CDJA2+J2tOXMlUdfEL15zHnzfg7kvrMZ/Ctco2DbOyDl0bbrHQ2E7V1gP
25vs8F3qd9+nqqdrJZvdUW7OaaSCRKov3WuTSLU7LiVXBjVHK53qs1ZCFPlX55X77bZhBRoiZSw4
UOzgqaAsARrE6CvTnaY00/VmD0iW0M1XAVeS4JFFSJi1sfCuXj66WTv4F7WLhNiW7p/iI2qe0qTl
oR2gCUJzitDgz4yDFopqNK7lO6mQREtmSkkNhrRTZyORdLNTsGRyb1WeJO1lyWKc97xhycrRlswc
MaaDc9/bkukJaNZttWTQ+HqaJ7Vkhbvy6+Lz4k7pld9EUgwOUki9wA7PW1gP3DOx4PCjciZWjEdF
Kd0wYy/JAbQoXkcI11VLGMFTg3SRBtXYHzgPaVMqj28aF6Wc38Hc70oyVRJ/hrvOVV5oo6u0HAkZ
+8uYV84YInCo/T+rTzGyFyDPTnxbnRpqzbI4wQchm33toHXcoMgg5HXPEWTEfRBiE5eVzuDYkF+U
v/ZwnlBM3DVmBAIdBUhdHtolklGXNX9HE0VBxAxzytl1EoRaQKpnutN/MUsj5QsiEJuPF0cg7Rkd
aajpRvTO6OTeko8lDJLnMjpOPGQLHOAAHA0cHoLA2427mbErlhiJwLWJIQJTogDBinkzOv8UJQxP
XfcbrFATasAKVoK0kVzNiAv/JBrkSbrEbaJokzTRl7TzDrEM7+3AyEbEEv0juPYUUOB/M3YeFUtY
6Fub5mASJkLfVXYMOo0l/pKibxJLrI/LzfWWlTcr63hoj1iCMkWM/iimKTP5zb12FKn56HVDkWy7
Yn1CNCSSgMzesAgraXKKqgqhp4LgAY+vkHBmOpJ+oReorWWpXlBde6Axp8TG2PmEpxKnpfeE6AI3
C0fzlHRMrSVJa9/4CN1+AU+Oo2cOjmzlgJqtumM3buIkluQrsj6+0nNHLNJkHYmwxYwFIjNfF213
Q07vH4YgStRDvW71D9k54Usvpy+6TB3GOG+otzFOiTeyMP4urcoexUkEQKZtF/4Ie+XLrHn9Szxl
uQEKtcc3/krjHvFN7j36G7Za+uiFK1UACpdYV6c/XfdhDTinnlyd1WVdEykneFBkb0Nnk1smoGJq
7mOZhA5Uob91HbHrtsO6moZgeutqyPkkl4yst9k59dS6ylnOIYqaxIku42YTh5Vsv9sjPR1OdM2x
DmJCkcID2ElBfSfr4ucRQfOghBidv8rSeupYQ/yy9Xi8QF8o5gS/2Jck0c8ySaVebM82JgT4tfle
U9Be5FOEbFyyFk4T2g1tv3q82khKS4DxOeWncL6Z4E7nWX2Vn4DANn14TJywNDbuDIyMZfJW6K42
S1kM6QqMRkK3PTh6WxCkWmD0HrrDbwD0MJgx1m6HbuF/M5AX6Jscuo1pniYwqo61M+/NtNQDVc//
DECr6uWOhYNumzgv18P2JIJnQK5ijvQS0Zqwt5gBlqmuLETvRLOidKZRy3bhh+BYgi7+/jx7jONg
0twEZDQ01EtN+u5TRgZJEd4eF3+sT/JrE/ni8QjnSLsWFo+la4ZedeOaQ+0WlzRCHrM4NJYQDMog
okYWrU2lcwTeiauTbP5PjmuGBAZce3Z38+yrr/QwXIfZz7DH59urKjux7HxS2ezjheRuHLCZxL+k
L0Hxgi8W7HB6YbTu0sQSLkGuXql0l4iL3KVRPnENdQmCMPigkddVdESnoAOoQ2JUCg7MWLJNN+6H
BW3Why7Rcab+oil63azztR/sOlkZQ/eI+KgM8ou/XjqZwdO1RaWm9xdaCL9aa5M/t1qbyoo4wCEC
4YS86Dni3LcPwG/KL/jK2SbHNYOFI4soiznAd9ZtW61dH9fL01XPZQu/35uO1l9yybN1U9+6Z/N/
etORyzBNx32/u7lty7GS4xH57gpajr77/TPifqXWJo5sBvGRHyIuyullahahEuCvSEUTQlwlYgBF
XTa8NZ8BimyCyA27wjehaALTSGLQ4jDpAozIqINoAI+EFpttGqt8sZIdiobDmUs3PjGXGDJhDCCF
Do01HPZk6nQI84cYjvYMtdHQWN/fICn+EThEYSPvRP4cW1uXi426rSZgf5Bf0cuyIhNGDzK49ybg
RzQBNv8nNwGGDE9iAk4n8xAyYgf5O0Stk9BWkiI27R4GAKAFFa3veyEMGh56fnVGodcHKsISr4ng
JJpgawxFFFsjKqBb6GZvbM23s7i8irDJ0ODh0Bod4FZoNaZjJLIaFM8Bq+PpVldqm6zEd4JyK7Du
1svDNW+0tmeFzgrseS3b7Ab3PiszZPtpa7bZZv/UsGoI8DSoKj+g2+FX36eoqntw1puD/FZvYz//
NK6Cg5m1dbaXZ6ToRvM+OvrTzDbD7+UOfGgB1DZbAOT5Ib3bBmWBntnqlHHFKXtAbxktE7djPKD7
M9EOIR4PUDXLyRN0wm7/ZKcLTIDueAExtk9ukQpfeaMU8kUsxeukDKPEiujhgpOD0rqwKsNTC925
6T/dJZ4uxQ3fPCqiZIi3WKxoIPsGA+mSk7UQYIhsb4uV0rZ2qxi0xXbZm1UaHI6bVaiu9c0q0yis
26zS0sWw/UMV6r0Jij8fPnF2x2b/5CYo16VJTNBxb54EhmP/OoWNISsOLrVj0+7h2KcJ9LDjkFhH
2ASyBhCWw+PmQmZEGlanYWBeCHQA9wsNF/Ao1pb8M6uTYEdXn2c5auKzBBYB6NEEAZ/jw7jYUmag
YG3s9JWifce02ZGGzNuUkYZGe353iy0VPPoNjiRwRRbcOa6J53wfl6y4IsnaPGX+J1dEdiiNu9vO
7itEhnOVpoQmi1zW6+X2mgvK9iy/j1zk2MbqUF59UcBm/9RmwxDgacyG+B0dkcsfU7ORRC6rw3LT
PIk8jSPkzM2q6yAysZcfCObZ5poIteo9M9gB5lLjiU1nYw+9AwgQxw7AXS/nNEtEezaAXnKxQk0P
y2iwFMwmvjOMAHShCwzR8u6zd/qLFjHTRWrab5w3Ts77EB3JcI0LIyH0Ar2aKUFcRk4q1x0jqeui
EpGQ72JfkjFi2OJ+cJT8wHqYBQwT33+DQAgvwI/LgrWLD5T5NX/RHtVonie7NL1YNo2+qZvnVvxb
bhpxTp2Y9hcpyAxyctyKfxhv8/wWZoJiR0VXwQAGoGyYTgUL1m1NSgIG6xFhGnhfPJd+r5g9lxRo
iFniYtGToiOK0elhAZ5wIDaBE6wEySa5mvyEafv/fzbQZv8o025cMyKtNL30oaY9d//llpHDJjuI
67aJ3VvbxNS0V6e1bEJvJCUnu2RE+iTg1FRWwAfkmWLIdRtCMJ8IaIgYVuleIiOqUztEWYc+kCSy
bkuP4hKV0EmgorHslwh6EZbgO0uEMSiIIPzjmNgRXotgR7w+/kiW/NlCbuHBNxZpuRPL4a1sHgAH
IgsFnPGEiMdOstv0Img8pYzGphdlIrtOPGR7TLxxC/JTPnl4qGQkspT5bSkyXQMn7VOHKYnUW9fO
jHZ6ZyLznjszZVB8W2tnVOm6mZrGX3eJSxlbE8FcbvV94vLtRKA2+0eZKeMEuyHA0Uw9u3mW/LbH
ea1LXEoxU/uDdRaWZmrUnjSbtqKjmgfGa1zUIOABXTVG6IHAcZ0tCTE6sJVomwOxNorrOnn9E0Cb
ekb45zEUEtaBxqhG7GYNvztmLXcu3C6GGmsnDzOEuoEo8BM4NeRp+Bm+a4YZYbxNzwVzwI5cI8yo
Dodlle99mC7MsOeScgUFeB9mxIUn/Qm9cjXBFSQ2+0fhtxFmGCoV8fvVzav7XsdRciRw+F1ZxwSJ
3313lAXazkOVm6kbC7huDUqa0bQGPb+1QzhxaT9zCuj2xToMlL8b8eXlT/z2KwcY8vXTnznklg8O
BOVPfHyIxbxdkMceLOWvswn+j6cFGrVkwHDYNLk13IGN7Gp1YA12jXRgDYpvzYHdr8N95ddyYG0Z
vhgAnRRLHMnkCc3wBXmWd+FIns3+UQBoOLCGADsAvL+5Ewf2rhcA5qGdAOBuZ54zFkj1UtByAZMs
oS6PzR/8niYkE7SUPhn+E1dX4bbQkWWYT0cGRRw2+jzL5+pDzsxfx3PlJJtLUvmv48XmEqcYrkVs
Ra+bbb/8IuKz368v/nJYfqeGkdDXvt+ihVhu0b1c/+ZmRnb7syyddc0N5y4mxwUl1pUCEuKQGUWA
jXkHyXs2lTHj311HJcWFFyypU8G4hX1A6hYt43tc7NHMFKiya7eeZcKY/MNfe+d6RohwsP2S1Env
rvRpH1ucR/4oRRKGusOMthpTZcCtxAnmmttdVPX7+JfAz9pjtzNYXpG/AsTutb2trdDUmEvXxW1t
BKK6cU2ji3T34KCcnV/EsLtIwWXERAVjiEo5ZBkVfAJVj18SUpknRSgxVUrUpM6e1l8SGiHh1jT6
G2NtAZ/aAhozES3gq5tnI84Vbo/mgXSoQ8smgmpTLQ9X20QgfTIsINL1dO34Afr9UTQORMX4Idkd
TEFlGYKvHn23BMz7AzQNXF9Gky+CqU0ME7BbxZ6VsEuumGP9Qu2RFgdpDlN7mlnY7pMzwzYPdLCo
yWjtNsem+wviioWylWXyFjRVRqWmjSVUc8qUR9wFkR8mKlsOE9Hp6AkZ7WDq9sF1XvnUbhQbWleE
tZBLjWIe2zujaGsRzRrmsmYUvb9YzptG0YXkXgH+I0XaQQG0W0cJo27m4Xpc7EK4qdu5EWiuDoS3
czavqHkGr+gnUJihr7JYPyKIbGCPOpAgz4apDqhCS4uigKCFW+53fZJfE6F+URtJ5xY+pDUkJxni
kccyRhggi6WXaZTPwq3OXNYeRbzVCNuiNbURDq3UljDVCD9cHoZuBUeMnXz30Sd1N87UeRt+X7aq
9st9c71/GqWQOFQ6ZVhh4geEjDhNqaF7hyLRcKkrB33CXwolHtDU4QFIRWEtdJMe67JZCjQqkRri
yURTgjlgXRZVs5WRQ59gvNEMtsuRBjlCEnylJoxNo3OxVqE//ENVJUFWwhYFEjY2UtBr0Y6GIJpT
Rx5iaEAOkgU7kl6xMxzdbIPA3Thc1mz8s+a9sq1Oe7sFdlka2wLn2R638GXr2fAM7rktCEY7IzO4
BsW3lsEFylzN+JpA82MY35okiMF7Jy5Vs3F+ctOZm7hoOu9vnt1fbjo3e/NSBKHo/RXZ3KCWs8Nh
zfDCrVvZtM8fwy3mRFaCJJy0zg1jhFsCMq834StANPCU6MusTFLZeW2SFIxl1ACTGgMoVqLeaSQX
owIOis4k+kJy9A74Iy9v4FTyySP/RFzReCyouH3ovsUzD28clluTI/cRkQvC+V4zn1N3wZNQ73J+
MPA+wRO37JI5F2cUpa/F8weR7Hyd1WcULZ60H5StXZ2PjOKqWu669yuMyyi2dBFSYjCW/KMuQfTT
bdExPqE2QN9YKbg07/ql7rZcTw32xiQT7F+NuT9Tbni1AqXXEe3vUp3XfdHH/VJ288mBsnW1W8oG
hWq7rPaTxUnSJwMq/hOx29yLtiyuZVpP1HyOIhmwwg9faIIsKexkXnAUOkN6EWgU7onc1AYGEPmT
LKRYx4U60tdNeNREvqMdYZt8hWrFnCY0+bVfvO1zQRpJ/hlpjReehbLjI9+GR0jgUNlHckHKXP+X
RGS2Wn653RZrKx1IzO7wZdJciXVVQ2itlobrHZ3k1tIl9mwVgHCQywy7da0WMI2yQGl8Z93a1p1k
CYy6XY9O0phx3Dme2txwsyS9JChf4gkwQ0eBw2hSgxVzhJROcIKVoPskhxIUX7SNlXSWzIiS8+gJ
iPvUYMSRSDcJ8UnnFvaZvQMhHRLLJP0L2ZWLU4PJ9URnk+2WU+TX52oT6HefuR98HmXy6svc6/1q
Y6lANHmvb+5kI93D30rv5775P6NybVoKZW5kc3RyZWFtCmVuZG9iago1IDAgb2JqCjczNTUKZW5k
b2JqCjIgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAzIDAgUiAvUmVzb3VyY2VzIDYgMCBS
IC9Db250ZW50cyA0IDAgUiAvTWVkaWFCb3ggWzAgMCA3OTIgNjEyXQo+PgplbmRvYmoKNiAwIG9i
ago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+
IC9Gb250IDw8IC9UVDEuMSA5IDAgUgo+PiA+PgplbmRvYmoKMTAgMCBvYmoKPDwgL0xlbmd0aCAx
MSAwIFIgL04gMyAvQWx0ZXJuYXRlIC9EZXZpY2VSR0IgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4K
c3RyZWFtCngBnZZ3VFPZFofPvTe90BIiICX0GnoJINI7SBUEUYlJgFAChoQmdkQFRhQRKVZkVMAB
R4ciY0UUC4OCYtcJ8hBQxsFRREXl3YxrCe+tNfPemv3HWd/Z57fX2Wfvfde6AFD8ggTCdFgBgDSh
WBTu68FcEhPLxPcCGBABDlgBwOFmZgRH+EQC1Py9PZmZqEjGs/buLoBku9ssv1Amc9b/f5EiN0Mk
BgAKRdU2PH4mF+UClFOzxRky/wTK9JUpMoYxMhahCaKsIuPEr2z2p+Yru8mYlybkoRpZzhm8NJ6M
u1DemiXho4wEoVyYJeBno3wHZb1USZoA5fco09P4nEwAMBSZX8znJqFsiTJFFBnuifICAAiUxDm8
cg6L+TlongB4pmfkigSJSWKmEdeYaeXoyGb68bNT+WIxK5TDTeGIeEzP9LQMjjAXgK9vlkUBJVlt
mWiR7a0c7e1Z1uZo+b/Z3x5+U/09yHr7VfEm7M+eQYyeWd9s7KwvvRYA9iRamx2zvpVVALRtBkDl
4axP7yAA8gUAtN6c8x6GbF6SxOIMJwuL7OxscwGfay4r6Df7n4Jvyr+GOfeZy+77VjumFz+BI0kV
M2VF5aanpktEzMwMDpfPZP33EP/jwDlpzcnDLJyfwBfxhehVUeiUCYSJaLuFPIFYkC5kCoR/1eF/
GDYnBxl+nWsUaHVfAH2FOVC4SQfIbz0AQyMDJG4/egJ961sQMQrIvrxorZGvc48yev7n+h8LXIpu
4UxBIlPm9gyPZHIloiwZo9+EbMECEpAHdKAKNIEuMAIsYA0cgDNwA94gAISASBADlgMuSAJpQASy
QT7YAApBMdgBdoNqcADUgXrQBE6CNnAGXARXwA1wCwyAR0AKhsFLMAHegWkIgvAQFaJBqpAWpA+Z
QtYQG1oIeUNBUDgUA8VDiZAQkkD50CaoGCqDqqFDUD30I3Qaughdg/qgB9AgNAb9AX2EEZgC02EN
2AC2gNmwOxwIR8LL4ER4FZwHF8Db4Uq4Fj4Ot8IX4RvwACyFX8KTCEDICAPRRlgIG/FEQpBYJAER
IWuRIqQCqUWakA6kG7mNSJFx5AMGh6FhmBgWxhnjh1mM4WJWYdZiSjDVmGOYVkwX5jZmEDOB+YKl
YtWxplgnrD92CTYRm40txFZgj2BbsJexA9hh7DscDsfAGeIccH64GFwybjWuBLcP14y7gOvDDeEm
8Xi8Kt4U74IPwXPwYnwhvgp/HH8e348fxr8nkAlaBGuCDyGWICRsJFQQGgjnCP2EEcI0UYGoT3Qi
hhB5xFxiKbGO2EG8SRwmTpMUSYYkF1IkKZm0gVRJaiJdJj0mvSGTyTpkR3IYWUBeT64knyBfJQ+S
P1CUKCYUT0ocRULZTjlKuUB5QHlDpVINqG7UWKqYup1aT71EfUp9L0eTM5fzl+PJrZOrkWuV65d7
JU+U15d3l18unydfIX9K/qb8uAJRwUDBU4GjsFahRuG0wj2FSUWaopViiGKaYolig+I1xVElvJKB
krcST6lA6bDSJaUhGkLTpXnSuLRNtDraZdowHUc3pPvTk+nF9B/ovfQJZSVlW+Uo5RzlGuWzylIG
wjBg+DNSGaWMk4y7jI/zNOa5z+PP2zavaV7/vCmV+SpuKnyVIpVmlQGVj6pMVW/VFNWdqm2qT9Qw
aiZqYWrZavvVLquNz6fPd57PnV80/+T8h+qwuol6uPpq9cPqPeqTGpoavhoZGlUalzTGNRmabprJ
muWa5zTHtGhaC7UEWuVa57VeMJWZ7sxUZiWzizmhra7tpy3RPqTdqz2tY6izWGejTrPOE12SLls3
Qbdct1N3Qk9LL1gvX69R76E+UZ+tn6S/R79bf8rA0CDaYItBm8GooYqhv2GeYaPhYyOqkavRKqNa
ozvGOGO2cYrxPuNbJrCJnUmSSY3JTVPY1N5UYLrPtM8Ma+ZoJjSrNbvHorDcWVmsRtagOcM8yHyj
eZv5Kws9i1iLnRbdFl8s7SxTLessH1kpWQVYbbTqsPrD2sSaa11jfceGauNjs86m3ea1rakt33a/
7X07ml2w3Ra7TrvP9g72Ivsm+zEHPYd4h70O99h0dii7hH3VEevo4bjO8YzjByd7J7HTSaffnVnO
Kc4NzqMLDBfwF9QtGHLRceG4HHKRLmQujF94cKHUVduV41rr+sxN143ndsRtxN3YPdn9uPsrD0sP
kUeLx5Snk+cazwteiJevV5FXr7eS92Lvau+nPjo+iT6NPhO+dr6rfS/4Yf0C/Xb63fPX8Of61/tP
BDgErAnoCqQERgRWBz4LMgkSBXUEw8EBwbuCHy/SXyRc1BYCQvxDdoU8CTUMXRX6cxguLDSsJux5
uFV4fnh3BC1iRURDxLtIj8jSyEeLjRZLFndGyUfFRdVHTUV7RZdFS5dYLFmz5EaMWowgpj0WHxsV
eyR2cqn30t1Lh+Ps4grj7i4zXJaz7NpyteWpy8+ukF/BWXEqHhsfHd8Q/4kTwqnlTK70X7l35QTX
k7uH+5LnxivnjfFd+GX8kQSXhLKE0USXxF2JY0muSRVJ4wJPQbXgdbJf8oHkqZSQlKMpM6nRqc1p
hLT4tNNCJWGKsCtdMz0nvS/DNKMwQ7rKadXuVROiQNGRTChzWWa7mI7+TPVIjCSbJYNZC7Nqst5n
R2WfylHMEeb05JrkbssdyfPJ+341ZjV3dWe+dv6G/ME17msOrYXWrlzbuU53XcG64fW+649tIG1I
2fDLRsuNZRvfbore1FGgUbC+YGiz7+bGQrlCUeG9Lc5bDmzFbBVs7d1ms61q25ciXtH1YsviiuJP
JdyS699ZfVf53cz2hO29pfal+3fgdgh33N3puvNYmWJZXtnQruBdreXM8qLyt7tX7L5WYVtxYA9p
j2SPtDKosr1Kr2pH1afqpOqBGo+a5r3qe7ftndrH29e/321/0wGNA8UHPh4UHLx/yPdQa61BbcVh
3OGsw8/rouq6v2d/X39E7Ujxkc9HhUelx8KPddU71Nc3qDeUNsKNksax43HHb/3g9UN7E6vpUDOj
ufgEOCE58eLH+B/vngw82XmKfarpJ/2f9rbQWopaodbc1om2pDZpe0x73+mA050dzh0tP5v/fPSM
9pmas8pnS8+RzhWcmzmfd37yQsaF8YuJF4c6V3Q+urTk0p2usK7ey4GXr17xuXKp2737/FWXq2eu
OV07fZ19ve2G/Y3WHruell/sfmnpte9tvelws/2W462OvgV95/pd+y/e9rp95Y7/nRsDiwb67i6+
e/9e3D3pfd790QepD14/zHo4/Wj9Y+zjoicKTyqeqj+t/dX412apvfTsoNdgz7OIZ4+GuEMv/5X5
r0/DBc+pzytGtEbqR61Hz4z5jN16sfTF8MuMl9Pjhb8p/rb3ldGrn353+71nYsnE8GvR65k/St6o
vjn61vZt52To5NN3ae+mp4req74/9oH9oftj9MeR6exP+E+Vn40/d3wJ/PJ4Jm1m5t/3hPP7CmVu
ZHN0cmVhbQplbmRvYmoKMTEgMCBvYmoKMjYxMgplbmRvYmoKNyAwIG9iagpbIC9JQ0NCYXNlZCAx
MCAwIFIgXQplbmRvYmoKMTMgMCBvYmoKPDwgL0xlbmd0aCAxNCAwIFIgL0ZpbHRlciAvRmxhdGVE
ZWNvZGUgPj4Kc3RyZWFtCngB7V1rjxzFFf1ev6KJ40kvA+Ppnp4XC2yCvV6CrRiTJcZg8gEHK4og
EuH/S7n1OKequ273dO/MOCgyIO08qm697j3nPqqHX4rnxS/FuinqzWax2y2r4mf7bt0sF8ulvPup
2OzrRbVRPmGPn4p/Fi/Mv4sHD3+tite/FsvFZrndNataXm1X7h95tWr2y2q/KX59XaxkrGYnQ24X
VS2DbNaLWt5u60VT/OdH8+aEc0pXtlnt7Erq7UqGlYGKF0Uy6WIp/8rkfpG51o17515Uu6La2c1Y
bs3rn4vPbotGFib/yp9qsyzqql4Xtz8XD25vq0VVVMXtm+K7ovzo2YUVVJSXF8X3xe0XxfWtLKuz
2eaOmy3z7l2YucPCiu7C6t3eLczkC6vtupqi3F8UH7Zf/MF9UhXlS7T52rZdF6V/b0q2WLimsjsP
3ItVUVYQt4OU37kX0psj3Q9Df3Bh3MjzGdsMyOGglAw596y8ypRDYth7xiH4EZb5TZjXywvTe9TT
7co4uxo66tPocBXOWlHi+RKnIhvdXZohAPy2tNgh16q4fZ0aahMstavQ5Xt/aS6K23+p5nnozOSE
AjpyK+58ZmYAdzLzrLarqg947gfjoEF9gjOc8yOv+EUJQ3jfKrBYI96z4ayr0c1+u1gKP9SNZ4tN
s1julkuBwmZRrff7bb9Ois324Gq2vtpK7AHWgAam/CBY3XztFijTn13hFXEBK5qxEdsQDu7ZHRPY
YidsB5u27EBQT0DpUcQDAsPHbvi1KSn6GntP2fmE2IZysLJPu7vfC/r9u24PdpDNnLk0bXOphSP7
9r+SFchmbRNAGKG7smnCoHVnmM2yO4xx/Fk+vrl8enXzTP6LxjnJQKy5Lzd119xTYn6crGCI9b12
msj6jhxFuAKY43jNeBVSeE1OS6iVBANFnP8+6DrVKFioKT+13wh/sg91D5oGbXoRWnY/Dz2jQVEP
+WLWL30O8cCUTy7s8mQVGIcTohDKJb30M7Ap52JWkXsmaYGjttZJef0SNWiZ9B3FO1LRtUxIRXZB
MAnbk6AU9+HGnoi0eRr+Xrmtkw/Ye+PEiLnBk/rb+L0w4qpqxu3Jo7Ur9Fr33rjX/o8cqQzdywHL
/WK7se77GTlAn2bQG1OS22gYAYOL8hrQyzavLvBR5LdHQRej9s+hyJQERaZEtKAei51ShUzHxy9O
FXZoZ+mBWt+kkwN1a5gOUF9+d3egrvb7/RBQi3lwd10EtVsv9nXR7JvFphH9q6u19UmsB7IRIjRT
w7rc/RCPuGdS4wDe2n47cPEBC8CACEAKwDdUKUIjXwQVNzFU6sd+6jzlYYDoIxGoo1/I6XCCtBQK
mulRVwB9dqS/xY6YAZtoZiR4aEouOTPBh8BDCgFFRuNmJyGVwLR05MCBllP8GcV+MPN8E+azGUJO
4syfgSVRwAwShPHaCtvrtx0RrMv0XYamHedYxutR3XsPPrh/tbtnVUNQ/f7783SWA7Qash5uOC2s
ssN1XaF2WDVSeMcJdTylCRf2nsJTxIkWT1mkOD4B5AKVvjlCQ6D4iQtApqc+QXeGAxUhdDk7dvLK
b0rqd2ZSGBvi2ZJeGboEyDD022BZ84FQpxgOdTzqxSVdY0syUBAoO7/J9DJoj8UoDHo4ULC4YkMd
0zLM2oY6mqKEUOe7qxtJFCIPcdhgYjRic5DVfrXpmmAa6jxLd3eKcBvq9AhH8otwyRcBm035Q/Br
X5Xu3IURM3+WON6njzaO8GpEfWRTdh5NNiYmHLuWQWEU37GMGNHA7Obs0xVGGVT0SBNoC/FYn/SJ
JjBwSMFdGcL/1Ubxp86H/7nyTcX/RJ1taqtH5QBidEro5ogLExyQuKuClRKFQmuyvrN0u63PHlJb
zXa/WLuqRBrWbI5g6ri4QBfq8dB8oB8tugjRJJEfyxFstQuXmLEf2dkJe8Gm2KygpTEIgni2pEKj
C7ceTSHc0YWdkyQlqP10tyjnGlTA2UFQRheK0Y6niw7NG1u5OVTnCRY2QBdO402n5HN6ulAMy2fG
Xr26eiz5qzvzxU7ye3lphzUrCeZGQVFWEHN8oQt/jgNncgMM8o2liSapDlGVGAjwBbWFGNBShQHY
DHMdgE193jlsJkWegfFSJVLdZhmui9KjYTMLWb2zrIgUNwCGxS2j7cbID2aNtv4IojPIvr2wKd51
YyvG/V62sbXh8ebXhc3W8TCPR83AzBmFAUevoXgIl6lDvovU/548ypQSyhl9l5cUxMatbJxwiOkN
9DowNGof0sCrExu5vE/V2hHm8BQYOipB3x6mlfcRGHp6MwqGcoW1buuuWnZNIHVbv0phyFJ0SPw0
e7kvcLbEjz4pJn5IZcx8U5/ohn7oEM0m5S0R2mg7fACdxF8SJD4Y8CiDKCo8+9I2Sa4Yjh9QLCze
xKp6/I5L4wuOIeUe52WwMQd94NaYVvDpNLx+z5mefMcXHuuTcgWm6jcgeiAcOdsZQBVb0HOCLFn2
96bnysXJ0rERniqXdBG1USh1epkhtXqdN/KBRvNGKrwDKYFBcuFT0y2wzn4icJeERhBBmG3cae8/
6zuNEhmUgDocXpgSVnndJQSoGA35yRP2hrhHtKU504pslNskRdFOZhy2o8DGxijR3Xrr5QOLworm
np5G0mFOSiPbZjtEI69epft70GXrVHorka5sD/wDmxr2kSaPPE0NW9CWKJROCfGTrakgGYw9dHoa
833tzH/UmIMrSi/COKzSN2w6VnlWl/SMJLxUrFL2bipWRev3CKWIPOTjhkOA3cGkEWbgPU+i18dd
2RJT5uOeMDWgHwzhhY47tYcQRHRhG8k4hYXHhaHcmdSlsSuUhO2gRN8iicKPxCszfMsyDZw6HOXd
3pYGMBBQ8Gp8sla5l2LtvosqIVn7+dXluGSt7vVudk1XcOr13h6FViJcQSvmXalKOGWgl63qWXWR
JC0dK+oNuY/wBX+Qijij3oU2ppToSASK90cgIwxScgZ6/IBDSQQWJgZV5VBYBCw5JmR74dmUKTzb
CabwbD1HXtY9iKsJU3gfUN/86biaOT6VvWpS6eL/GPgnP7Y/2W9WEt9yLz9zRyJnzHOTs5myYi0n
5nFZn5xeqHNDGt6IRua12ksdP4PXI0LnyB3ec+yZI/xB2gIDOamWW92T9Co3DDoX05SMd2gmUFR2
8gqaFOpaOuHNblKZzQxNiMhNlcDKWsmyQU/zCFLTdMQjt+y/gnxHIbdWZlOOeSpy5xboDLCW64n9
V/0/H2lLmXCXNt2owqFuAFya8vdOa+W2BFrkmEp9ZCdIoWJG2P47NJ2NaQVsTR+BQA7FYidoOvtw
EnzBrzjjlloOwG62cQF21Z1rmdgojMvFe9hVxTMJiC1I6jXM+9yEtMnT8JdQwd5k5q9tE0HmVk7x
8F5oxhYAWZ22DshJStuiAgB5uZKLVmcFZH2O7wDZPYrVujl4HkCuq7cCyPkxR0AWf/fOdaz1eqcB
stSvHGmL+UXDjwnk1W63kIcW2jcHj9jfxM2w9yVkUsqmfpa5XiPQdOdAOUkg09Mldsar0/A6CLQE
5eBUJyEcSCNvS8F0HqL7GK/NfQyfnK1ALRyU9MEmQMpuk8SZ6d8TlTXaV9/zVDRHwt5wLthIBkQc
2W+NiVELheRt81sdcYvY7Td5fTDqrOdQXWmnc2hICSXiHYfqhkoWhGa0ONQGZ/J03s3/kEP1aU/h
UGLN2dLhPXN8x6FviUN1yzl5UKMcs+fQy5urm2PugjR79fllcKhkuiKHHvZHo+G7oEYXTi4kHAMA
ED5EGCXuPwFnEVhJXviGJVnAPe+4UwrpDbcBKI15IdSJ+E0Yx5RRbEgcYWCwycQ71XGzPAjruzUd
hHsCGV38MAjb9If4H+cH4WQv3BVAfbLYcB4jc4EnvAK4kl8I2NgLBm3MPo2H6B+W3a8VF5G5T1hD
QoeMHKnJ2IrjrgC2lMsmoszQo60H7nv7QhgyYyY+g5XZeSviH0xEufRf+usSIwrHB0sIolzK/p8c
sxUdDph9eXUjAHvnuMf+uIaSiAJmCx1EzE7invVusbb1q/SJqdNotY17ZFLKpsYLVFQCoCU0mECL
L4KOJwVP9oVpsA9TUQ+dxyNYNYteOWgkuVyYYTiuxBR8lhbzIr/8NeRmwqDyTCqDGw6fTSwWI/AV
5L6w4qQuwooLvshiKC6b48V1E/l872SJN8FjFjVoX9rhghjJYGTsirQ4/9UZgZm+R5d0xT7yDmZC
LS4YaQ3CAuIwD7pg5DAPmvwRh7EJvbxY6HlQtSqcm8qDwTnBmaItfCu8Z9++evcKeNHmwbQgc+Sd
Tv0k7syDduHuKnwo2lDfsRUkTyANaRUtaHHRaP3jJ2yZCe0YYnzmQHlyypTMM1DONUI1zg4nBCZN
nmZO5ufnNZFJ1Z88Ekk9PxJxmEnbTGT8rx8dxaRaMV7hFjLpY6m7jGDS3L5sSWe1UZ89BpM+7WHS
ZrVozvfssT6pyKS98E12oAnh6SISCJWM5g9to0JSyreWQIRRw+XXJH/IzuwUSRe2BbmwJEgL4vVK
PMeO8jgEBPIDSoplLLShHHBqYjjeTeUWsem34YdggAU0Ve4ZpHP5s86ixPsIcKBcZY1LQvBJ6OAc
OM3YWPKvIQqD7HihmP24J726ce1VOZbdz3FZPaFad9NMNFlxVFtBR/RUp2QX/I0IXfwwk7+1iLa/
NKdPe1JaEQDUT81H3rLtmSO4CkadeMLv7krgBxBPEaLK/ivR1FHEqt2VUI55KrHm2SZHrEv1kWQQ
67MeYq13i5UtOZ8nRF0ttSdjcVmMeE8wJRoTZ8kaE4iVnXvxO6YWOSIMDJRDId0vupM1ZaQOtAWj
ZcLAjiQitAgMl0SVkIUW9CjwQbcBSdKPnlT5+A14kItztTLPzyRdJmaxLrnRhjFl8ZE/DueRut7v
uKuoGakpqi05ATKvzDxOaoDUco/Uhae6kg6TWh6ehhm4nyO6i3vvL5HIXCJ/M1TWmSpZtD2JcIlk
BYtuM9Vp0k4umarvFw0VatliqhApUsegT++SqTZlJD+mFH/19mAIqO//6ZkqVUX/tONpmKpu1Ieh
wVTyd5Q1ZzToCmC68MNPxpnyC+gkNZnaCpVGC8B7clODELt3wYNccibGZnRHuXNyCRvHoFPQ17rO
IolAxxcZa7VSSgMQmG2aL4TpuzYdYXPxDmF18cMI+9bChoRtXAJQnyyOnudMBj9lIaxaLeTm9BkL
YbI4xculXnFRVFH6aNeIRNgmKig3ZfZ/8cBLSwNIwkcBrJZjU84iAOzjq0upJdw5x1bt1Me8AbBf
pQAbq1X1Xn52/XyPeeuT+pI/tQoDIxIirRXrRXO4r4gFgMvsM8qdzR8PVMIBqjQhmibBT+gVs3FM
HcHRZ68Yi3C2RPH4HXbBryyJBv4RaktYMhoyKqBUfQ8ClcClT/Zgsktv+D8eGB93D5SgdMXIS1B3
9Ap84koGiX41f7rhN8JA/Ykrfdp6OKDfKadVt8OBtKZ0ZOKqZ46gCyhsKxyw2nj6h3zgltGuMDaM
5WBNKT7dQfSZ9JhQ67klXy8arin50Ht8TemIME7TMv+YkG6BR/GdlvpSFMXynfzquNzOGFdTyv1L
m/qqKu2J8Y/Ad6OfR8+ku4hCl/6jxePUN2fUMBda8EcfIZleFF/wOxQ0Vs5gxCheWMlyW+HSIb4p
0YA9MPQXz2FjZCS2ib+Wz49QbckGwrWFbCBFSLQov0TSDxcGW4Mxxhgphjb8cZeXX4bpGS5bZjMq
/MuTOa4AIqelOLjTIxkvPn3i1EUyujIM84jLFb2Ne9VJJGPNYikFp4FLS7cjN1q3Cl04Y2hqJLE4
RgvQIWgINIY/WoMLoQxL0IK6zCcPmKt842xBzAZtIX3GqbA3PwmhTFJnjf4RFZqGzf6MgOawVQzK
ymF0WtkL5kWPkILlm1Eqn52E9230oxjWyRNF18//C8vBQ7sKZW5kc3RyZWFtCmVuZG9iagoxNCAw
IG9iago0NDY1CmVuZG9iagoxMiAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDMgMCBSIC9S
ZXNvdXJjZXMgMTUgMCBSIC9Db250ZW50cyAxMyAwIFIgL01lZGlhQm94ClswIDAgNzkyIDYxMl0g
Pj4KZW5kb2JqCjE1IDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNl
IDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUMS4xIDkgMCBSCj4+ID4+CmVuZG9iagozIDAg
b2JqCjw8IC9UeXBlIC9QYWdlcyAvTWVkaWFCb3ggWzAgMCA3OTIgNjEyXSAvQ291bnQgMiAvS2lk
cyBbIDIgMCBSIDEyIDAgUiBdID4+CmVuZG9iagoxNiAwIG9iago8PCAvVHlwZSAvQ2F0YWxvZyAv
UGFnZXMgMyAwIFIgPj4KZW5kb2JqCjkgMCBvYmoKPDwgL1R5cGUgL0ZvbnQgL1N1YnR5cGUgL1Ry
dWVUeXBlIC9CYXNlRm9udCAvVElEUkJLK0NhbGlicmkgL0ZvbnREZXNjcmlwdG9yCjE3IDAgUiAv
VG9Vbmljb2RlIDE4IDAgUiAvRmlyc3RDaGFyIDMzIC9MYXN0Q2hhciAxMDIgL1dpZHRocyBbIDQ4
NyAyMjkgNDIzCjQ1NSA0OTggMzM1IDIyNiA0NTkgNTI1IDc5OSA0NzkgMzQ5IDQ1MyA1MzMgNTI3
IDUyNSA1MjUgNTc5IDM4NiA2MTUgMzA1IDY2Mgo3MTUgMzkxIDUyNSA0OTggNTA3IDIyOSA1MjUg
NDcxIDMwNiA4OTAgMjIxIDQ1OSA0MzMgODk0IDI1MiA1MDcgNTA3IDUwNyA1MjUKNTQzIDM5NSA1
MDcgNTI1IDU0NCA1MDcgODU1IDQyMCA1MDcgMjUwIDUwNyA2NDYgNDg4IDQ1MiA1MTcgMjUyIDQw
MSA1MDcgNTA3CjMwMyAzMDMgMjY4IDYzMSA0NjMgMzE5IDYyMyA1MDcgNjQyIDIzOSBdID4+CmVu
ZG9iagoxOCAwIG9iago8PCAvTGVuZ3RoIDE5IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+Pgpz
dHJlYW0KeAFdlMuK20AQRff6il5OFoNbj7bHIARhwoAXeRAnH6BHyyOIZSHLC/99zi07k2QWx3Bd
D9UttXr1vPu0G4fFrb7Np3YfF9cPYzfH8+kyt9E18TCMSZq5bmiXu7L/2mM9JSuK99fzEo+7sT+5
skycW32n5LzMV/fwsTs18YP++zp3cR7Gg3v4+by3f/aXafoVj3FcnE+qynWxp93nevpSH6NbWenj
riM+LNdHqv5m/LhO0TERFeltpPbUxfNUt3Gux0NMSu+r8uWlSuLYvQvdC5q+fa3npMw2Fcl+6/jp
+Mk8P7W3ynvOu4q8V0Wm5LpzmU//Sw7+NlDT3yfJ0qoU3oei4nkZErxfbyVzJCBzyQIJyEYyIAEZ
JNdI8H5jrZ6QQGer3SKBqCXXSKC2U22DBGQq2SKB5EyyQwLSpopI8L6wzjjOWSi1Pck5bgQySuJG
kKzOOW4EK7Jk3OTmqNDMOW4EtWtJ3AhqLZmXkdsL2WwUxZxgKo2RY05Qa60wl5tBFkgUc8J7ZkNi
TpDcSmJOIJ8kMSeQelCBOcEmTWIOL0hOB1HMCYbUzKzEYCq1wpZBlINQFpgT1Go5VBhMpT0XmBNI
S8ZcYQbxRRRzgqksGXOFGQwmMVeYwU2tZMwJWsl+gTnBVLJfYE4wldXyBtmwkrW6gFdBVGcj4FUg
tSueZpAsvxwuA0cWxS8nWa1kP+BVUItfPrc/Bz9dv/sQAqsQZOp8smmDge0prCHYKhiMKGsQJGsz
gTUIZpCdwBoEM1gr1hBuq9D7CqwhmHe+DiS+Bcna2xrfgs5K5mswiOoEsniDqCXjnQ9TyWrFuTMY
Q2vkozQ4NhqDE23w+qj9ZxW6hHRZvl1u7WWeudfsRrUrT1fZMMa3S3c6TWpg/AYiKGchCmVuZHN0
cmVhbQplbmRvYmoKMTkgMCBvYmoKNjcyCmVuZG9iagoxNyAwIG9iago8PCAvVHlwZSAvRm9udERl
c2NyaXB0b3IgL0ZvbnROYW1lIC9USURSQksrQ2FsaWJyaSAvRmxhZ3MgNCAvRm9udEJCb3ggWy01
MDMgLTMwNyAxMjQwIDk2NF0KL0l0YWxpY0FuZ2xlIDAgL0FzY2VudCA5NTIgL0Rlc2NlbnQgLTI2
OSAvQ2FwSGVpZ2h0IDYzMiAvU3RlbVYgMCAvWEhlaWdodAo0NjQgL0F2Z1dpZHRoIDUyMSAvTWF4
V2lkdGggMTMyOCAvRm9udEZpbGUyIDIwIDAgUiA+PgplbmRvYmoKMjAgMCBvYmoKPDwgL0xlbmd0
aCAyMSAwIFIgL0xlbmd0aDEgMzM2ODAgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngB
1b13fJzF1TY8s/f23otW2qKVVmXVe7GltZotybIt2bIl27Ildxv3jm2MwVQDgQAhoUNCIGACsmxj
GZJg8jg9BkIoaRB4UiAkJpBOkfRdM7Mjy5A87/v7ff88r8zZ65q5y95zZubMmTNzLzu371pNTOQQ
UUjJyk1DWwn/q/g+4KGVu3dGRDp7HSGa9DVb124S6fyrCDGkrd146RqRrlIT0rVh3eqhVSJNPgFW
rUOGSNMKYNa6TTv3inT5A4TQ3I1bVqaOV25E/h2bhvamvp/8CunI5qFNq8X5h1l+ZOv21anjtA+3
s1NxkH8mKxsPcvI7mWnFV4B30Aixk/8iOqICFhPc0XELvZKocZQd19w3etM/f+RYbpv2dxLQ84uf
+eOBHzPyvWu/dsPHH43dYPiT7ikkDbiD+MN1uvvGfkGI8YGPP/roAcOf+J1SBzl0jBiUyKjqqhMG
P+0AOSzJlZJcIckhSS6X5KAkl0lyQJL9kuyT5FJJ9kqyR5LdkuySZKckOyTZJslWSbZIslmSTZJs
lOQSSTZIsl6SdZKslWSNJKslWSXJSklWSDIkyaAkyyVZJsmAJEslWSLJYkn6JemTZJEkCyXplWSB
JPMl6ZGkW5J5ksyVZI4kXZLMlqRTkg5J2iWZJclMSdokaZWkRZJmSZokmSFJUpJGSRokmS7JNEnq
JamTpFaSGkmqJamSpFKSCknKJSmTpFSSEkmKJSmSpFCSAkkSkuRLkidJriQ5ksQlyZYkS5KYJJmS
RCWJSBKWJCRJhiTpkgQlSZMkIIlfEp8kXkk8krglcUnilMQhiV0SmyRWSSySmCUxSWKUxCCJXhKd
JFpJNJKoJVEkUUlCJSEpQickGZdkTJJPJPlYko8k+VCSf0nyT0n+IcnfJfmbJH+V5C+SfCDJ+5L8
WZL3JDkvyZ8k+aMk70ryB0nekeRtSX4vye8k+a0kv5HkvyV5S5I3Jfm1JG9I8rokv5Lkl5L8QpKf
S/IzSV6T5FVJXpHkZUl+KslLkvxEkhcleUGS5yU5J8mPJfmRJD+U5AeSfF+S70nyXUm+I8lZSf5L
km9L8pwkZyR5VpJvSfJNSb4hyTOSPC3JaUlGJTklyVOSnJTkhCTHJRmR5Jgkw5I8KckTknxdkscl
OSrJY5I8KsnXJHlEkocl+aokD0nyFUm+LMmDkjwgyf2S3CfJvZLcI8ndktwlyZ2SfEmSL0pyhyRf
kOR2SW6T5FZJPi/JLZLcLMnnJLlJkhsluUGSI5JcL8l1klwryTWSXC3JVZIcluRKSa6Q5JAkl0ty
UJLLJDkgyX5J9klyqSR7JdkjyW5JdkmyU5IdkmyXZJskWyXZIslmSTZJslGSSyTZIMl6SdZJslaS
NZKslmSVJCslWSHJkCSDkiyXZJkkA5IslWSJJIsl6ZekT5JFkiyUpFeSBZLMl6RHknmSzJVkjiSz
JemUpEOSdklmSTJTkjZJWiVpkaT5OPOW4TWPhBrC8JlHQh7AlSJ1xUioDqlDInW5gIMjITMyLxOp
AwL2C9gn4NKRjBk4Ze9IRjNgj4DdAnaJYztFaoeA7SJz20hGEy7YKmCLgM3ilE0CNgq4ZCS9FWdu
ELBewDoBawWsGUlvwSmrRWqVgJUCVggYEjAoYLmAZeK6AZFaKmCJgMUC+gX0CVgkYKGAXgELBMwX
0COgW8A8AXMFzBHQJWC2gE4BHSPBdpShXcCskWAHUjMFtI0EO5FqHQnOBrQIaBbQJI7NENclBTSK
6xoETBcwTZxZL6BOXF4roEZAtYAqAZXiZhUCysVdygSUCigRNysWUCSuKxRQICAhIF9AnoBcATni
1nEB2eKeWQJiAjLFraMCIuK6sICQgAwB6QKCAtJG0uZAWQEB/pG0uUj5BHhFpkeAW2S6BDgFOMQx
uwCbyLQKsAgwi2MmAUYBBnFML0AnQDsSmIdv14wEugFqAYrIVIkUFUA40AkB4/wUOiZSnwj4WMBH
4tiHIvUvAf8U8A8Bfx/xLwiP0r+N+OcD/ipSfxHwgYD3xbE/i9R7As4L+JM49kcB74rMPwh4R8Db
An4vTvmdSP1WpH4jUv8t4C0Bb4pjvxbwhsh8XcCvBPxSwC/EKT8XqZ8JeG3EtwhFeXXEtxDwioCX
ReZPBbwk4CcCXhSnvCDgeZF5TsCPBfxIwA/FKT8Q8H2R+T0B3xXwHQFnBfyXOPPbIvWcgDMCnhXH
viXgmyLzGwKeEfC0gNMCRsWZp0TqKQEnBZwQcHzE24hCj4x4lwCOCRgW8KSAJwR8XcDjAo4KeGzE
C6tPHxV3+ZqAR8SxhwV8VcBDAr4i4MsCHhTwgID7xc3uE3e5V8A94tjdAu4ScKeAL4kLvihSdwj4
goDbxbHbxF1uFfB5cewWATcL+JyAmwTcKM68QaSOCLhewHUCrhVwzYhnCGW/esSzAnCVgMMjnjVI
XSngihFPL1KHRjwYbOjlI54qwEEBl4nLD4jr9gvYN+JZhVMuFZfvFbBHwG4BuwTsFLBD3Hq7uHyb
gK0jnpW4yxZxs83izE0CNgq4RMAGAevFdesErBVPtkZcvlrAKnHmSgErBAwJGBSwXMAyUegB8WRL
BSwRhV4sbt0vvqhPwCLxuAvFF/WKuywQMF9Aj4DuEXcSBZs34mZqnTviZh12zoj7MKBrxF0ImC1O
6RTQMeKGI0HbRWqWgJkis23EfRDHWkfc1wJaRtyXA5pH3IcATSPONsAMAUkBjQIaRpzwC+h0kZo2
4uhHql5A3YiD9aNaATUjjplIVY84+gBVI47FgEpxrEJA+YijAJll4szSEQcrWMmIgxmkYgFF4vJC
8Q0FAhLiZvkC8sTNcgXkCIgLyB5xMC1lCYiJe2aKe0bFzSLiLmEBIXFdhoB0AUEBaQICI/YB3NM/
Yl8G8I3YlwO8AjwC3AJcApziAoe4wC4ybQKsAiwCzOJMkzjTKDINAvQCdAK04kyNOFMtMhUBKgFU
AElO2FaEmYzbVobHbKvCn4B/DPkI8iHy/oW8f0L+Afk75G/I/yvkLzj2AdLvQ/4MeQ9yHvl/gvwR
x95F+g+QdyBvQ35vXRv+nXVd+LeQ30D+G/IW8t4E/hryBuR1pH8F/CXkF5CfQ35muST8mqU0/Crw
FcvG8MuWePinkJfAf2JJhF+EvAB5HsfPIe/Hlk3hH4H/EPwH4N+3bAh/z7I+/F3LuvB3LGvDZ3Ht
f+F+34Y8B0lOnMHns5BvQb5p3hb+hnl7+BnzjvDT5p3h05BRyCnkPwU5iWMncOw48kYgxyDDkCdN
l4afMO0Lf910IPy46bLwUdPB8GOQRyFfgzwCeRjyVVNh+CHgVyBfxjUPAh8wXRK+H/w+8Hsh94Df
jXvdhXvdiXt9CXlfhNwB+QLkdshtkFtx3edxv1uMc8I3G+eGP2dcG77J+NXwjcZHwlcr2eGrlJrw
YVoTvrL3UO8VRw/1Xt57We/Bo5f1mi6jpsuCl3Vetv+yo5f98rKkU2s80Luvd//Rfb2X9u7p3Xt0
T+/TqmvIGtXVyWm9u4/u6lXvcu/auUv52y56dBdt2UVLdlEV2WXfFdmlmHf2bu/dcXR7L9k+b/uh
7cPb1fXD29/criLbqXF04szx7cFQGzB5YLvF3ratd0vv1qNbejev2dS7AQ+4vmZt77qja3vX1Kzq
XX10Ve/KmhW9QzWDvctrBnqXHR3oXVqzuHfJ0cW9/TV9vYtw/sKaBb29Rxf0zq/p7u052t07t2ZO
7xzkd9V09s4+2tnbUTOrt/3orN6ZNW29rSg8SbenR9IVO3uAOel4EhKkTSXBZPDN4PtBNQkOB88E
FactLZymyrMFaPPcAN0SuDxwc0Cx+V/wq5L+vII2m+8F3699f/apXUlfXlEb8dq9Ea/iYWXzdi1g
ZTvubWwRWFrJy9rljcXbbB5q84Q9qtawhxLHm473HYrnWfsLdpXNRm22CZsqacPpNmvYqmIfE1Yl
aS2tbrNZwhYV+5iwKN6kBTns4XPM8xa02Uxhk6q30TTXpEqaGpvbkqbCkjai0AjFyo8doOjZ01BP
uG2UkuNeqqGj9JZjC+YnEp2jetLTOayft2SYXjecPZ99JrsXD2uvGya9i5f0HaP0c/3HqKp5wbC7
s3uxSF99002kKaNzOGN+3/ADGf2dw4dAkoxMgJCMY17S1J9YtmPXjkRi5zJ8LNuxM8H/Q4ruYin8
4QD+27ETafYPgDRhR/7znzgN5y3fgT9+G3H3/3zJ/wNH6P8Dz/i//BGPETTRvhkTqqvIKtVhyJWQ
KyCHIJdDDkIugxyA7Ifsg1wK2QvZA9kN2QXZCdkB2QbZCtkC2QzZBNkIuQSyAbIesg6yFrIGshqy
CrISsgIyBBmELIcsgwxAlkKWQBZD+iF9kEWQhZBeyALIfEgPpBsyDzIXMgfSBZkN6YR0QNohsyAz
IW2QVkgLpBnSBJkBSUIaIQ2Q6ZBpkHpIHaQWUgOphlRBKiEVkHJIGaQUUgIphhRBCiEFkAQkH5IH
yYXkQOKQbEgWJAbJhEQhEUgYEoJkQNIhQUgaJADxQ3wQL8QDcUNcECfEAbFDbBArxAIxQ0wQI8QA
0UN0EC1EA1HPmMCnAlFBKISQVRR5dBwyBvkE8jHkI8iHkH9B/gn5B+TvkL9B/gr5C+QDyPuQP0Pe
g5yH/AnyR8i7kD9A3oG8Dfk95HeQ30J+A/lvyFuQNyG/hrwBeR3yK8gvIb+A/BzyM8hrkFchr0Be
hvwU8hLkJ5AXIS9Anoecg/wY8iPIDyE/gHwf8j3IdyHfgZyF/Bfk25DnIGcgz0K+Bfkm5BuQZyBP
Q05DRiGnIE9BTkJOQI5DRiDHIMOQJyFPQL4OeRxyFPIY5FHI1yCPQB6GfBXyEOQrkC9DHoQ8ALkf
ch/kXsg9kLshd0HuhHwJ8kXIHZAvQG6H3Aa5FfJ5yC2QmyGfg9wEuRFyA+QI5HrIdZBrIddAriar
ZhyiV4EdhlwJuQJyCHI55CDkMsgByH7IPsilkL2QPZDdkF2QnZAdkO2QbZCtkC2QzZBNkI2QSyAb
IOsh6yBrIWsgqyGrICshKyBDkEHIcsgyyABkKWQJZDGkH9IHWQRZCOmFLIDMh/RA5kHmQuZAZkM6
IR2QdsgsyExIG6QV0gJpJqv+l5vp/+2P1/+//QH/lz+ff/kytmOIkPHbpm4SIvPIBrKDHMK/a8hN
5DbyLPklWUEOg91JHiAPk0fJMHmO/IC8dtFV/z8T45dqNhGzcopoiYuQiY8mzo8/DBnVWKfk3IaU
Sx25kDNhn3jvU3nvjd82YR8f1TqJkV9rUb2Eu/2Vjk18hPFVSywTVSytuhbcxr/pA91940+OP3JR
AeaRbrKYLCFLyQAZJEMo/yqyjqyHZi4hG8kmspmnNuPYWvA1SC3HWbAlnF84awvZSraQ7WQn2UV2
499W8B2pFDu2jad3kT34t5dcSvaR/eQAuSz1uYfnHMCRfTx3L44cJJejZq4gV3ImUeQcJleRq1Fr
15LryPWosf+cun7yrCPkBnIj6vlz5Gbyn/hNFx25hdxCPk9uRXu4nXyB3EG+hHZxN7nnU7lf5Pl3
kfvI/Wgz7IovIOd+zu4gXyTfIN8lJ8kT5EnyFNflSuhWaETqZQ3X9Fbo4ADKfHjKEwtt7pnU1kFo
g5X7SKrce6G/K6dcsTulR6a9wziTaedIqh7YXS5L5UhN3IKSCX6hnExHrAw3X1ROecX/KZeVmOnp
HuhLaobp7A7k3fWZ3KlnTOV3kHvRAx/EJ9MqY18GF+x+zqfm3zd57gP82FfIQ+SrqItHCGMSRc7D
yHuEfA19+zFylDyOfxf4VCaOPkG+zmtumBwjI+Q4OYGafIqcIqM8/3869iRsx6evOZ6618jkXU6T
p8kzaCHfImdgab6NfzLnm8h7NpV7lp8l0t/GXsqz/Cx29NtoW9+Dhfoh+RH5MXmBfAep5/nn95F6
kbxEfkpeoxawn5A/4HOMvKj5LbGSGdh4+TRq4x6yjCxLzly1fNnA0iWL+/t6F8zv6Z43d07X7M6O
9lkz21pbmptmJBsbpk+rr6utqa6qLC4qLMiNZ2fFMsN+t8Nus5iMBr1Oq1Er8GwLWmNtg5Hh+OCw
Oh6bNauQpWNDyBiakjE4HEFW28XnDEfYdUM4dNGZSZy55lNnJsWZyckzqT0yjUwrLIi0xiLD51pi
kVG6uLsP/KaWWH9k+DznXZyr4zxhQSIaxRWRVv+6lsgwHYy0DrftXnekdbClsIAeMxmbY82rjYUF
5JjRBGoCG86NbT1GcxsoJ6rc1rpjKqK3sK8dVrJbh1YNz+vua20JRqP9PI8083sNa5uHdfxekfXD
eGZyQ+RYwZkjN47ayYrBhHlVbNXQ0r5hZQgXHVFajxy5dtiRGM6LtQzn7futHwpcPVwQa2kdTsTw
YJ09k19AhzXZ9ljkyN8JHj52/k946ik5Q6kcbbb974QdZEWcVNMwHZKc4NnwhChfNMqe5YbRJFmB
xPCh7j6RjpAVwRGSLE70D6sG2ZEz8oinlx05JI9MXj4Yg2ZbY62Dqf92r/MPH1oRKSxAzfL/sofV
2TgeGVbigytWrmM4tPpIrAUlhC7JAgRtWkCSQyllth4rKcb5Q4MoxHqmhu6+4eLY1mF3rEloGxm4
SXbr+vl9/BKR2zrsbh4mgytTVw0Xt+JaNJHWI6xi2AOye8W6+06T8ok3j1VEgsfLSQXpZ88x7G1G
pcRbj/StWjMcHgyuQvtcE+kLRoeT/VBff6xvdT+rpZh9OO9NfB3+UIH8KpTtU2fLk1HsYV22PtKn
Cir9rLaQEWnDR6xpGg7Yh7UiyWq0aVqkjwaJPA3fkjqDsYvug4SS3TwLFwNxafOsYBSNm//9D48U
FAXAYwzrJ59JjYfQXHgm8T3/8dHE2eyB8iKtq1umPOBFN0WCP2Dqbv/+OVVMFyll4BH0rDpnsTIU
FqjAIzisH1ahnDyL1aI/MkzmRfpiq2P9MbSh5Lw+VjlM17x+O+fHWGCQ13aqlSy4KCWO14hjwyTa
uaBPJljMZrgtweuVVStPz+TpyeSsTx1ul4cjR/SxzvlH2JfHUjckEfQgVI423j50Q42zAp21DYYy
1jYUi9gjbUeGRicOrThyLJk8srV1cF0dusGRWPuqI7H5fdNQl7zfXxbcx77aSTpp54KmwgLYnqZj
MXpd97EkvW7+4r7TdkIi1y3oG1EhKDrY1H8sC8f6TkcISfJcFctlmeyUCEuwO/UgoefnB08nCTnE
j6p5Bk+vRFyW54mTkEfJylGVyLPL81TIU4u8JM/rxx96mH8dqgB2uDWyilXPgf51Rwb7WeciXlQl
/qPDNNZAhlWxBoRyteZhY2x107Ap1sTyG1l+o8jXsnxdrGmYeimUMwqbdGQwBjuFJteHEHk/Woed
tX5VdmR0YmJBX/Rc8Hx/FF1iKWRx37AhgXFAk92B82YyGUT2zOFDK4fYc5BedHXWM9tX9qMvyBvi
lPZhA+5gSN0BZ7Txa1hzxEUrUTeoQH79ISSGD/UP9yfYl/atZ08UidiHyaxYHapd3FMTZ19U3H/E
GStjDRunDhuzr2VgwLMRBKl5ThBJfBkMLiuRzownXxnDoZWDEdSAmqycj6YubKmR1RtyVsMkquOr
uRiDqYOEFUvJNlmMw4Yi3BD/MW4qwg3xn64fSmGF56lrUyfgu+3DJjxRfIoqUxdAOzjUzp4F/12L
h2enPsdu0z1KemJ7YRrZQ/Ov0uHwsCW7fQjGX1xvQk6sRl6Me+mzWRa7x1mRq2MlN0PvSvaC0YlH
YpcyCyD/CgtibHBgDZMET6Nhk/4jn84YXpIoLNB/OtfCs48c0Vv+/QVCX3rLJLK7RFox1hCiZq+x
vAB8kMTUi8nj6hYypP4TeVx5B/J18rjGTJaoPyGPq9SQm4hOGSCPa19Dfj5kNlmpzsQ1ffzcmcrv
iU2TSR7Thch05RWyVF1B7lRWkMXAQeVjMqDaRrKVs6SS5SP2djV9d+IV5Suc36ldRe5k+eoafj7j
g6of4voo6VY9QaJI367cSzI1o6RS2UPylPtJppJH+pWTuM8EyVdlkWcQjfyi4iMUkeRWRI6vhuxD
bO4GpZLcoMshRPmELEJ5B4FZwEsgPZBZkCcg2yFrISWQ1RB2fCWEndODShHv8xBixnzzDqSjpA0z
3BDxkwhJI3k47iT5JJN4SQ4pQqvNItkkRlQYczUkiBlqAcklATIdvmmUZJB0Ukk8pAbvDRWSOlJO
mlDh7cRHHHiHqJnE8b5UC7Hgu9pIKZkFj1ZLEni/yEhqSSuZSapINSkjelKCd6sMZBpxkzCeiGAe
8SAtpr9TrVC9oHQqJ9RL1B9r2jRHNR9qH9bN0J3Wl+lfNzxp9BofNJWZ3jLvs2gt91obrM/ZnrCX
2Y86yhw/dtqc77uucNvcD3saPaPeg96PfEf8MwKBwKNp1rRNab8NeoIDwcuDjwR/mO5KX5l+Y/pL
GSdCs0LLwzT8ZOSV6HWZjZm/jv0060vZXdm92X/L/iR+Ek+lQWRih/ISZvEKyltLusgcsuQbxIJw
m5fU0ZMnPS0t+kLdtxBKU5EIgnF6Qmlz0qZWWU6lpTXGTlVqb1Ic7aO08ESj7iaVijSOvTH2fPHY
G+edtcXnafHrb73xlv2D5x21xeVvvfxWaQl1RB1c3FaVTufWxjKLVJU58ary8rIGVWVFPJZpVfG8
iqrqBqW8LKRScKbIaVCxNFVe+mSxMndMqzoYa1xYrgml2dwWrUaV7ncWTsu2z1+SPa0oQ6fotIpG
r8utbsrs3Nia+QudI8PjzXDq9c4MryfDoRv7pcb60V801o+b1Rs/vl3R1i9tzFK+ZNSr1FrtaMgf
yK+Pti+0uexqk8vu8Op1Toc5t2Xp2DWedHaPdI9H3GusC2qJTXykPqhxo33Fyb2nSdbEOyfMdjo7
Npoi8dGJ90+YkGOSBOu97yfTWFa2nX1a+KeZfyZzaTY7XGCiXVmxePbfzCazPzMjZrRQr9pMzHaz
6snYs7EXYkrMHDM7M3qcvZpe0tjY6KytLS4eGHD4ah2gjnL7+TJHOTSeGBAxMqwkZnu9Wq7yHCWq
WJVYZjxeVU2Fnn26mBJV79JTe3Y4nO0yqLeM/X6DYnTF0jOybVRPR9SWQE4okp9mVe+nv6bfnu4N
WtWKzmyg9eM/MFgMao016FWPmKx6RdHbTDeN7Ue3xhyXqClaVwh9pIZ8P5kW9ttpV9huYx8WfPjN
+IigrNh9WJTMTfMkcdyTxHGPx1TATi5gJxewkwvYyQXs5IKnVWWIK505CU7i5dD0cZwJfP84TuaI
84H/OI5L+HGcWT6qsictD5jOmFSmtJy/lZbqskYpdoV0V4xS0zHdAtJ4vpG321paPPAW11rZywlB
0JwTiVrBoVS3VR2LZsYrHRVV5VG0Sg9rzyGFVhSpYjEHa8yuC1RNwzVzV25rH3/Cl5fno/Gdt68s
8yZm5Fcubc0dH0urWdwxcra5pyowJ3vmJd3Pf1Tf1xynO6av7WnI94Rz1FfmhAsW7OsqWjCzxmms
7NmsosWzK9PHB2L1c8der+ubFh6vSa/ugY0bmnhfbdaE0ItXHE8n9YmUVoBcK8A/HYdWgO8xrfDj
0EriW6pyWDE/LYb1i9OCEdd89TM0H0awhBYdMyxEl375PBNaLIpvf/VsaUm22yo6bwXvllqmANZN
WQf2uEPoqqK7qs0qjd6dXL6//eCPbu6af8dPLq/ZsLgtqNcoar1Jby2bu23uwptWVVeuvGVJ147u
CpvOqFVO2f1OqzsvJ7jgoQ/uffCTJ5d6IvlBqyvN6U53GXKKc1qvee7A/m9ePiNeHNc6QuiBrJXd
jFbmhK3dk8xojFIXazku1nJcbpTZ5USBXX6U1vUMazkkTbSYtJRuOOI8IG8xwHeO4+y0Z7DuZoBu
zCPW7uAojR/TiFYidfGybBEDaBKqi5qEbkoDuHnhV99/ePw9Xv3ZX3vn3u6TFVseu+bJYwce216r
uutrH3+1R1T0oq+8c+f6k1d1fOJoOPQcG9dQMuUASlZAdh9Ly0nVKJDXKEc8NZA/NT+Op84ZVTmS
BoMr4org4dNGqT5pORSnZ+L0xTiNx7WBUZTH0p0DOKadbPUD27ajiou5GbGLYpXxer64WLyiow7Z
6GOCKgfURot+7DZWQtUavUWv0eBjXEtH9DANagP4HBXVW4zqmc6gUy9Kq3cG3c6gQz++wWBPdznT
7LrxUr0jyMs98ZGyAOXOIUuP6VypcgN5uTmyWk2Vmx9ndYtyn7RkkFCGDkU77nIFtKM093hmd4AZ
yNSIVHzWkerGKJ2otKmFkaON7NjKAhRMNw7t6fDwnCf17kiaP9OtR1HbeO5ZVzpKMUtnD3pcQYdh
7Hc6i06jwYf6iZwwhhxWoiUT76n3aiKkkXw5mZGebvOzFupnLdTPbJvfiBbqt6MUflZ7FvJsDo3k
JHMGc5QcW6r8QF5+IO/JQN6T+XFcaRtVlZ0orqAV/lFqPJGZWVvc8Aw1Yow30ryR2vnuUVpwrBj9
mfdmDBJsgE7ZuZcHBs6KOkd2Si8X9eaqagezd6y386p3MAvIBm/R/9XqvWq9WWeuWXZ48SWP7W5s
3ffo6mn7K8dfdjjUBowRd5u8TqOzbumKVaV3/OkrCwcePX9Lx5WrW9OM6mWuDJc+XhSfc+RbWw6c
uaolI4NempkFNer19nTnuCstnpHpNw88/v7td300PJQWy0vLZP0CY+48jLnFZPREYymNmVMqAnIV
cYRagbxr8ONQkZkpN92XZWLaNzHtm5j2TUz7JmYfTGyM8JGkBwNL0sU+7A46myRxnPjYpiEcYPgU
jvnyezCAFCRtZ8z0RTM1XzwaFw9sO99IMWq8zEaSVIe60LEGYEGFYwOXaJIKbao8yJNUPU/vjvrT
Im792HGwAGt5enemPxB161VdvC2CpUH7aHJmvaph7NuSq38h2dhHKq3kqf5F+6A/D5l3qtE31/ek
TyEpFQK5CjlCN0CuQn4cGiJPwyYaJ86cgiaM9h7ufKCYk4bwQrlkCWiffG6DJ+pjzz35tBeekD2V
buI9+ls8VS5BaIwIE/1/9TgZeBwH7cqwxnoMz9AyOP9+jF2a1NgFqzb5eLzHZxZpU+2Wj1MYxcVg
5aG/TW/Z0pNeXZRp0mlUCkYofSBWFM4sidhFEVwG2tZ1aHGpweYwmx0Bpxe+pM1pcxR1z1Dug/bV
rBek7HYnSpJGZp0mHlES7ITjiuUIxQK5YoF8sPGgbZ4gBluPZ5QmUoaZFp+TiuV6FT5H6mm53VI6
YV0NY2d9ebJR0BeZO9bpDroMsLNPyGr/+EGDIz1V99oEbOs08njSPtiwtUFlKSnxFRcbi/x+PvCh
a/ABEb2DI54VyJ+VH0cjSGP9KJRVajYbWU8ysp5kZD3JyHqSkfUkI2sn8NGSAdZosqq6TX6fpdhf
WqQN53aHe6Xb2uiEw1qOjiI9LXitspc4yh2104vLy5kfO6W/xCjzXYtUOTQ2peewOURI5aPlzKFl
1KNN6N3hgC/q0qvGyxWTJ8PtCblNqvGZFL0m4I+4dAXBdZGSLL+B7tHQa0xp4Xhgky3oMl9onms/
vl1n1ClquCWYKNwpdal+OD/LnJYb/GSR8nAoP2AyuDI8Kat0UOPATPLq4zk2mzvVozhCQRyhI+D7
zAPjaSjHzZUZMhYVlTFllvlxbpkfJ5bZcVYZU2YZO8VOQjU9xiJbjjrAxjQ2dMPt99Uy5aXsywXd
FUNnvMkITcXjOTGv1/Nv9BVSfOVx5smmWpX6oMWTZqlOy4nFPOPrIjPSVSqV3hX2+8NOfUFaT0ZO
OMNB6zKqykr9FEO6KxzwRpz6mW7MjEwZZTmqN2svq591R8cnf50cBB/LzTT68sJj369YOThQPPfo
XNW3MG+AV4CuAu9t5cR59TuaKDptDjmQTHMzHbhZg3Iz183NXDc30wHUVJ40RDCzPoSZRSilXCDv
VUA+KAL5oMiP46rQM3BvjSSAIdA2P8Z6FjMLcPQnXbjUEHhh1JO2gXtwU/xZ9Tsdt71x+62v3NDS
cfsbt9/88k2tJ3OWfGnr1i8tz4sv/uL2bXcty1Xdce8nx5YvevgfD9z50ZPLF371r49u/uYNcxbc
+Mza7Wdu6Fpw8zeYtwrf5nvof+mITOw9lqVNFQTIC8IRBQfyLsePoyBa1gR8jgymngymngy72UJn
Z7D5UAZG/hHiyMa4f1yrNaOYpuOebvMUt0c0ENmxUmW9uPtgXFdPcVqV7yX3fH3vbQZXNMBMdn4a
9eR3rd80O+9k/aKBgvvvnrO2LUu5beiezdPGiyb7Bapa52tceumiuRsqrGMf5s5cyWqYjdYmlLgK
kZPPJ0P2Ike1Hk9dzUpRzUtRzUpVzWq5GrV8Ko/NAvMaHUwlYBxxLkeoBshVA+SW0wHVjKQX2eHp
PrU1SZNJ33Ro4GS025eaGzPfb+A8pnWpbiJtDZzdVC9h5kQpUjB5uzAWs6md1xdSUpM7n8vrpRXx
nHg8NcVTm7TurFBa1G1S7/EUNiyo3yGVhVmeq3RGWueOOTmxpqW1kYrCXPdOq358rGVeoLH8819r
WdkUhpHBcGFAFy+tWNQYG/v5pBLhNGoUS83CLc0z1s6tc1sT0+aUjv8mK0O5evZ6n047PjtaPw/W
ZubEeWUl+k07efs0mYFggw2hhBlMZVARR6iOI3oQkKtqxqiqIJkoS7rcdHZZEmNmVllWmTnoZ9cG
mQEP2nFVkBmeIKuO4NPY+QgrfjzIPYEzxwMpdAt8ysbcI3PRMzQHgS8jjSdNjkg1rU6azHQ26udM
0shYtaPa4Z0Gr/zkjKAmb753lOal+iGq4LyDhS4SiQH7eTu65RR/iU9GpPM02UHVsoOKoNHkYP7p
SahWWdm858GBGVsW1ftMGJj11vJ52zpqBpqzynrWb17XU16//vMLEou6prm0apWiNelMxS0DdVXz
KtLK5m/YvGF+Ob1kyecwVY9k+rPDiB7pMnNjoep55dVz6kvLGxZsm9t9+cJCWyDsMjn8Lifmpumx
jIySpuyqOdPKyqfP34Y6sqGvv4aWn0lWn/InoV6/Aw7NmRNghHdsKJt3eLRujjgAvLjjs4HUgWAH
jjm0TjalyUj17TI4Xh/wQMV3EvaziZSGpviTUemiM6ddeY1PxG6X3tj47XKiplzFp2l8HvPxfZMN
cYXeke5yiVAX8xweg6W+FF5NgtyZzBgspBHWayOsF0dY04mwsT/CWg1+98iedEz1otHSiDdl6YDc
0nHEdUBeYH4cV3ufxk5XeJjM12avRiQNcLaN8R57D6bgst1w11p0Z9ZgBIObkHLwVBcGNEcqHHEh
R31p66HRXZcMH2wRUzmXvmD+rvbOXd1wGOBgR+HlvbH79KGmhkuf2qPEpDo++cvia7C61HflIsUn
85hWpk98pH0TWplG1h6PT6NloxP/SjazRp+N6tEzkltMEehjOdk0089IXib1RxgpLKWFJbQwixbG
aHVPfk+sxKRMDephdG9EqfDHAnmpf9mT/g+P4jFPCJG8qin+zwVPqAwxP53msNqenhcKJ9Kt6vEP
VB8p1rS8SLQg3aaMP6aljngknOXSqWiMUrdicGeH0qNug0LzVDRD0bpiGaGYnWriVgcbsx1W5Sef
FEuuPupDQFDRW00fn1XXmWzMAbaZPv6uut4IrrGm+Zj9XwpL1aj8ELH0JBlORmxN4abiJsVk8FWY
0WIqWNupYM2mws7MEKJx/0xi6p9jI9RMWOsidazF4FTgO8y6ccQFDLnZqxtV6ZNuh+87pMJeoao/
U0EJ5sEVRTPyR2kwaXsxk2ZmqjPeLeqY/itzl5oUpyJ9A+fZNHhg27IB6Q6cTSwbqC0W42QZBodl
8DtZzBQeUqWInXLjU17JojuTweoGNXc4dSL65S0vq6pWGu3pwbSwtf7z3TN3dBc27Pza+gPe0jm1
04faS816uD+6YNPCNRVD1y2IP3RTy6qmcP+8GVum+81mjN/mxY1t2W1rZsze2pHdVjGvMpgRy9Db
A7ZARlosw1XQe3DBWV9hY17b/KYWaPdOaPcVzTascMDvPNnYSI3RqlSPAvLRAMitP0tzfVWN0n8l
g54Ec64SEWg0wfSfYP05wTSeGFUZkwbiMVZVRtWaklGqeSreEWyzz64FPabpYh4UC6n4MKamfM8L
OpvsgzkyKnih6zlEtFm6VjqHF9pqUCmvlK+8ZSDR3taWg6iQB86kVueK+APwLHM7Z83KXXHDotwn
PBULk5GGZGtOy4Hmhr7qAH171zNXtTnidXmb0R/Vasy/NDV8VMXH2O/yamL2OYeHd7VeuWq6M7+p
bPzO+YumrdyPHrsYGosoP0CI8/pj6cweMycD+CZrW8B3TkAZhIfTcICH2aATIPcsL4TZJt5lFyDc
Zkpaiq3UGng7nDRaZoURFVCdcHUofyxltt5gmVVaMEq1xwxQ29jLCRZ+SVwIvZyF9RKBtk8FVHky
lolRLTQZTlUiKo0uMK2zr3jojtWVM7bd2Z/obqn0G7Qqp8WWM623bs/l0eTAtNqFjQkzm7h82RFw
WALZGc7k/uO7rn52X709LdNvdfmdOeFobvTUE4sO9yWyEjG9CzEqFRmEXu7BHtE4Ysg3JMON9dQU
rGW9s5ZZ9lrmGdSy1lHLGkvtM3hjgJBiobVi1sJwHMhtO0dcxPNxdjFrUEZXtM1UmxNUW9EtNSP+
DnR19XFrF5Yr0Zh4c4JZTxl1AawPXpj6Te2CcM0m5ywKfLIpjnq1co/Oke5mizUz71yy8sZFuWUr
Pr987uGkzh1mbcrwcPNlLY1oQWhRM6LTk205AdmA9nQt7Dp8bMXOZ66a2dqsMsk5zFgr2s6KA8mW
K1ejLTXDJVKRAWjrTli1BNYRn0jmF1c1Vm2pUlysN7ki0JLLFS1gflQB05ZYwOD2DW3hw5MtiYcS
KhaaP8l6W4U61fiAvI3xNC4DCgOnZvqLRgu+d0h9i1p1Rk1fVFO1Or34V/EO/7uD1q1WldXwbjpv
YANiFUPEc7kWy15PiEkOjF0CXgI6qDYWndKs0E+nNj6VJ6eKK1Sn3JkTGBsJtW3tTq5qLzbrTFpF
pehMVQu3Jbc8sr1u2rYHVm74wmDhw8qle6YvbcjEVDEn2rl3YZEnzaOzBpwWl81sCvhdDftG9+08
fUVry467+1xX3l40e3U1GzmzsV/4Gs1ejJyrRrx21gF5xwumrBZDbq1AuIMA5GYMbsCHIyX5WCd7
Melk8bls4/mqmWnx8yWzIrPts9i0+HwZm+ElzpZz9+hsohxrFtI14E3Fwy029DDF44eZl9adT4bV
qmvUGr1W5wnlBbMrItYf6E0GjdP2Az1ME8IH+svtduZWXh6btakj1pRl1isam8tn1RhMBn95d90K
nSPNlRX55I+II2FcNOkVTyTLlebQDSy7dmGexWZ2IdatkMrx25Trle+TBqy9LicvJj3Owpmsl83U
o/HMjNhddPbM8kZ4FWwEBPL+BXzzKXaoUTcXNGmxOensuUG1rUQp1+lYa0JnhL7OJC0gheW6YFBX
XqhmOk5WoGGRPvYVfRE7LuvLz06agNm2Ep1S0/EL8/x3PJ7BGuUP02blR5p+XtOx5OeRuanFsUY+
Yp5/VZj+RPm5ROJswgf3nTnwDowH9nMJ/JeQH0zr0DFCD3xeFc/Rwp55falZlYwgV2N4xYov+2SK
9/ow8cJUa3I4Zctp8ZwcK6ZiYri43mW7IpZeNnBoTvXKoNM3o+qPzVt7iioueXjbpjtXFNijpZHS
4rLscFbF0itm580MU7vDMT6+eqBkZrFv9ZLSWcW++cu7/xDJ8xuu2t25uiGo7IyFsxYVz9k7vyDD
6ywKxYpURlV0en99w9be0uxkf0W0oaY8EJhdMH0wnj3Q1LVvQaFBHx3/YOnaSE17bv+acPWssWV1
jSp9oDAv1zOjOaOkgbXvO+H9P4CRuYxceqKxguZfWKhINewpKxh8nHaxYdkXEuFoZnhFTJqbDRM7
ZhSRaMScMNnVnirsyGoLzObmk43GGIxTkU4xGF9kOx3cY9HqpkxwUxEfh3AdPcoDeqcYc/1F7SUN
B1qQ5GEyORTPvKV98f7Z0YBszypb17KWrL7esRtkztTxt7N9+prrh5ilvHriI9qtKUa0OUpuPNUY
mxvbElO8rDOjiMAL3j8cfaR54wXKWQLv9N5nsEslHcFUrqnPBk9TKkXw9F9PGcNsBRk/J9BwImBv
5/p59XwiNbSk/BVmBz8bq3axPQmsMaIV0oZPK8BVUF+XYDKpAuUqGfWlJXX5ebUQlHjilfHb6CqU
OAvRqmuOzy1ja/rcWQD+hfVjoDDsIO+zpcZs9otTCTM6KD8PyLUCFDYQhKuBwPYljYEAKStiZSxC
GY/nhtuxuKM+puG9FCV1lJenCntWlBZl1YjARmryzLvRBbfsomJ3h5KrZkYK/QY1VXQGnTbmixaH
rNLoMR3kJ+rr822r9i9I6I0Wh9PC1u407sJZ7crRz6pD9IMD6AcV5AtJc2MVzSulpUkn7YJ79CI3
8CDc9wK+y7TD01BK6TN4nzKTmFM6+M+rOugaad7CQsJUIrqIN9OkyW1Pb3PI7oFYAi2GswXvno8J
ZW/yiTM0M9kMcui/6Ryp/REet1ZHqderHNC7MtOCMb9NO37Vp9sHXaB3BrA0k+kxWGzjT9PNFhMP
8yg6i4H+Zdzy2W7yyUt0t9FiUDCoGsx++/jT49kOT8p20AbozEOSfIVmC1+h4W1/SttINYnJNkL/
dcJob+MNPtUA/m0r/2zLnmzQF3pw6ik0L8LHmUfeTQadbHmSr6LH+Ww2h09lt/bQtil2jD8R0jxw
xxFVAuStmtu3UMiLbh8KlYm1AmbmxIIBN3NGtO9T81hkal4DPG3eCaZ43Py2SHPTwBGX5zyDF1fL
iJ1qRzo74Hxrk5YZHQ1thTXthbMnzSPqf2rYtzYVA8TWpFTwgFlL/rr9FKvAJnkXmczPZKRsqCc1
/RbTG4/mRWFKXXp3QUtR7Y5W1nuwEqHzFjQX1e6ctKxaZ7rPm2HXzb65vaa/pcRe2N05M2vR7vbw
ZH2oYrWfsrGfzUH4xoQmZDDp9/TOTSuekVvaku+C8Z0txyDUYBm5PWkTNciqMTUcfbqWUqOQUDtq
LVWbbLIYMjH/XyyXMt9h6pop/dep1MDEhqWksbAjP5DVLlXvhOInR6ZEKgad0vb/pOuLVfufh6dJ
JX6x6/8wPF2kKChokI1ObDb4BjTE1h++lkxvzKO5TprnoHELjZtpXE/jOprPoyF8TQFKAPL2B+Rm
C3jxmgNz1kPFRmqcspjB5gVTFjOexlvbiKuespGuragm7MmgI7YORO5Vqek1myGmWqZcpWe2KvUn
fVkZCpUTajlZVN6o2/H17Vu+urmqdsfjO4DVTwQbNsxtX98SDTZumDtrQ0uE/m7z6Ws6mw6e2A7s
AB5ov3JFbcXyK7s6rhyqrVh2JXRz5/jtyivQDYstHGKxhWgV27zGxm0g75wszY04CG8u6MFwYjwi
rMADDDy6LCIM/zau0G6f+x/jCv8urPBZK+35z2GFW5fltsxIZklTjcbi9gSdurzZXd2FK46wsEI5
Dyu05bTsa27or06jf9j9jcMz7ZkVsfEGGU1Q/wGdCxvbTIZL8xvyPLOvenJX6xWrprnymkvH78Ju
+VUHWEsahLbuSWnrmmQQ6gqbEsy+Jdj8WSiAG7kEmzvn4+0P3mzKU80JyK0kUO5n4wrFvjXMnT3Z
7abpibDajiFfM5LWUcPmzvYuNub/+7kznzpPthPE7aS3zeOEsuF4Pjt3NjAvMOzW5XXMas9hKipb
+fnluW2tM/PZ1kd3ukP3mfnz+AmpKXourzZmk3NoR3Z93iapuvG/i0m0CMhgEs09A9Uj0Fg5WXli
ayWN21KNCsiLDhSNixHW6myscTlTWzNYUJl1K5KGNpedNCQ64jZPpN3Dwgnc3PMBX3QiZm+kMti8
4t/4waIRaVWPqLQGvd6XkeUJlFTWxaa0HG6rs2fU1WZYolkZZrVClRXekMNgMOjdRbOrx4blAH/B
0ByuasmxKXqj0WDlO5u6J86rnkeJ28nzSXNxZ2Pn3M7LO5/s1ExZuOHdiqdhZoFnjsMt5mnYHo4w
4DNG6a+SYbF6w5pYkDWx1OINDgeZiQ4+jR9yYEvwRiSIOYl8uFBnknHcr9H8pFllLnq92vhHxzzH
oGOrQxGLNL9kKzQd3ndEkA9qFMszqcUZbCadsnhWnArWiJiCle1n+b9enFE9X77syjkli1pLvEY1
W3xJNC6syW8pC+Yk5/V2J3Pyevb3ZM2qy/PoFHhHRq0hs6q9OD+Z58lN9vTOT+ZQa+tG1Lcv4M4K
u+B/BiNBZ6wqO16RG85MNCycVjnUXmB2euxmm9fuCNh13oDXFStJz6nMjWTmT1vAvJvoxJ9Vm9Rf
xy7vpSfyiCNWmOqIHKFTIK8LIO+QHKHEQtYIzT5L4fnYrAzLed+sUuZ963hU9Pw5NtiVp6JX586K
0J7YK+X4dIBB5ZkahuA+Oeucqk16eySvyNe2Kplx0OZkW+kuk3Owt1ns2Gl7u3qmLyvdrdcYNOol
GZl2q0GbjeVGlVVEGF6VC+yvihjEuHFgucFo0Fj9rNy3szif8g34BLciyldBTTmsBeWwFpTDFmZz
uJHKYX4CNgl++BRh7hgJp7ogkGsF+C9u+BlhUxh2gszgcxpMwD7E4k1he45JE2iHY6a5EOxj/VPG
+iab1EUTVhnsm4zyiYUc7ESTWxUQ5nNmeHwZDm3XHXzo17lFYMZXPKukYX8rwn2YvzoNk87Unt45
09Zev0KVKf2lsb/NXd6c3der2iVzmH4yMW/fD/0UkN+cxvZujGZsqSbM13KywzQkSIjyKSoKznf0
AOWGDuk4OVNWzAHFJKtxQjW8CgfNsdNcDc3MRcb0TJqVSaOMYtdqVpRGeG6EZkVojo3ujtIoC3IZ
HJ5Z0Qh6LVLvJA0wA9EIujRLsekS8P2kGfeI5rZHTWntJmEA+RIZJjkkMcA9h8QA1o8GEpS5EHzu
w9eTEswq6ia31Exu6VP5XL5qlxhXlf1UpajGz6ktabmhUG4Aq0jPqzVs84cvI4a94uNq5WMVortB
X8ihU+5XG4xm3SePsr3gar3VqCwyOw0KIqzYUWU2jKWZzarfGxAsU+lNTNuVEx9proK2W8kbp7Go
fSY5HUVDHB87AGpoNcPsIhqP0niExsM0HqLxDJqTTnPVNE+hdfW0vo7WF9JpBdQewYIhfsKMhw8Y
IhiPjAjuYMf4wbMZJrFvosvGsm0z2vl5TJmN9rn2LfbL7Wp70umdZS9vz26vu6WAFrBjBcxq2l3e
WWsL9hSoWpHrm21gSn6FaXLgbGPjOehS6BtxMBZjJUzLXNWMsIU7KBpTyNTSnZKjm7J2JwfjKSqf
QjVXqTXj/1QsvtxQOD9gVr6pUj2pWNKwnpeD1PiHGjVmF770TKde+blK9T2VwYlmj906qtdU9FUV
9iSk+bFNTblf57ZdqBTVTQbD2I4LVWRz6wwm1BBmqmNpBgNqyALDi9n8mF+mVHq4rJTkoXd0or6K
yTWnSSkU40DLw0InghHMYtQXUT/a41OgFX6KvZLcNrCuwrO81MBaaz4OE3bNNEJrYrTKRE0RNr1g
tWIylZbktcdMjox2OXtn1sLhpCJ8DdVSpnb2Hz7wWgNfomM7OC681XBhRdTFGzFbBqVKs96VEw7F
PCb1z15TmzyZeLnBQQ3UP/5PPXXlRDJibqP63ItqoyMczMh2qgzjHxZYXWYNZuc6unr8boCiMbus
9BR9xOqyqBWtUTd+jM4FKGqT2za+jFkPeIEHoJ8s0nOaBFHWShSzOkjzgtTPlgLifhq3VllVOQaa
xobkujQaqAHWB2i4PWB0tRs71XNJJ4tiw4thq78oJWtJrPNGFbEKWe3Cji4ar5hc9XXxwKnXrVOV
79WWlqVFHCrtAYNdGX9Wb88KhTLdBg2lyr+0jsxIepZDO37S7tCY3VZaq3YalaUev1WD1zYsY0Wq
V10mDcYJJ0rSD6f2NfxeSILUnyZ2lMTLdhzF+Y6dYhyvMLQYVIZsByYtxwOzbBgrMHnBg7PgO9a+
B87B7qB6WOCJbVxkrbyaXrSNmG+toWxzguo1rd6qH3vVE2Qmg940frndxXY2qtQmBxb3kDe+iz6M
bQraNmwO1qVHM61eb8Cu2hDNxh5yndbqdUSsfl+afewO7MNm3vjVE/9QFmmWIeo0i8ST1qyssMF9
XKMpMbTUsdAgPYbfBITn/Dp7O4lHtcUKweRrSUocKk1tMfnMWq90JWXPVRaVLT7YpYvleEJOvZYa
nOlO74yltWmR5FBT3aJknlGHNQCtu7Z7qOKSu1aVjJ81+PNCkdyAwRDIjYQQiFZ+3XfdYJXmA5uN
dTqKUc2ly2tZWla7vDUeCPm1jgyvP+AKpzmnr7vxk/poImgyBRN4mTNgMgUKURf542/QHeRNvM9m
HDH50on95XNia5NOJ0xOtUs+K92htfoc12ssroDL4TNS9dUmf1ZaIMtnujlcUVQYeF5nxFyHPYXr
UDBi12rtEabPZyb+SW9SvsDnycFjBNvx9p8yhmKY5duw5HKu8Rxze+SmernvBDU7OVtLDdv0JpQ5
HMmFXfHnRsJCBxellUikgJWvIJJZyLBwLDcqMlBgDB9peD2Ski/ieTajxCbiO8Y205x5CrZDa1Bg
l/EoiedY8acEczcXN0wrYrJpZnFRK4Tdg46/rRg130KUTX/MriHF2PvuS6krFffTfU1tcWd4AlGn
WqsaUFtcIQ9WENWaDyzY4KCzuCza/RabAdpyW3C/VnpCVaSajncKrSeIznQeWw3gDaIm+IqbCCzz
1l7kdIwvc+KPfhltWkM/zAmF4/GQ1pGGu1w9/gj9q+YGvKOYmfQozKgqzJ1XeMdTPGHT1aSxGNrm
Aw3V4oUbp2/y1a4ihfczMXDTPy8fWL5EQ60ZAWeay6xU9dSkh2t7yineuPD60u0qzYofjPe/+tr4
4h+ZHSYNNolr1vzkZ69v2/arn7+0Fu/CwcDh/W5K9uGJ3sYTRUn5aeLEVAzPBO+GR0EYnmSGwYnA
5Blm5DEfE0+YKBOPyDwMplb2vlmVs7JClcP6FtqGz+ukb6fXdFcpZrzfk5ZhoZqly5YtU6vs6T4P
XqpQrd2lCmx7/Wc/WYN1OJUGpuCH9JHXXqWP/MBgx5tCWq363PhcPN8Nyhpaq9mFejSMaOwz0QJE
Z+ZTXiXV8HQ0U2fzO50Bq85nxE50f9RjoMo1kzPXFxhT4Jmw1o47qu7id8wj1pOaYHwmu23juakN
/MKNRWxdVSlyvB7VYa3d53QiSOwzutk3uQ10/NqL8krin/5qtpaIN2DELnI95Y9jt2OFkExYtHs1
RfgtI/Z7QxuObzvsx1bPTcnSIrO/sIbs9/f6e0nbyp1vhXPDpQffcyx+b968Tp35cNG2LI0jjH/L
pr+38aruzj8vQ3NsfBkLRViww1pdGbN8/D1Btu/uubMs+zn7T17Ffry3IFyFfOaClbfU1I5vdPFV
i2FHp2jZnAVTPhYWtV60U0EsKWfxJT0tq2oNX6NXp1bwqql2ryPesHhPV15bVbYOmzxao4mm8iy/
0Rqpmb99dqS+qizNoU6Po7Y0qn57SXNeU1mm11i8/dlbdo/euKo136srP/jyg+27F1VhbqhRUWz/
qB26cs4z42NfmWUK1/Rf/vVf3/TQn++ZPfaN+LxyzCtjXkNlo7+spjH+8ScKbfncNXsWl7uyarNz
a7PsjmgJ1joTW3Zv66+2RUqifVYrtnzrxisWzc9rG1i7sWzRvXtmVvTvPHz95Vtztoxe0+FwYd+/
z2F12sxGt9va99DvP1dx7Z33f+na1XVzb3nhTLIlb0bPwu5wxzxHrDZHYW/nLZowKXdr/ooV3tJT
XT1dGV0ZmT3Yr3pqUbamsba8O5O9k4UeSIrPlZ9vPFc+Oe+2pxauJ814dZFGGnLsM4Lqtby/p16X
9ehCOrHUyquEvYunVe6evvXLq/Art9aA2xe0a1S+kp5koUevhuWxlMzdPu9zt1X1b9u1ra+qaOmN
A26c58fLsja1NzSjtsihUyvMzTGVtA/WNy+vD1b3b9+zvb+abp53eFmN5ueYuavxqpP+Z1qX1+/J
DHkxbmXEQlsH6+fW5uVXzduxoHnnomrtD7WIn2HHt/77CpbI7VZ0DVe6XZ8WSksrbsqZNq8mN1Ex
b8fEBPagmJSHNH+lWlJvICT9NF5rPHPcpuoagm1hL3cyHEHQFIYFvTSL7690w1MZILXJjHk9C6e3
/3pxpXZxhW7Jr0P5jtBi/Mtq7snq9V14SRarY2j0eM+AAxwsPpjH8LqxWKWOpTzzapd4S7ZIVe2a
nLkLhpcNUlMjjxJNMR27gQZJ7PiE83w4d6fNpdVbdFfnUy3MmS9k19L88XfzVRpbus/PUnn8DLP+
mrxLbS6X7bo8qnOEfP50mzqfenOo3h7y+zKsGpq7w+YaO5aLDdjKboffphs/Ecrk+BhzSLlzunB8
Cs9gR/V0digSC9EZOAd7o0za8W9N5eHB8RN0NrN0lyAa8E28mcb8pDtPkw549D4ofLCDJnY10jWN
tLmRVjTSrEbaOKpqTrrN6enmfZV0QyXtrKR1lTRRSStx4CmEsSNo6GyihXpi65WncBtSgjejRic+
QgxK1WWumygp0cTx4x4jrv6WUeo5plme2ljAxsnEALZyDgy8xWdM2KtiFwwmFw6wMLEsvMRs0EV7
fXWfiv6mdrYo36zY+PC27gNLp2fbnUVz9zy8OXt2ssCqU6soVttM8aqu8oFrevOUtBldC0vX39If
f8JXtbgpu6O1MS3auKwxuawhg36l9/5L23M7Nh55aNn8x+67Ye00g81psthcVix56q0O6+xDjy61
hfy22tXXD9Ytb8qy+MLOK55YX1jSvZrt7eiBbp/GHm22OXomvfI0qWIhEuxYqcKgeYINmpWMsBxO
WE6FzOGE5fAAMUIwHKHbdjbOsipqpyXyPpyw7ZNTc95k43QJ/lczyYA7l3sPuTy0k+Ls1YHcUZU/
mRayxUIoBUIY/CPkDhlr+Pk1LPzgycCEnF+YymQX1jytasbI9DLrnFMq/czx1M7w1J66MyxqyxwD
vrWnCY+bNLIyNZXgpizJI0ac8GzWfHD3JtbUHEY2PzJWTtcUjgX6W8cmGwtWclNLI3yzeCKV4ONa
IgEQqwbik7Uevq4HkyGbEX9vsVq4Smxw4vOQkKKIPRJsEcVXVcVe4ZZ7TqqUp6dte/iSVfdtrsvt
3Nw6bWkyWrryzjUrbh4oYBvuZm7pzPlZRs38yo1bgrWLpq3emJ/Zuralcfn08NVXHTpMZy84vLgo
v2dv1/Q1Czszw63dS6ta9vSVF3dvbixftqA9EuvoXa5ant9SEljRm9M8rTZccXDsy0WdM6ZHww1N
7QVDGy5BP52FtvQ9/p5MAquxgU8tUmXLRSoEKc8ks1nrKKRTlp/YmqubRfjcrPLc7FV69zMqONIk
IoKbEdQF67hAvgoB5GE+4DvMs0ZECtu6C5MGI3sFJ0kUtvCTNOCKYuNco4rwOBVSeBeMNwgWdQYx
EvyaGTZsGfH6DXs/Rb5+w2bzfNc/m8Sjo7PKkWuDLJwMOyD+Pj3TwkoXfJLJt8zVyveKNw1fse+R
NYmSjcOH9gOHrcHEtK6S3g3TMYKtnlXTOx1zDdWRL/zj2NCiR//5wO3/5Pj40F27e6sD8278xsbP
/+hQXVbzsu1Xw3w9gW57v8aH3wn5XTIrK0SzMmhWOo0FaVYazQpQNnn30Ty+QOhkEQt0N+yxYuou
oYSpluSxqByOALlCOUL7QK5QIA+J5LEXeqwh7APHawEm9mlCoJAbTyDvV8Az7FZT8s+wgB/SUD2u
eAC/puHCKwGNx2M9eVh71Yn3BssaxzAFEjpNnMMOLbENLvEdrlkiQoBCvanZeSrsF8VMWiu2YVVn
C6vqwc8Z4N2B+7V4D3psqc5s0mrxOje1fsR2uuGtCQPNV5udficCrdp39VaDpoVF43X2NLzR7TAo
P/uCUW0J+Rx+u1n7rKLGrkUMRR/fbMBEB9reDm3fgzbdgNVpS14VTYRoXgaL8SWZWvkwlKReti3Z
y82Rl6nJi2b4VHk2/pHalK5rn8aPmpugLCjHxEJ8JrREk6OmNhKpReMreqrcqy2ab8cqY67UkPCw
2PvuMCYwIOdYc+QWgxsMHru7SDksGPqpbd/cseW2Q8dfsLhHY7AZxiqtHptOMdrMHy9aX+tMr5xX
wTd9s3EYP4bgr++/pH7ZTQNF3pnXbDmnKsd+eU0He3tEZw953SGfz0KNS2/duyKR6KrLzMzN1DtD
HixhWD1ZMX/l0n2tDftvfnL7qwYnX01aC5twK/TXRzWnsZB9JpnOWuJiWqqHykrZpLGU662U6a10
VFWZNM6ZH58zx49YMlT8TjKOU+IsxJlEbjypWIPsSrF6xK8MsiuxkZA32SA0f5KH7dDdsX8J/dua
arJA3tqBZ5IuVIO1Ponb1rNg6+ziesqbMjIYihGg3lHv8GIjuilpbJ9f8NdIRNPOXgwyTb4YVHy+
1j75bhBMN4uswt6LpRVMX/ieQ2w6TFn7KV4CXOIq1monozeTS5+TObAgqcwLlejBCHBrw87HLpmx
ra/OptcqVouhcv6WlqZVLZmJ+Zd27Udd6bQmq2Fb0/r2nLSK7sq6odll8I11CmbOrrreLcnF1y0p
jDQsrm/eMq+Qbu+/eU21JyNstSKCkJUeyY5kNvSWVfclM9E9PK6ATZeZ7K/Oba8Kx3JjGlvQy6YU
LtRz0YJdM6ev7641qXSV85jtL4Gf+1O8Y5IPu/Rxso4FxAtpTgHNyqFZcZqdTuNBGuMGKttPs/Eb
I14a99C4m8btWFSlWRqapaaJIHMXziSdwloVev0gXmbEEJ3ldofhKdSdN70Ib9NNfJLMwBl21v3s
rC3Z2TKRnQ0idhaUsLNfx8ghamGrsFX5Rdb92NblpBGH1eqS4pwgVqtRwepE1G43RnuMzAuHZ+es
LWceuIjoJlKrZQm45GzrKNsOjyF7SvRcjgV84/KUDbvy9Sb5IzbMVnnxGktU+anbeat8y3fsXbPd
gtiGUUdf0rhCBaFoach+q8Mz/qBqfAl9hG6Nxsfflyu31K6F2+0KBXwWxYm5OH5GyGL45Lsx1R/G
6pjFWo0edwfe6GogzyUtOdU0p4pvEVG4xeJOWZJWp6wSEL/8g/ZfzV7hyoXqc6HKXNYvcq1zy7aU
XV6mlP37Fzqfxlur7A141sVQZ2yXOBa9wU4xH8/l8qPjFCTNBXV/i2Ti3RZNQTd+9GFK1xnAvJ5t
baL2V1M95uzAy6LzCOUy7aaGVj6BvKi7ZPK4mfwNDGx9w898iCm/ckfboWMbp21cUGXDjy5hQ4TO
mD9z/azmrd1FOd0HFk7vi6f7wxmq6XqbUeN2jmfE2ku2PLyllj6w7stb6hwBv9XsSHM68OsOeJcl
0rK2o2F5Y9iclq2yRSOImbqycse/oFFVDh3BTDA1L8H/zQCbaaH5legDT0LzYfLaabwP907S6IjS
2Q47VAqjAlWJcZH5mzyNtgjEnlm0xZ184Q1NOnWVnV3FkuwqIN9bwA+b2FLfLvQa7CZj+bgYy2vC
3Y6y2Q0fkIE/4w4tlv74oAPkGxY44p7AN0+i8jwaRMcLj6d1m/jLuOyFPfyhlbNaYAF99peCKStx
/IeZpkbKlScVjUE7XqSx+bLSMuMI7tN3x25zuTRGq0H1F6vHpFWfdWYEA9aPnzcjHKlFYFLdkZvl
wriCHS/QZmomAm02Qpsqnn4YI0cJft/sm0lXXhHN19A8vqaWj1+JMdIWlAzvamE4acFwAqWKkSRj
XymtLW0vXV+qJLCNk71OaiBWawTBKeYDwozwFvvmCdZi69m4gUuB7yedbCTYVU+r6tvq19QrWVi5
G1UlktbibOzd+Eskoqv6W/58tGL9MZ14Qxt2ApNCPh1ku8wT/MUsmAIEFS+0Yd6KWZDqoo0H1VPe
1ZKvNU/6jFXKw+6S7v2Pbk10zyjAi24ITZhyp/eUD93QV6CqvH1w4239OWUbHtrefdnSZI7jycym
wcYZS+vTAzWLmzpvVD294PH7b1hXb7I7neE0b5pVg99/6Dz48NJwSf2aG+cvvHt3W17XpiMPth16
cmNJ8dxVlfUrWrKZm40/9jt0lDMtwa/7LWhv6WnqTDQPbVy/Yvv6/w+1L+EdCmVuZHN0cmVhbQpl
bmRvYmoKMjEgMCBvYmoKMTk2NTUKZW5kb2JqCjIyIDAgb2JqCihTQ0lNLVRpY2tldC1QbGFuLnhs
c3gpCmVuZG9iagoyMyAwIG9iagooTWFjIE9TIFggMTAuOC41IFF1YXJ0eiBQREZDb250ZXh0KQpl
bmRvYmoKMjQgMCBvYmoKKFBoaWwgSHVudCkKZW5kb2JqCjI1IDAgb2JqCihFeGNlbCkKZW5kb2Jq
CjI2IDAgb2JqCihEOjIwMTQwMjExMjEyMzEwWjAwJzAwJykKZW5kb2JqCjI3IDAgb2JqCigpCmVu
ZG9iagoyOCAwIG9iagpbIF0KZW5kb2JqCjEgMCBvYmoKPDwgL1RpdGxlIDIyIDAgUiAvQXV0aG9y
IDI0IDAgUiAvUHJvZHVjZXIgMjMgMCBSIC9DcmVhdG9yIDI1IDAgUiAvQ3JlYXRpb25EYXRlCjI2
IDAgUiAvTW9kRGF0ZSAyNiAwIFIgL0tleXdvcmRzIDI3IDAgUiAvQUFQTDpLZXl3b3JkcyAyOCAw
IFIgPj4KZW5kb2JqCnhyZWYKMCAyOQowMDAwMDAwMDAwIDY1NTM1IGYgCjAwMDAwMzY3OTAgMDAw
MDAgbiAKMDAwMDAwNzQ3MSAwMDAwMCBuIAowMDAwMDE1MjE1IDAwMDAwIG4gCjAwMDAwMDAwMjIg
MDAwMDAgbiAKMDAwMDAwNzQ1MSAwMDAwMCBuIAowMDAwMDA3NTc1IDAwMDAwIG4gCjAwMDAwMTA0
MTAgMDAwMDAgbiAKMDAwMDAwMDAwMCAwMDAwMCBuIAowMDAwMDE1MzU1IDAwMDAwIG4gCjAwMDAw
MDc2NzQgMDAwMDAgbiAKMDAwMDAxMDM4OSAwMDAwMCBuIAowMDAwMDE1MDA4IDAwMDAwIG4gCjAw
MDAwMTA0NDYgMDAwMDAgbiAKMDAwMDAxNDk4NyAwMDAwMCBuIAowMDAwMDE1MTE1IDAwMDAwIG4g
CjAwMDAwMTUzMDUgMDAwMDAgbiAKMDAwMDAxNjU2MiAwMDAwMCBuIAowMDAwMDE1Nzk0IDAwMDAw
IG4gCjAwMDAwMTY1NDIgMDAwMDAgbiAKMDAwMDAxNjc5NyAwMDAwMCBuIAowMDAwMDM2NTQzIDAw
MDAwIG4gCjAwMDAwMzY1NjUgMDAwMDAgbiAKMDAwMDAzNjYwNSAwMDAwMCBuIAowMDAwMDM2NjU3
IDAwMDAwIG4gCjAwMDAwMzY2ODUgMDAwMDAgbiAKMDAwMDAzNjcwOSAwMDAwMCBuIAowMDAwMDM2
NzUxIDAwMDAwIG4gCjAwMDAwMzY3NzAgMDAwMDAgbiAKdHJhaWxlcgo8PCAvU2l6ZSAyOSAvUm9v
dCAxNiAwIFIgL0luZm8gMSAwIFIgL0lEIFsgPGFjZTZiNTQ3MzY1ZWI3NGRlNTgxYjE5ZjdlMzAz
ODlhPgo8YWNlNmI1NDczNjVlYjc0ZGU1ODFiMTlmN2UzMDM4OWE+IF0gPj4Kc3RhcnR4cmVmCjM2
OTQ5CiUlRU9GCg==

--Apple-Mail=_9FD4E9DF-4C58-462A-8317-37413A5F3BBA
Content-Transfer-Encoding: 7bit
Content-Type: text/html;
	charset=us-ascii



--Apple-Mail=_9FD4E9DF-4C58-462A-8317-37413A5F3BBA
Content-Disposition: attachment;
	filename=draft-ietf-scim-core-schema-02-03.diff.txt.html
Content-Type: text/html;
	name="draft-ietf-scim-core-schema-02-03.diff.txt.html"
Content-Transfer-Encoding: quoted-printable


=20
=20
=20
=20
=20
=20
=20
=20
  =20
  =20
  Diff: draft-ietf-scim-core-schema-02.txt - =
draft-ietf-scim-core-schema-03.txt=20
  =20
=20
=20
  =20
  =20=

      =

      =

      =

      =

      =

      =

      =

      =

      =

      =

      =

      =

      =

      =

      =

      =

      =

      =

      =

      =

      =

      =

      =

      =

      =

      =

      =

      =

      =

      =
=
=

      =

      =
=
=

      =

      
< draft-ietf-scim-core-schema-02.txt =
  draft-ietf-scim-core-schema-03.txt >
 

      
Network Working Group                                  C. =
Mortimore, Ed. Network Working Group   =
                               C. Mortimore, Ed.

      
Internet-Draft                                            =
    Salesforce Internet-Draft          =
                                      Salesforce

      

      
Intended status: Standards Track                        =
      P. Harding Intended status: Standards Track                        =
      K. Grizzle

      
Expires: March 3, 2014    =
                                     P. Madsen Expires: August 15, 2014  =
                                     SailPoint

      
                                                         =
      P. Harding
                     =
                                           P. Madsen

      
   =
                                                                 =
Ping                                   =
                                  Ping

      
   =
                                                             T. =
Drake                                  =
                               T. Drake

      
   =
                                                            =
UnboundID                              =
                                  UnboundID

      

      
 =
                                                        August 30, 2013                                                        =
February 11, 2014

      
 

      
   =
     System for Cross-Domain Identity Management: Core Schema =
        System for Cross-Domain Identity =
Management: Core Schema

      
 =
                    draft-ietf-scim-core-schema-02             =
         draft-ietf-scim-core-schema-03

      
 

      
Abstract Abstract

      
 

      
   =
The System for Cross-Domain Identity Management (SCIM) =
specification    The System for =
Cross-Domain Identity Management (SCIM) specification

      
   =
is designed to make managing user identity in cloud based =
   is designed to make managing user identity =
in cloud based

      
   =
applications and services easier.  The specification suite =
builds    applications and services =
easier.  The specification suite builds

      
   =
upon experience with existing schemas and deployments, placing =
   upon experience with existing schemas and =
deployments, placing

      
   =
specific emphasis on simplicity of development and integration, =
while    specific emphasis on =
simplicity of development and integration, while

      
   =
applying existing authentication, authorization, and privacy =
models.    applying existing =
authentication, authorization, and privacy models.

      
   =
Its intent is to reduce the cost and complexity of user =
management    Its intent is to reduce =
the cost and complexity of user management

      
 =


      
skipping to change at page 2, line 4 =
skipping to change at =
page 2, line 6

      
 

      
   =
Internet-Drafts are working documents of the Internet =
Engineering    Internet-Drafts are =
working documents of the Internet Engineering

      
   =
Task Force (IETF).  Note that other groups may also distribute =
   Task Force (IETF).  Note that other groups =
may also distribute

      
   =
working documents as Internet-Drafts.  The list of current =
Internet-    working documents as =
Internet-Drafts.  The list of current Internet-

      
   =
Drafts is at http://datatracker.ietf.org/drafts/current/. =
   Drafts is at =
http://datatracker.ietf.org/drafts/current/.

      
 

      
   =
Internet-Drafts are draft documents valid for a maximum of six =
months    Internet-Drafts are draft =
documents valid for a maximum of six months

      
   =
and may be updated, replaced, or obsoleted by other documents at =
any    and may be updated, replaced, =
or obsoleted by other documents at any

      
   =
time.  It is inappropriate to use Internet-Drafts as reference =
   time.  It is inappropriate to use =
Internet-Drafts as reference

      
   =
material or to cite them other than as "work in progress." =
   material or to cite them other than as "work =
in progress."

      

      
 =
  This Internet-Draft will expire on March =
3, 2014.                       =
                                                   

      
    This =
Internet-Draft will expire on August 15, =
2014.

      
 

      
Copyright Notice Copyright Notice

      
 

      

      
 =
  Copyright (c) 2013 IETF Trust and the =
persons identified as the    =
Copyright (c) 2014 IETF Trust and the =
persons identified as the

      
   =
document authors.  All rights reserved. =
   document authors.  All rights reserved.

      
 

      
   =
This document is subject to BCP 78 and the IETF Trust's Legal =
   This document is subject to BCP 78 and the =
IETF Trust's Legal

      
   =
Provisions Relating to IETF Documents  =
  Provisions Relating to IETF Documents

      
   =
(http://trustee.ietf.org/license-info) in effect on the date of =
   (http://trustee.ietf.org/license-info) in =
effect on the date of

      
   =
publication of this document.  Please review these documents =
   publication of this document.  Please review =
these documents

      
   =
carefully, as they describe your rights and restrictions with =
respect    carefully, as they describe =
your rights and restrictions with respect

      
   =
to this document.  Code Components extracted from this document =
must    to this document.  Code =
Components extracted from this document must

      
   =
include Simplified BSD License text as described in Section 4.e =
of    include Simplified BSD License =
text as described in Section 4.e of

      
   =
the Trust Legal Provisions and are provided without warranty as =
   the Trust Legal Provisions and are provided =
without warranty as

      
 =


      
skipping to change at page 2, line 47 =
skipping to change at =
page 2, line 50

      
   =
4.  Schema Extension Model  . . . . . . . . . . . . . . . . . . .   =
8    4.  Schema Extension Model  . . . =
. . . . . . . . . . . . . . . .   8

      
   =
5.  SCIM Core Schema  . . . . . . . . . . . . . . . . . . . . . .   =
8    5.  SCIM Core Schema  . . . . . . =
. . . . . . . . . . . . . . . .   8

      
   =
  5.1.  Common Schema Attributes  . . . . . . . . . . . . . . . .   =
8      5.1.  Common Schema Attributes  =
. . . . . . . . . . . . . . . .   8

      
   =
  5.2.  "schemas" Attribute . . . . . . . . . . . . . . . . . . .   =
9      5.2.  "schemas" Attribute . . . =
. . . . . . . . . . . . . . . .   9

      
   =
6.  SCIM User Schema  . . . . . . . . . . . . . . . . . . . . . .  =
10    6.  SCIM User Schema  . . . . . =
. . . . . . . . . . . . . . . . .  10

      
   =
  6.1.  Singular Attributes . . . . . . . . . . . . . . . . . . .  =
10      6.1.  Singular Attributes . . =
. . . . . . . . . . . . . . . . .  10

      
   =
  6.2.  Multi-valued Attributes . . . . . . . . . . . . . . . . .  =
12      6.2.  Multi-valued Attributes =
. . . . . . . . . . . . . . . . .  12

      
   =
7.  SCIM Enterprise User Schema Extension . . . . . . . . . . . .  =
14    7.  SCIM Enterprise User Schema =
Extension . . . . . . . . . . . .  14

      
   =
8.  SCIM Group Schema . . . . . . . . . . . . . . . . . . . . . .  =
15    8.  SCIM Group Schema . . . . . =
. . . . . . . . . . . . . . . . .  15

      
   =
9.  Service Provider Configuration Schema . . . . . . . . . . . .  =
15    9.  Service Provider =
Configuration Schema . . . . . . . . . . . .  15

      

      
 =
  10. Resource Type Schema  . . . . . . . =
. . . . . . . . . . . . .  17    10. =
ResourceType Schema . . . . . . . . . . . =
. . . . . . . . . .  17
   =
11. Schema Schema . . . . . . . . . . . . . . . . . . . . . . . .  =
18    11. Schema Schema . . . . . . . =
. . . . . . . . . . . . . . . . .  18

      

      
 =
  12. JSON Representation . . . . . . . . . . . . . . . . . . . . .  =
20    =
12. JSON Representation . . . . . . . . . . . . . . . . . . . . .  22

      
 =
    12.1.  Minimal User Representation  . . . . . . . . . . . . . .  =
20      =
12.1.  Minimal User Representation  . . . . . . . . . . . . . .  22

      
 =
    12.2.  Full User Representation . . . . . . . . . . . . . . . .  =
20      =
12.2.  Full User Representation . . . . . . . . . . . . . . . .  23

      
 =
    12.3.  Enterprise User Extension Representation . . . . . . . .  =
23      =
12.3.  Enterprise User Extension Representation . . . . . . . .  26

      
 =
    12.4.  Group Representation . . . . . . . . . . . . . . . . . .  =
26      =
12.4.  Group Representation . . . . . . . . . . . . . . . . . .  29

      
 =
    12.5.  Service Provider Configuration Representation  . . . . .  =
27      =
12.5.  Service Provider Configuration Representation  . . . . .  29

      
 =
    12.6.  Resource Type Representation . . . . . . . . . . . . . .  =
28      =
12.6.  Resource Type Representation . . . . . . . . . . . . . .  30

      
 =
    12.7.  Schema Representation  . . . . . . . . . . . . . . . . .  =
29      =
12.7.  Schema Representation  . . . . . . . . . . . . . . . . .  31

      
 =
  13. Security Considerations . . . . . . . . . . . . . . . . . . .  =
34    =
13. Security Considerations . . . . . . . . . . . . . . . . . . .  53

      
 =
  14. References  . . . . . . . . . . . . . . . . . . . . . . . . .  =
34    =
14. References  . . . . . . . . . . . . . . . . . . . . . . . . .  53

      
 =
    14.1.  Normative References . . . . . . . . . . . . . . . . . .   =
0      =
14.1.  Normative References . . . . . . . . . . . . . . . . . .  53

      
 =
    14.2.  URIs . . . . . . . . . . . . . =
. . . . . . . . . . . . .  34 =
     14.2.  Informative =
References . . . . . . . . . . . . . . . . .  54

      
 =
  Appendix A.  Contributors . . . . . . . =
. . . . . . . . . . . . .  35 =
   Appendix A.  =
Contributors . . . . . . . . . . . . . . . =
. . . . .  54

      
 =
  Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  =
35    =
Appendix B.  Change Log . . . . . . . . . =
. . . . . . . . . . . .  55

      
    Authors' =
Addresses  . . . . . . . . . . . . . . . . . . . . . . .  55

      
 

      
1. =
 Requirements Notation and Conventions 1.  Requirements Notation and Conventions

      
 

      
   =
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL =
NOT",    The key words "MUST", "MUST =
NOT", "REQUIRED", "SHALL", "SHALL NOT",

      
   =
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in =
this    "SHOULD", "SHOULD NOT", =
"RECOMMENDED", "MAY", and "OPTIONAL" in this

      
   =
document are to be interpreted as described in [RFC2119] . =
   document are to be interpreted as described =
in [RFC2119] .

      
 

      
   =
Throughout this document, values are quoted to indicate that they =
are    Throughout this document, =
values are quoted to indicate that they are

      
   =
to be taken literally.  When using these values in protocol =
messages,    to be taken literally.  =
When using these values in protocol messages,

      
   =
the quotes MUST NOT be used as part of the value.    the quotes MUST NOT be used as part of the =
value.

      
 =


      
skipping to change at page 4, line 4 =
skipping to change at =
page 4, line 8

      
   =
model, as well as binding documents to provide patterns for =
   model, as well as binding documents to =
provide patterns for

      
   =
exchanging this schema via a REST API.  It draws inspiration and =
best    exchanging this schema via a =
REST API.  It draws inspiration and best

      
   =
practice, building upon existing user APIs and schemas from a =
wide    practice, building upon =
existing user APIs and schemas from a wide

      
   =
variety of sources including, but not limited to, existing APIs =
   variety of sources including, but not =
limited to, existing APIs

      
   =
exposed by cloud providers, PortableContacts, and LDAP =
directory    exposed by cloud =
providers, PortableContacts, and LDAP directory

      
   =
services.    services.

      
 

      
   =
This document provides a platform neutral schema and extension =
model    This document provides a =
platform neutral schema and extension model

      
   =
for representing users and groups in JSON format.  This schema =
is    for representing users and =
groups in JSON format.  This schema is

      
   =
intended for exchange and use with cloud service providers. =
   intended for exchange and use with cloud =
service providers.

      

      
                                 =
                                         

      
   =
Additional binding documents provide a standard REST API, SAML =
   Additional binding documents provide a =
standard REST API, SAML
   =
binding, and use cases.    binding, =
and use cases.

      
 

      
2.1.=
  Definitions 2.1.  =
Definitions

      
 

      

      
 =
  Service Provider:  A web application that provides identity =
   Service Provider:  An =
HTTP web application that provides identity

      
   =
   information via the SCIM protocol.  =
     information via the SCIM protocol.

      
 

      

      
 =
  Consumer:  A website or application that =
uses the SCIM protocol to    Client:  A website or application that uses the =
SCIM protocol to

      
 =
     manage identity data maintained by the Service=
 Provider.       manage =
identity data maintained by the service provider. =
 The

      
       client initiates SCIM HTTP requests to a target =
service provider.

      
 

      

      
 =
  Resource:  The Service Provider managed =
artifact containing one or    =
Resource:  The service provider managed =
artifact containing one or

      
 =
     more attributes; e.g., User or Group       =
more attributes; e.g., "User" or "Group".

      
 

      

      
 =
  Resource Type:  A type of a Resource =
that is managed by a Service =
   Resource Type:  A type of a resource that is managed by a service

      
      Provider.  The =
Resource Type defines the Resource name, endpoint       provider.  The =
resource type defines the resource name, endpoint

      
 =
     URL, Schemas, and other meta-data which indicate where a Resource      =
 URL, Schemas, and other meta-data which indicate where a resource

      
 =
     is managed and how it is composed; e.g., User or Group.       =
is managed and how it is composed; e.g., "User" or "Group".

      
 

      
   =
Schema:  A collection of Attribute Definitions that describe =
the    Schema:  A collection of =
Attribute Definitions that describe the

      

      
 =
     contents of an entire or partial Resource; e.g.,       contents of an entire or partial resource; e.g.,

      
 =
     urn:scim:schemas:core:User:2.0. =
      "urn:scim:schemas:core:2.0:User".

      
 

      

      
 =
  Singular Attribute:  A Resource =
attribute that contains 0..1 values;  =
  Singular Attribute:  A resource =
attribute that contains 0..1 values;

      
 =
     e.g., displayName.       e.g., "displayName".

      
 

      

      
 =
  Multi-valued Attribute:  A Resource =
attribute that contains 0..n    =
Multi-valued Attribute:  A resource =
attribute that contains 0..n

      
 =
     values; e.g., emails. =
      values; e.g., "emails".

      
 

      

      
 =
  Simple Attribute:  A Singular or Multi-valued Attribute whose value =
   Simple Attribute:  A singular or multi-valued =
attribute whose value

      
 =
     is a primitive; e.g., String. =
      is a primitive; e.g., "String".

      
 

      

      
 =
  Complex Attribute:  A Singular or Multi-valued Attribute whose value =
   Complex Attribute:  A singular or multi-valued =
attribute whose value

      
 =
     is a composition of one or more Simple =
Attributes.       is a =
composition of one or more simple attributes; =
e.g.,

      
       "addresses".

      
 

      

      
 =
  Sub-Attribute:  A Simple Attribute =
contained within a Complex =
   Sub-Attribute:  A simple attribute contained within a complex

      
      Attribute. =
      =
attribute.

      
 

      
3. =
 SCIM Schema Structure 3.  SCIM Schema =
Structure

      
 

      
   =
SCIM schema provides a minimal core schema for representing users =
and    SCIM schema provides a minimal =
core schema for representing users and

      
   =
groups (resources), encompassing common attributes found in =
many    groups (resources), =
encompassing common attributes found in many

      
   =
existing deployments and schemas.    =
existing deployments and schemas.

      
 

      
   =
A resource is a collection of attributes identified by one or =
more    A resource is a collection of =
attributes identified by one or more

      
   =
schemas.  Minimally, an attribute consists of the attribute name =
and    schemas.  Minimally, an =
attribute consists of the attribute name and

      

      
 =
  at least one Simple or Complex value either of =
which may be Multi-    at =
least one simple or complex value either of which =
may be multi-

      
   =
valued.  SCIM schema defines the data type, plurality and other =
   valued.  SCIM schema defines the data type, =
plurality and other

      
   =
distinguishing features of an attribute.  Unless otherwise =
specified    distinguishing features =
of an attribute.  Unless otherwise specified

      

      
 =
  all attributes are modifiable by Consumers.  =
Immutable (read-only)    all =
attributes are modifiable by consumers.  =
Attribute definitions

      
   attributes SHALL be specified =
as 'READ-ONLY' within the attribute    contain a property =
"mutability" that determines whether an attribute

      
 =
  definition.  Additionally, Service Providers MAY choose to make some    is: "readOnly", "writeOnly", =
"immutable", or "readWrite".

      
   or all Resource attributes =
immutable and SHOULD identify those    Additionally, service =
providers MAY define other properties such =
as

      
   attributes via the =
associated Resource's schema endpoint    returnability =
Resource's schema endpoint (Section 5.2).

      
 =
  (Section 5.2). 

      
 

      

      
 =
  A JSON [1] (JavaScript Object Notation) =
format is defined.  Attribute    A =
JSON (JavaScript Object Notation) format [RFC4627] is defined.

      
 =
  names SHOULD be camelCased.  SCIM resources represented in JSON =
MUST    Attribute names SHOULD be =
camelCased.  SCIM resources represented in

      
 =
  specify schema via the schemas attribute =
(Section 5.2).    JSON MUST =
specify schema via the "schemas" attributeSection =
5.2.

      
 

      
3.1.=
  Attribute Data Types 3.1.  Attribute =
Data Types

      
 

      

      
 =
  Attribute data types are derived from JSON [2] and unless otherwise    Attribute data types are derived from JSON [RFC4627] and unless

      
 =
  specified are optional, modifiable by Consumers, and of type String    otherwise specified are optional, modifiable by =
clients, and of type

      
 =
  (Section 3.1.1).  The JSON format defines a limited set of =
data    String (Section 3.1.1).  The =
JSON format defines a limited set of

      
 =
  types, hence, where appropriate, alternate JSON =
representations    data types, hence, =
where appropriate, alternate JSON representations

      
 =
  derived from XML schema [3] are defined =
below.  SCIM extensions    derived =
from XML Schema [XML-Schema] are defined =
below.  SCIM

      
 =
  SHOULD not introduce new data types. =
   extensions SHOULD not introduce new data types.

      
 

      
3.1.1.  String 3.1.1.  =
String

      
 

      
   =
A sequence of zero or more Unicode characters.  The JSON format =
is    A sequence of zero or more =
Unicode characters.  The JSON format is

      

      
 =
  defined in section 2.5 [4] of RFC 4627.  A String attribute MAY    defined in Section 2.5 =
[RFC4627] . A "String" attribute MAY specify a

      
 =
  specify a required data format.  Additionally, when Canonical Values    required data format.  Additionally, when canonical values are

      
 =
  are specified Service Providers SHOULD =
conform to those values if    =
specified service providers SHOULD conform =
to those values if

      
 =
  appropriate, but MAY provide alternate String values to represent    appropriate, but MAY provide alternate "String" values to represent

      
   =
additional values.    additional =
values.

      
 

      
3.1.2.  Boolean 3.1.2.  =
Boolean

      
 

      

      
 =
  The literal "true" or "false".  The JSON format is defined in section    =
The literal "true" or "false".  The JSON format is defined in

      
 =
  2.1 [5] of RFC 4627.    Section 2.1 [RFC4627] .

      
 

      
3.1.3.  Decimal 3.1.3.  =
Decimal

      
 

      
   =
A real number with at least one digit to the left and right of =
the    A real number with at least one =
digit to the left and right of the

      

      
 =
  period.  The JSON format is defined in section =
2.4 [6] of RFC 4627.    =
period.  The JSON format is defined in Section =
2.4 [RFC4627] .

      
 

      
3.1.4.  Integer 3.1.4.  =
Integer

      
 

      

      
 =
  A Decimal number with no fractional =
digits.  The JSON format is    A =
decimal number with no fractional digits.  =
The JSON format is

      
 =
  defined in section 2.4 [7] of RFC 4627 with the additional =
constraint    defined in Section 2.4 [RFC4627] with the additional constraint =
that

      
 =
  that the value MUST NOT contain fractionial or exponent =
parts.    the value MUST NOT contain =
fractionial or exponent parts.

      
 

      
3.1.5.  DateTime 3.1.5. =
 DateTime

      
 

      
   =
A DateTime value (e.g. 2008-01-23T04:56:22Z).  The attribute =
value    A DateTime value (e.g. =
2008-01-23T04:56:22Z).  The attribute value

      

      
 =
  MUST be encoded as a valid xsd:dateTime as specified in section 3.2.7  =
  MUST be encoded as a valid xsd:dateTime as specified in Section 3.2.7

      
 =
  [8] of the XML Schema Datatypes =
Specification.    [XML-Schema] .

      
 

      
   =
Values represented in JSON MUST conform to the XML constraints =
above    Values represented in JSON =
MUST conform to the XML constraints above

      

      
 =
  and are represented as a JSON String [9].    and =
are represented as a JSON String per Section 2.5 =
[RFC4627].

      
 

      
3.1.6.  Binary 3.1.6.  =
Binary

      
 

      
   =
Arbitrary binary data.  The attribute value MUST be encoded as =
a    Arbitrary binary data.  The =
attribute value MUST be encoded as a

      

      
 =
  valid xsd:base64Binary as specified in section 3.2.16 [10] of =
the XML    valid =
xsd:base64Binary as specified in Section =
3.2.16 [XML-Schema] .

      
   Schema Datatypes =
Specification. 

      
 

      
   =
Values represented in JSON MUST conform to the XML constraints =
above    Values represented in JSON =
MUST conform to the XML constraints above

      

      
 =
  and are represented as a JSON String [11].    and =
are represented as a JSON String perSection 2.5 =
[RFC4627].

      
 

      
3.1.7.  Reference 3.1.7. =
 Reference

      
 

      

      
 =
  A reference to a SCIM Resource.  The =
value MUST be the absolute or    A =
reference to a SCIM resource.  The value =
MUST be the absolute or
 =
  relative URI of the target Resource.  =
Relative URIs should be    relative =
URI of the target resource.  Relative URIs =
should be

      
 =
  resolved as specified in section 5.2 =
[12] of RFC 3986.  The base URI =
   resolved as specified in Section 5.2 [RFC3986].  The base URI for

      
 =
  for relative URI resolution MUST include all URI components and =
path    relative URI resolution MUST =
include all URI components and path

      
   =
segments up to but not including the Endpoint URI; e.g., the base =
URI    segments up to but not =
including the Endpoint URI; e.g., the base URI

      

      
 =
  for a request to https://example.com/v1/Users/2819c223-7f76-453a-    for a request to https://example.com/v2/Users/2819c223-7f76-453a-

      
 =
  919d-413861904646 would be https://example.com/v1/ and the =
relative    919d-413861904646 would =
be https://example.com/v2/ and the =
relative

      
 =
  URI for this Resource would be =
Users/2819c223-7f76-453a-    URI for =
this resource would be =
Users/2819c223-7f76-453a-

      
   =
919d-413861904646.    =
919d-413861904646.

      
 

      
   =
Performing a GET operation on a reference URI MUST return the =
target    Performing a GET operation =
on a reference URI MUST return the target

      

      
 =
  Resource or an appropriate HTTP response code.  =
The Service Provider    resource or an appropriate HTTP response code.  The =
service provider
   =
MAY optionally choose to enforce referential integrity for =
   MAY optionally choose to enforce referential =
integrity for

      
   =
references.    references.

      
 

      
   =
By convention, a reference is commonly represented as a "$ref" =
sub-    By convention, a reference is =
commonly represented as a "$ref" sub-

      
   =
attribute in complex or multi-valued attributes, however this =
is    attribute in complex or =
multi-valued attributes, however this is

      
   =
OPTIONAL.    OPTIONAL.

      
 

      
3.1.8.  Complex 3.1.8.  =
Complex

      
 

      

      
 =
  A Singular or Multi-valued Attribute whose value is a =
composition of    A singular or multi-valued =
attribute whose value is a composition of

      
 =
  one or more Simple Attributes.  The JSON =
format is defined in section =
   one or more simple Attributes.  The JSON format is defined =
in

      
 =
  2.2 [13] of RFC 4627.    Section 2.2 [RFC4627] .

      
 

      
3.2.=
  Multi-valued Attributes 3.2.  =
Multi-valued Attributes
 

      
   =
Multi-valued attributes are unordered lists of attributes.  =
Each    Multi-valued attributes are =
unordered lists of attributes.  Each

      
   =
attribute MAY contain Sub-Attributes and therefore multi-valued =
   attribute MAY contain Sub-Attributes and =
therefore multi-valued

      

      
 =
  attributes may contain Complex Attributes.  The =
below Sub-Attributes    =
attributes may contain complex attributes.  The =
sub-attributes below

      
   =
are considered normative and when specified SHOULD be used as =
   are considered normative and when specified =
SHOULD be used as

      
   =
defined.    defined.

      
 

      
   =
type  A label indicating the attribute's function; e.g., "work" =
or    type  A label indicating the =
attribute's function; e.g., "work" or

      
   =
   "home".       "home".

      
 

      

      
 =
  primary  A Boolean value indicating the =
'primary' or preferred    primary  A =
boolean value indicating the 'primary' or =
preferred

      
   =
   attribute value for this attribute, e.g. the preferred =
mailing       attribute value for this =
attribute, e.g. the preferred mailing

      
   =
   address or primary e-mail address.  The primary attribute =
value       address or primary e-mail =
address.  The primary attribute value

      

      
 =
     'true' MUST appear no more than =
once.       "true" MUST appear no more than once.

      
 

      

      
 =
  display  A human readable name, primarily used for display purposes.    =
display  A human readable name, primarily used for display purposes

      
      READ-ONLY. =
      and has a =
mutability of "immutable".

      
 

      
   =
operation  The operation to perform on the multi-valued =
attribute    operation  The operation =
to perform on the multi-valued attribute

      
   =
   during a PATCH request.  The only valid value is "delete", =
which       during a PATCH request.  =
The only valid value is "delete", which

      

      
 =
     signifies that this instance should be removed from the Resource.     =
  signifies that this instance should be removed from the resource.

      
 

      
   =
value  The attribute's significant value; e.g., the e-mail =
address,    value  The attribute's =
significant value; e.g., the e-mail address,

      
   =
   phone number, etc.  Attributes that define a "value" =
sub-attribute       phone number, etc. =
 Attributes that define a "value" sub-attribute

      
   =
   MAY be alternately represented as a collection of primitive =
types.       MAY be alternately =
represented as a collection of primitive types.

      
   =
   For example:       For =
example:

      
 

      
   =
  {      {

      
   =
    "emails": [        "emails": =
[

      
   =
      {"value":"bjensen@example.com"},  =
        {"value":"bjensen@example.com"},

      
   =
      {"value":"babs@example.com"}     =
     {"value":"babs@example.com"}

      
   =
    ]        ]

      
   =
  }      }

      
 

      
   =
   May also be represented as:       =
May also be represented as:

      
 

      
   =
  {      {

      
   =
    "emails": ["bjensen@example.com","babs@example.com"] =
       "emails": =
["bjensen@example.com","babs@example.com"]

      
   =
  }      }

      
 

      

      
 =
  $ref  The Reference of the target =
Resource, if the attribute is a =
   $ref  The reference URI of the target =
resource, if the attribute is a

      
   =
   reference.       reference.

      
 

      

      
 =
  When returning multi-valued attributes, Service =
Providers SHOULD    When =
returning multi-valued attributes, service =
providers SHOULD
   =
canonicalize the value returned, if appropriate (e.g. for =
e-mail    canonicalize the value =
returned, if appropriate (e.g. for e-mail

      

      
 =
  addresses and URLs).  Providers MAY =
return the same value more than    =
addresses and URLs).  Service providers =
MAY return the same value

      
 =
  once with different types (e.g. the same e-mail address may used =
for    more than once with different =
types (e.g. the same e-mail address may

      
 =
  work and home), but SHOULD NOT return the same (type, value) =
   used for work and home), but SHOULD NOT =
return the same (type, value)

      
   =
combination more than once per Attribute, as this complicates =
   combination more than once per Attribute, as =
this complicates

      
   =
processing by the Consumer.    =
processing by the Consumer.

      
 

      
4. =
 Schema Extension Model 4.  Schema =
Extension Model

      
 

      
   =
SCIM schema follows an object extension model similar to =
   SCIM schema follows an object extension =
model similar to

      
   =
ObjectClasses used in LDAP.  Unlike LDAP there is no =
inheritance    ObjectClasses used in =
LDAP.  Unlike LDAP there is no inheritance

      
   =
model; all extensions are additive (similar to LDAP Auxiliary =
Object    model; all extensions are =
additive (similar to LDAP Auxiliary Object

      

      
 =
  Classes [14]).  Each value indicates =
additive schema that may exist    =
Class [RFC4512]).  Each value indicates =
additive schema that may

      
 =
  in a SCIM representation as specified by extensions not defined =
in    exist in a SCIM representation =
as specified by extensions not defined

      
 =
  this suite.  Schema extensions MUST NOT redefine any =
attributes    in this suite.  Schema =
extensions MUST NOT redefine any attributes

      
   =
defined in this specification and SHOULD follow conventions =
defined    defined in this =
specification and SHOULD follow conventions defined

      
   =
in this specification.  Each schema extension must identify a =
URI    in this specification.  Each =
schema extension must identify a URI

      
   =
used to identify the extension.  The JSON format MUST use the =
   used to identify the extension.  The JSON =
format MUST use the

      

      
 =
  "schemas" attribute (Section 5.2) to =
distinguish extended resources    =
"schemas" attributeSection 5.2 to =
distinguish extended resources and

      
 =
  and attributes.    =
attributes.

      
 

      
5. =
 SCIM Core Schema 5.  SCIM Core =
Schema

      
 

      
5.1.=
  Common Schema Attributes 5.1.  =
Common Schema Attributes

      
 

      

      
 =
  Each SCIM Resource (Users, Groups, etc.) =
includes the below common    Each =
SCIM resource (Users, Groups, etc.) =
includes the below common

      
 =
  attributes.  These attributes MUST be included in all Resources,    =
attributes.  These attributes MUST be included in all resources,

      
 =
  including any extended Resource types.  =
It is not necessary to    including =
any extended resource types.  It is not =
necessary to

      
 =
  specify the schemas attribute if the Resource is fully defined in    specify the schemas attribute if the resource is fully defined in

      
   =
this document as the core schema is implicitly included. =
   this document as the core schema is =
implicitly included.

      
 

      

      
 =
  id Unique identifier for the SCIM Resource=
 as defined by the Service =
   id Unique identifier for the SCIM resource as defined by the service

      
      Provider.  Each =
representation of the Resource MUST =
include a non-  =
     provider.  Each representation of the resource MUST include a non-

      
 =
     empty id value.  This identifier MUST =
be unique across the Service =
      empty "id" =
value.  This identifier MUST be unique across the

      
      Provider's entire =
set of Resources.  It MUST be a stable, =
non-    =
   service provider's entire set of resources.  It MUST be a stable,

      
      reassignable =
identifier that does not change when the same       non-reassignable =
identifier that does not change when the same

      
 =
     Resource is returned in subsequent =
requests.  The value of the id =
      resource =
is returned in subsequent requests.  The value of the

      
 =
     attribute is always issued by the Service =
Provider and MUST never       =
"id" attribute is always issued by the =
service provider and MUST

      
 =
     be specified by the Service Consumer. =
 bulkId: is a reserved       never be =
specified by the client.  bulkId: is a =
reserved keyword

      
 =
     keyword and MUST NOT be used in the unique identifier.  =
REQUIRED       and MUST NOT be used =
in the unique identifier.  REQUIRED and has =
a

      
 =
     and READ-ONLY.       mutability of =
"readOnly".

      
 

      

      
 =
  externalId  An identifier for the Resource=
 as defined by the Service =
   externalId  An identifier for the resource as defined by the client.

      
      Consumer.  The =
externalId may simplify identification of =
the       The "externalId" may simplify identification of the =
resource

      
 =
     Resource between Service Consumer and Service provider by allowing       between client and =
service provider by allowing the client to

      
 =
     the Consumer to refer to the Resource with its own identifier, =
      refer to the resource with its own identifier, obviating the =
need

      
 =
     obviating the need to store a local mapping between the =
local       to store a local mapping =
between the local identifier of the

      
 =
     identifier of the Resource and the =
identifier used by the Service =
      resource =
and the identifier used by the service =
provider.  Each

      
      Provider.  Each =
Resource MAY include a non-empty =
externalId value.       resource MAY include a non-empty externalId =
value.  The value of

      
 =
     The value of the externalId attribute =
is always issued be the       the "externalId" =
attribute is always issued by the client and can

      
 =
     Service Consumer and can never be =
specified by the Service       never be specified by the service provider.  The service provider

      
      Provider.  The =
Service Provider MUST always interpret =
the       MUST always interpret the =
externalId as scoped to the client's

      
 =
     externalId as scoped to the Service =
Consumer's tenant.       =
tenant.

      
 

      
   =
meta  A complex attribute containing resource metadata.  All =
sub-    meta  A complex attribute =
containing resource metadata.  All sub-

      
   =
   attributes are OPTIONAL       =
attributes are OPTIONAL
 

      

      
 =
     resourceType  The name of the Resource =
Type of the Resource. =
      resourceType  The name of the resource type of the resource.

      
         =
READ-ONLY.          Attribute has mutability of =
"readOnly".

      
 

      

      
 =
     created  The DateTime the Resource =
was added to the Service       created  The DateTime the resource was added to the service

      
         Provider.  The =
attribute MUST be a DateTime.  READ-ONLY.          provider.  The =
attribute MUST be a DateTime.  Attribute =
has

      
          mutability of "readOnly".

      
 

      
   =
   lastModified  The most recent DateTime the details of this =
      lastModified  The most recent DateTime =
the details of this

      

      
 =
        Resource were updated at the Service Provider.  If this          resource were =
updated at the service provider.  If =
this

      
 =
        Resource has never been modified =
since its initial creation,          =
resource has never been modified since its =
initial creation,

      
   =
      the value MUST be the same as the value of created.  The =
         the value MUST be the same as the =
value of created.  The

      

      
 =
        attribute MUST be a DateTime.  READ-ONLY.    =
      attribute MUST be a DateTime.  Attribute =
has mutability of

      
          "readOnly".

      
 

      

      
 =
     location  The URI of the Resource =
being returned.  This value MUST      =
 location  The URI of the resource being =
returned.  This value MUST

      
 =
        be the same as the Location HTTP response header.  READ-ONLY.    =
      be the same as the Location HTTP response header.  Attribute

      
          has mutability of "readOnly".

      
 

      

      
 =
     version  The version of the Resource =
being returned.  This value       =
version  The version of the resource being =
returned.  This value

      
 =
        must be the same as the ETag HTTP response header.  READ-ONLY.    =
      must be the same as the ETag HTTP response header.  Attribute

      
          has mutability of "readOnly".

      
 

      
   =
   attributes  The names of the attributes to remove from the =
      attributes  The names of the attributes =
to remove from the

      

      
 =
        Resource during a PATCH =
operation.          resource during a PATCH operation.

      
 

      
5.2.=
  "schemas" Attribute 5.2.  "schemas" =
Attribute

      
 

      
   =
SCIM supports resources of different types, with extensible =
schemas.    SCIM supports resources of =
different types, with extensible schemas.

      
   =
Each resource MUST be indicated using fully qualified URLs. =
   Each resource MUST be indicated using fully =
qualified URLs.

      
 

      

      
 =
  When a representation does not explicitly =
provide support for    A "schemas" attribute is used to indicate the =
version of SCIM schema

      
   indicating a schema, such as =
JSON, a schemas attribute is used to    as well as any schema extensions.

      
 =
  indicate the version of SCIM schema as well as any schema =
extensions. 

      
 

      

      
 =
  schemas  The schemas attribute is an array of Strings which allows    schemas  The schemas attribute is an array of strings which allows

      
   =
   introspection of the supported schema version for a SCIM =
      introspection of the supported schema =
version for a SCIM

      
   =
   representation as well any schema extensions supported by =
that       representation as well any =
schema extensions supported by that

      
   =
   representation.  Each String value must be a unique URI.  =
This       representation.  Each =
String value must be a unique URI.  This

      
   =
   specification defines URIs for User, Group, and a standard =
      specification defines URIs for User, =
Group, and a standard

      

      
 =
     "enterprise" extension.  All =
representations of SCIM schema MUST   =
    enterprise-user extension.  All =
representations of SCIM schema

      
 =
     include a non-zero value array with value(s) of the URIs =
supported       MUST include a =
non-zero value array with value(s) of the URIs

      
 =
     by that representation.  The schemas attribute for a Resource MUST  =
     supported by that representation.  The schemas attribute for =
a

      
 =
     only contain values defined as "schema" and "schemaExtensions" =
for       resource MUST only contain values defined as =
"schema" and

      
 =
     the Resource's Resource Type.  =
Duplicate values MUST NOT be       =
"schemaExtensions" for the resource's resource =
type.  Duplicate
 =
     included.  Value order is not specified and MUST not =
impact       values MUST NOT be =
included.  Value order is not specified and

      
 =
     behavior.  REQUIRED.       MUST =
not impact behavior.  REQUIRED.

      
 

      
6. =
 SCIM User Schema 6.  SCIM User =
Schema

      
 

      
   =
SCIM provides a schema for representing Users, identified using =
the    SCIM provides a schema for =
representing Users, identified using the

      

      
 =
  following URI: 'urn:scim:schemas:core:2.0:User'.  The =
following    following URI: "urn:scim:schemas:core:2.0:User".  The =
following

      
   =
attributes are defined in addition to those attributes defined =
in    attributes are defined in =
addition to those attributes defined in

      
   =
SCIM Core Schema:    SCIM Core =
Schema:

      
 

      
6.1.=
  Singular Attributes 6.1.  Singular =
Attributes

      
 

      

      
 =
  userName  Unique identifier for the User, =
typically used by the user    =
userName  Unique identifier for the user, =
typically used by the user

      
   =
   to directly authenticate to the service provider.  Often =
displayed       to directly =
authenticate to the service provider.  Often displayed

      
   =
   to the user as their unique identifier within the system (as =
      to the user as their unique identifier =
within the system (as

      
   =
   opposed to id or externalId, which are generally opaque and =
not       opposed to id or externalId, =
which are generally opaque and not

      
   =
   user-friendly identifiers).  Each User MUST include a =
non-empty       user-friendly =
identifiers).  Each User MUST include a non-empty

      

      
 =
     userName value.  This identifier MUST be unique across the Service       =
userName value.  This identifier MUST be unique across the

      
      Consumer's entire =
set of Users.  REQUIRED.       client's entire set =
of Users.  RECOMMENDED.

      
 

      

      
 =
  name  The components of the User's real =
name.  Providers MAY return =
   name  The components of the user's real name.  Service =
providers MAY

      
 =
     just the full name as a single string in the formatted =
sub-       return just the full name =
as a single string in the formatted sub-

      
   =
   attribute, or they MAY return just the individual component =
      attribute, or they MAY return just the =
individual component

      
   =
   attributes using the other sub-attributes, or they MAY =
return       attributes using the =
other sub-attributes, or they MAY return

      
   =
   both.  If both variants are returned, they SHOULD be =
describing       both.  If both =
variants are returned, they SHOULD be describing

      
   =
   the same name, with the formatted name indicating how the =
      the same name, with the formatted name =
indicating how the

      
   =
   component attributes should be combined.       component attributes should be combined.

      
 

      
   =
   formatted  The full name, including all middle names, titles, =
and       formatted  The full name, =
including all middle names, titles, and

      

      
 =
        suffixes as appropriate, formatted for display (e.g. Ms.          =
suffixes as appropriate, formatted for display (e.g. "Ms.

      
 =
        Barbara Jane Jensen, III.).=
          Barbara Jane Jensen, III.").

      
 

      

      
 =
     familyName  The family name of the User, or "Last Name" in most       familyName  The family name of the User, or last name in most

      
 =
        Western languages (e.g. Jensen =
given the full name Ms. Barbara =
         Western languages (e.g. "Jensen" given the full name "Ms.

      
 =
        Jane Jensen, III.). =
         Barbara Jane Jensen, III.").

      
 

      

      
 =
     givenName  The given name of the User, or "First Name" in most       givenName  The given name of the User, or first name in most

      
 =
        Western languages (e.g. Barbara =
given the full name Ms. Barbara =
         Western languages (e.g. "Barbara" given the full name "Ms.

      
 =
        Jane Jensen, III.). =
         Barbara Jane Jensen, III.").

      
 

      

      
 =
     middleName  The middle name(s) of the User (e.g.  Jane given the =
      middleName  The middle name(s) of the User (e.g.  "Jane" given the

      
 =
        full name Ms. Barbara Jane Jensen, =
III.).  =
        full name "Ms. Barbara Jane =
Jensen, III.").

      
 

      

      
 =
     honorificPrefix  The honorific prefix(es) of the User, or "Title"       =
honorificPrefix  The honorific prefix(es) of the User, or title in

      
 =
        in most Western languages (e.g. Ms. =
given the full name Ms.          most Western languages (e.g. "Ms." given the full name "Ms.

      
 =
        Barbara Jane Jensen, III.).=
          Barbara Jane Jensen, III.").

      
 

      

      
 =
     honorificSuffix  The honorific suffix(es) of the User, or "Suffix"      =
 honorificSuffix  The honorific suffix(es) of the User, or suffix

      
 =
        in most Western languages (e.g. III.=
 given the full name Ms.          in most Western languages (e.g. "III." given the full name "Ms.

      
 =
        Barbara Jane Jensen, III.).=
          Barbara Jane Jensen, III.").

      
 

      

      
 =
  displayName  The name of the User, =
suitable for display to end-users.    =
displayName  The name of the user, =
suitable for display to end-users.

      
 =
     Each User returned MAY include a =
non-empty displayName value.  The     =
  Each user returned MAY include a =
non-empty displayName value.  The

      
   =
   name SHOULD be the full name of the User being described if =
known       name SHOULD be the full =
name of the User being described if known

      

      
 =
     (e.g. Babs Jensen or Ms. Barbara J Jensen, =
III), but MAY be a       (e.g. =
"Babs Jensen" or "Ms. Barbara J Jensen, =
III"), but MAY be a

      
   =
   username or handle, if that is all that is available (e.g. =
      username or handle, if that is all that =
is available (e.g.

      

      
 =
     bjensen).  The value provided SHOULD =
be the primary textual label       =
"bjensen").  The value provided SHOULD be =
the primary textual

      
 =
     by which this User is normally displayed by the Service Provider       label by which this User is normally displayed by =
the service

      
 =
     when presenting it to end-users.       provider when =
presenting it to end-users.

      
 

      
   =
nickName  The casual way to address the user in real life, e.g. =
"Bob"    nickName  The casual way to =
address the user in real life, e.g. "Bob"

      
   =
   or "Bobby" instead of "Robert".  This attribute SHOULD NOT be =
used       or "Bobby" instead of =
"Robert".  This attribute SHOULD NOT be used

      
   =
   to represent a User's username (e.g. bjensen or =
mpepperidge).       to represent a =
User's username (e.g. bjensen or mpepperidge).

      
 

      

      
 =
  profileUrl  A fully qualified URL to a page representing the User's    =
profileUrl  A fully qualified URL to a page representing the user's

      
   =
   online profile.       online =
profile.

      
 

      

      
 =
  title  The user's title, such as "Vice President."    title  =
The user's title, such as "Vice President".

      
 

      
   =
userType  Used to identify the organization to user =
relationship.    userType  Used to =
identify the organization to user relationship.

      
   =
   Typical values used might be "Contractor", "Employee", =
"Intern",       Typical values used =
might be "Contractor", "Employee", "Intern",

      
   =
   "Temp", "External", and "Unknown" but any value may be used. =
      "Temp", "External", and "Unknown" but any =
value may be used.

      
 

      

      
 =
  preferredLanguage  Indicates the User's =
preferred written or spoken    =
preferredLanguage  Indicates the user's =
preferred written or spoken

      
   =
   language.  Generally used for selecting a localized User =
      language.  Generally used for selecting a =
localized User

      
   =
   interface.  Valid values are concatenation of the ISO 639-1 =
two       interface.  Valid values are =
concatenation of the ISO 639-1 two

      

      
 =
     letter language code [15], an =
underscore, and the ISO 3166-1 2      =
 letter language code per [ISO639-2], an =
underscore, and the ISO
 =
     letter country code [16]; e.g., =
'en_US' specifies the language       =
3166-1 2 letter country code[ISO3166]; =
e.g., 'en_US' specifies the

      
 =
     English and country US.       =
language English and country US.

      
 

      
   =
locale  Used to indicate the User's default location for purposes =
of    locale  Used to indicate the =
User's default location for purposes of

      
   =
   localizing items such as currency, date time format, =
numerical       localizing items such =
as currency, date time format, numerical

      
   =
   representations, etc.  A locale value is a concatenation of =
the       representations, etc.  A =
locale value is a concatenation of the

      

      
 =
     ISO 639-1 two letter language code =
[17], an underscore, and the   =
    ISO 639-1 two letter language code[ISO639-2], an underscore, and

      
 =
     ISO 3166-1 2 letter country code =
[18]; e.g., 'en_US' specifies the       the ISO 3166-1 2 letter country code[ISO3166]; e.g., 'en_US'

      
 =
     language English and country US.  =
     specifies the language English and country US.

      
 

      
   =
timezone  The User's time zone in the "Olson" timezone database =
   timezone  The User's time zone in the =
"Olson" timezone database

      

      
 =
     format [19]; =
e.g.,'America/Los_Angeles'.       =
format[Olson-TZ]; =
e.g.,'America/Los_Angeles'.

      
 

      

      
 =
  active  A Boolean value indicating the User's administrative status.    active  A Boolean value indicating the user's administrative status.

      
   =
   The definitive meaning of this attribute is determined by =
the       The definitive meaning of =
this attribute is determined by the

      

      
 =
     Service Provider though a value of =
true infers the User is, for =
      service provider. =
 As a typical example, a value of true infers

      
      example, able to =
login while a value of false implies the User's       =
the user is able to login while a value of =
false implies the

      
 =
     account has been suspended.      =
 user's account has been =
suspended.

      
 

      

      
 =
  password  The User's clear text =
password.  This attribute is intended  =
  password  The user's clear text =
password.  This attribute is intended

      
   =
   to be used as a means to specify an initial password when =
creating       to be used as a means =
to specify an initial password when creating

      

      
 =
     a new User or to reset an existing User's password.  No accepted   =
    a new User or to reset an existing User's password.  Password

      
      standards exist to =
convey password policies, hence =
Consumers       policies and the ability to update or set passwords are out of

      
      should expect Service =
Providers to reject password values.  This       scope of this document.  =
The mutability of this attribute is

      
 =
     value MUST never be returned by a =
Service Provider in any form. =
      "writeOnly" =
indicating the value MUST NOT be =
returned by a service

      
       provider in any form.

      
 

      
6.2.=
  Multi-valued Attributes 6.2.  =
Multi-valued Attributes
 

      
   =
The following multi-valued attributes are defined.    The following multi-valued attributes are =
defined.

      
 

      
   =
emails  E-mail addresses for the User.  The value SHOULD be =
   emails  E-mail addresses for the User.  The =
value SHOULD be

      

      
 =
     canonicalized by the Service =
Provider, e.g.  bjensen@example.com       canonicalized by the service=
 provider, e.g. "bjensen@example.com"

      
 =
     instead of bjensen@EXAMPLE.COM.  =
Canonical Type values of work,       =
instead of "bjensen@EXAMPLE.COM".  =
Canonical type values of

      
      home, and other.       =
"work", "home", and "other".

      
 

      

      
 =
  phoneNumbers  Phone numbers for the User. =
 The value SHOULD be    phoneNumbers  =
Phone numbers for the user.  The value =
SHOULD be

      
 =
     canonicalized by the Service Provider =
according to format in       =
canonicalized by the service provider =
according to format in

      
 =
     RFC3966 [20] e.g. =
'tel:+1-201-555-0123'.  Canonical Type =
values of       [RFC3966] e.g. 'tel:+1-201-555-0123'.  Canonical =
type values of

      
 =
     work, home, mobile, fax, pager and =
other.  =
     "work", "home", "mobile", "fax", =
"pager", and "other".

      
 

      

      
 =
  ims  Instant messaging address for the User.  No official    ims  Instant messaging address for the user.  No official

      
   =
   canonicalization rules exist for all instant messaging =
addresses,       canonicalization =
rules exist for all instant messaging addresses,

      

      
 =
     but Service Providers SHOULD, when =
appropriate, remove all       but =
service providers SHOULD, when =
appropriate, remove all
   =
   whitespace and convert the address to lowercase.  Instead of =
the       whitespace and convert the =
address to lowercase.  Instead of the

      

      
 =
     standard Canonical Values for type, =
this attribute defines the       =
standard canonical values for type, this =
attribute defines the

      
 =
     following Canonical Values to =
represent currently popular IM       =
following canonical values to represent =
currently popular IM

      
 =
     services: aim, gtalk, icq, xmpp, msn, skype, =
qq, and yahoo.       services: "aim", "gtalk", =
"icq", "xmpp", "msn", "skype", "qq",

      
       "yahoo", and "other".

      
 

      
   =
photos  URL of a photo of the User.  The value SHOULD be a =
   photos  URL of a photo of the User.  The =
value SHOULD be a

      
   =
   canonicalized URL, and MUST point to an image file (e.g. a =
GIF,       canonicalized URL, and MUST =
point to an image file (e.g. a GIF,

      
   =
   JPEG, or PNG image file) rather than to a web page containing =
an       JPEG, or PNG image file) =
rather than to a web page containing an

      

      
 =
     image.  Service Providers MAY return =
the same image at different       =
image.  Service providers MAY return the =
same image at different
   =
   sizes, though it is recognized that no standard for =
describing       sizes, though it is =
recognized that no standard for describing

      
   =
   images of various sizes currently exists.  Note that this =
      images of various sizes currently exists. =
 Note that this

      
   =
   attribute SHOULD NOT be used to send down arbitrary photos =
taken       attribute SHOULD NOT be =
used to send down arbitrary photos taken

      

      
 =
     by this User, but specifically =
profile photos of the User =
suitable       by this user, but specifically profile photos of the =
user suitable

      
 =
     for display when describing the User. =
 Instead of the standard       for =
display when describing the user.  Instead =
of the standard

      
 =
     Canonical Values for type, this =
attribute defines the following       =
canonical values for type, this attribute =
defines the following

      
 =
     Canonical Values to represent popular =
photo sizes: photo,       canonical values to =
represent popular photo sizes: "photo",

      
      thumbnail. =
      =
"thumbnail".

      
 

      

      
 =
  addresses  A physical mailing address for this User.  Canonical Type    =
addresses  A physical mailing address for this user.  Canonical type

      
      Values of work, home, and other.  The value attribute is a =
complex       =
values of "work", "home", and "other".  The value attribute is a

      
 =
     type with the following sub-attributes.  All Sub-Attributes are       complex type with the following sub-attributes.  =
All sub-

      
 =
     OPTIONAL.  =
     attributes are OPTIONAL.

      
 

      
   =
   formatted  The full mailing address, formatted for display or =
use       formatted  The full mailing =
address, formatted for display or use

      
   =
      with a mailing label.  This attribute MAY contain =
newlines.          with a mailing =
label.  This attribute MAY contain newlines.

      
 

      
   =
   streetAddress  The full street address component, which may =
      streetAddress  The full street address =
component, which may

      
   =
      include house number, street name, P.O. box, and =
multi-line          include house =
number, street name, P.O. box, and multi-line

      
   =
      extended street address information.  This attribute MAY =
         extended street address information.  =
This attribute MAY

      
   =
      contain newlines.          =
contain newlines.

      
 

      
   =
   locality  The city or locality component.       locality  The city or locality component.

      
 

      
   =
   region  The state or region component.       region  The state or region component.

      
 

      
   =
   postalCode  The zipcode or postal code component.       postalCode  The zipcode or postal code =
component.

      
 

      
   =
   country  The country name component.  When specified the =
value       country  The country name =
component.  When specified the value

      

      
 =
        MUST be in ISO 3166-1 alpha 2 "short" code format [21]; e.g.,          MUST be in ISO 3166-1 alpha 2 "short" code =
format[ISO3166];

      
 =
        the United States and Sweden are "US" and "SE", =
respectively.          e.g., the =
United States and Sweden are "US" and "SE",

      
          =
respectively.

      
 

      
   =
groups  A list of groups that the user belongs to, either =
thorough    groups  A list of groups =
that the user belongs to, either thorough

      
   =
   direct membership, nested groups, or dynamically calculated.  =
The       direct membership, nested =
groups, or dynamically calculated.  The

      
   =
   values are meant to enable expression of common group or =
role       values are meant to enable =
expression of common group or role

      
   =
   based access control models, although no explicit =
authorization       based access =
control models, although no explicit authorization

      
   =
   model is defined.  It is intended that the semantics of =
group       model is defined.  It is =
intended that the semantics of group

      
   =
   membership and any behavior or authorization granted as a =
result       membership and any =
behavior or authorization granted as a result

      

      
 =
     of membership are defined by the Service =
Provider.  The Canonical       =
of membership are defined by the service =
provider.  The canonical

      
   =
   types "direct" and "indirect" are defined to describe how =
the       types "direct" and =
"indirect" are defined to describe how the

      
   =
   group membership was derived.  Direct group membership =
indicates       group membership was =
derived.  Direct group membership indicates

      

      
 =
     the User is directly associated with =
the group and SHOULD indicate       =
the user is directly associated with the =
group and SHOULD indicate

      
 =
     that Consumers may modify membership =
through the Group Resource. =
      that clients=
 may modify membership through the "Group" =
resource.

      
 =
     Indirect membership indicates User =
membership is transitive or       =
Indirect membership indicates user =
membership is transitive or

      
 =
     dynamic and implies that Consumers =
cannot modify indirect group       =
dynamic and implies that clients cannot =
modify indirect group

      
 =
     membership through the Group resource =
but MAY modify direct group       =
membership through the "Group" resource =
but MAY modify direct

      
 =
     membership through the Group resource =
which MAY influence indirect       =
group membership through the "Group" =
resource which MAY influence

      
 =
     memberships.  If the SCIM Service =
Provider exposes a Group       =
indirect memberships.  If the SCIM service =
provider exposes a

      
 =
     resource, the "value" sub-attribute MUST be the "id" and =
the       Group resource, the "value" =
sub-attribute MUST be the "id" and the

      
 =
     "$ref" sub-attribute must be the URI of the corresponding Group       =
"$ref" sub-attribute must be the URI of the corresponding "Group"

      
 =
     resources to which the user belongs.  Since this attribute is       =
resources to which the user belongs.  Since this attribute has a

      
      read-only, group =
membership changes MUST be applied via the Group       mutability of =
"readOnly", group membership changes MUST be applied

      
 =
     Resource (Section 8).  READ-ONLY.    =
   via the Group Resource (Section 8).  The =
attribute has a

      
       mutability of "readOnly".

      
 

      

      
 =
  entitlements  A list of entitlements for the User that represent a    entitlements  A list of entitlements for the user that represent a

      
 =
     thing the User has.  That is, an entitlement is an additional       thing the user has. =
 An entitlement MAY =
be an additional right to

      
 =
     right to a thing, object or service.  =
No vocabulary or syntax is       a =
thing, object, or service.  No vocabulary =
or syntax is specified

      
 =
     specified and Service =
Providers/Consumers are expected to encode       and service providers and =
clients are expected to encode

      
   =
   sufficient information in the value so as to accurately and =
      sufficient information in the value so as =
to accurately and

      

      
 =
     without ambiguity determine what the User has access to.  This       without ambiguity determine what the user has access to.  This

      
   =
   value has NO canonical types though type may be useful as a =
means       value has NO canonical =
types though type may be useful as a means

      
   =
   to scope entitlements.       to =
scope entitlements.

      
 

      

      
 =
  roles  A list of roles for the User that =
collectively represent who    roles  =
A list of roles for the user that =
collectively represent who

      
 =
     the User is; e.g., 'Student', "Faculty".  No vocabulary or =
syntax       the user is; e.g., "Student, =
Faculty".  No vocabulary or syntax is

      
 =
     is specified though it is expected that a role value is a =
String       specified though it is =
expected that a role value is a String or

      
 =
     or label representing a collection of entitlements.  This =
value       label representing a =
collection of entitlements.  This value has

      
 =
     has NO canonical types.       NO =
canonical types.

      
 

      
   =
x509Certificates  A list of certificates issued to the User.  =
Values    x509Certificates  A list of =
certificates issued to the User.  Values

      
   =
   are Binary (Section 3.1.6) and DER encoded x509.  This value =
has       are Binary (Section 3.1.6) =
and DER encoded x509.  This value has

      
   =
   NO canonical types.       NO =
canonical types.

      
 

      
7. =
 SCIM Enterprise User Schema Extension 7.  SCIM Enterprise User Schema Extension

      
 

      
   =
The following SCIM extension defines attributes commonly used =
in    The following SCIM extension =
defines attributes commonly used in

      
   =
representing users that belong to, or act on behalf of a business =
or    representing users that belong =
to, or act on behalf of a business or

      
   =
enterprise.  The enterprise user extension is identified using =
the    enterprise.  The enterprise =
user extension is identified using the

      

      
 =
  following URI: 'urn:scim:schemas:extension:enterprise:2.0:User'.<=
/td>    following schema URI:

      
    "urn:scim:schemas:extension:enterprise:2.0:User".<=
/td>

      
 

      
   =
The following Singular Attributes are defined:    The following Singular Attributes are =
defined:

      
 

      
   =
employeeNumber  Numeric or alphanumeric identifier assigned to =
a    employeeNumber  Numeric or =
alphanumeric identifier assigned to a

      
   =
   person, typically based on order of hire or association with =
an       person, typically based on =
order of hire or association with an

      
   =
   organization.       =
organization.

      
 

      
   =
costCenter  Identifies the name of a cost center.    costCenter  Identifies the name of a cost =
center.

      
 

      
   =
organization  Identifies the name of an organization.    organization  Identifies the name of an =
organization.

      
 

      
   =
division  Identifies the name of a division.    division  Identifies the name of a division.

      
 

      
   =
department  Identifies the name of a department.    department  Identifies the name of a =
department.

      
 

      

      
 =
  manager  The User's manager.  A complex =
type that optionally allows    =
manager  The user's manager.  A complex =
type that optionally allows

      
 =
     Service Providers to represent =
organizational hierarchy by       =
service providers to represent =
organizational hierarchy by

      
   =
   referencing the "id" attribute of another User.       referencing the "id" attribute of another =
User.

      
 

      

      
 =
     managerId  The id of the SCIM resource representing the User's       =
value  The "id" of the SCIM resource representing the user's

      
 =
        manager.  REQUIRED. =
         manager.  RECOMMENDED.

      
 

      
   =
   $ref  The URI of the SCIM resource representing the User's =
      $ref  The URI of the SCIM resource =
representing the User's

      
 =
        manager.  REQUIRED. =
         manager.  RECOMMENDED.

      
 

      

      
 =
     displayName  The displayName of the User's manager.  OPTIONAL and       displayName  The displayName of the user's manager.  This

      
 =
        READ-ONLY.          attribute is =
OPTIONAL and mutability is =
"readOnly".

      
 

      
8. =
 SCIM Group Schema 8.  SCIM Group =
Schema

      
 

      
   =
SCIM provides a schema for representing groups, identified using =
the    SCIM provides a schema for =
representing groups, identified using the

      

      
 =
  following URI: =
'urn:scim:schemas:core:2.0:Group'.    following schema URI: =
"urn:scim:schemas:core:2.0:Group".

      
 

      

      
 =
  Group resources are meant to enable expression of common Group or    =
Group resources are meant to enable expression of common group or

      
   =
role based access control models, although no explicit =
authorization    role based access =
control models, although no explicit authorization

      
   =
model is defined.  It is intended that the semantics of group =
   model is defined.  It is intended that the =
semantics of group

      
   =
membership and any behavior or authorization granted as a result =
of    membership and any behavior or =
authorization granted as a result of

      

      
 =
  membership are defined by the Service =
Provider are considered out of  =
  membership are defined by the service =
provider are considered out of

      
   =
scope for this specification.    scope =
for this specification.
 

      

      
 =
  The following Singular Attribute is =
defined in addition to the common    =
The following singular attribute is =
defined in addition to the common

      
 =
  attributes defined in SCIM Core =
Schema:    attributes defined =
in SCIM core schema:

      
 

      
   =
displayName  A human readable name for the Group.  REQUIRED. =
   displayName  A human readable name for the =
Group.  REQUIRED.

      
 

      
   =
The following multi-valued attribute is defined in addition to =
the    The following multi-valued =
attribute is defined in addition to the

      
   =
common attributes defined in SCIM Core Schema:    common attributes defined in SCIM Core =
Schema:

      
 

      

      
 =
  members  A list of members of the Group.  Canonical Types "User" and    members  A list of members of the Group.  While values MAY be added

      
      "Group" are READ-ONLY.  The "value" sub-attribute must be =
the "id"       =
or removed, sub-attributes of members are "immutable".  The

      
 =
     and the "$ref" sub-attribute must be =
the URI of a SCIM resource,       =
"value" sub-attribute must be the "id" and the "$ref" sub-

      
 =
     either a User, or a Group.  The intention of the Group type is to       attribute must be =
the URI of a SCIM resource, either a "User",=
 or

      
 =
     allow the Service Provider to support =
nested Groups.  Service       a "Group".  The =
intention of the "Group" type is to allow =
the

      
 =
     Providers MAY require Consumers to provide a non-empty =
members       service provider to support nested groups.  Service providers MAY

      
 =
     value based on the "required" sub attribute of the =
"members"       require clients to provide a non-empty members value =
based on the

      
 =
     attribute in Group Resource =
Schema.       "required" sub =
attribute of the "members" attribute in the =
"Group"

      
       resource schema.

      
 

      
9. =
 Service Provider Configuration Schema 9.  Service Provider Configuration Schema

      
 

      

      
 =
  SCIM provides a schema for representing the Service Provider's    SCIM provides a schema for representing the service provider's

      
 =
  configuration identified using the following URI:    configuration identified using the following schema URI:

      
 =
  'urn:scim:schemas:core:2.0:ServiceProviderConfig'<=
/td>    "urn:scim:schemas:core:2.0:ServiceProviderConfig"<=
/td>

      
 

      

      
 =
  The Service Provider Configuration =
Resource enables a Service =
   The service provider =
configuration resource enables a service

      
   Provider to expose its compliance with the SCIM =
specification in a    provider to discovery =
of SCIM specification features in =
a

      
   =
standardized form as well as provide additional implementation =
   standardized form as well as provide =
additional implementation

      

      
 =
  details to Consumers.  All attributes =
are READ-ONLY.  Unlike other =
   details to clients.  All attributes are READ-ONLY (a mutability of

      
 =
  core Resources, the "id" attribute is =
not required for the Service =
   "readOnly").  =
Unlike other core resources, the "id" =
attribute is not

      
   Provider Configuration =
Resource.    required for the =
service provider configuration =
resource.

      
 

      
   =
The following Singular Attributes are defined in addition to =
the    The following Singular =
Attributes are defined in addition to the

      
   =
common attributes defined in Core Schema:    common attributes defined in Core Schema:

      
 

      

      
 =
  documentationUrl  An HTTP addressable URL pointing to the Service    =
documentationUrl  An HTTP addressable URL pointing to the service

      
      Provider's human =
consumable help documentation.       provider's human consumable help =
documentation.

      
 

      
   =
patch  A complex type that specifies PATCH configuration =
options.    patch  A complex type that =
specifies PATCH configuration options.

      
   =
   REQUIRED.       REQUIRED.

      
 

      
   =
   supported  Boolean value specifying whether the operation is =
      supported  Boolean value specifying =
whether the operation is

      
   =
      supported.  REQUIRED.          =
supported.  REQUIRED.

      
 

      
   =
bulk  A complex type that specifies BULK configuration options. =
   bulk  A complex type that specifies BULK =
configuration options.

      
   =
   REQUIRED       REQUIRED

      
 

      
 =


      
skipping to change at page 16, line =
29 skipping to =
change at page 16, line 29

      
 

      
   =
   maxPayloadSize  An integer value specifying the maximum =
payload       maxPayloadSize  An =
integer value specifying the maximum payload

      
   =
      size in bytes.  REQUIRED.        =
  size in bytes.  REQUIRED.

      
 

      
   =
filter  A complex type that specifies FILTER options.  =
REQUIRED.    filter  A complex type =
that specifies FILTER options.  REQUIRED.

      
 

      
   =
   supported  Boolean value specifying whether the operation is =
      supported  Boolean value specifying =
whether the operation is

      
   =
      supported.  REQUIRED.          =
supported.  REQUIRED.

      
 

      
   =
   maxResults  Integer value specifying the maximum number of =
      maxResults  Integer value specifying the =
maximum number of

      

      
 =
        Resources returned in a response.  =
REQUIRED.          resources returned in a response.  =
REQUIRED.

      
 

      
   =
changePassword  A complex type that specifies Change Password =
   changePassword  A complex type that =
specifies Change Password

      
   =
   configuration options.  REQUIRED.   =
    configuration options.  REQUIRED.

      
 

      
   =
   supported  Boolean value specifying whether the operation is =
      supported  Boolean value specifying =
whether the operation is

      
   =
      supported.  REQUIRED.          =
supported.  REQUIRED.

      
 

      
   =
sort  A complex type that specifies Sort configuration options. =
   sort  A complex type that specifies Sort =
configuration options.

      
   =
   REQUIRED.       REQUIRED.

      
 

      
   =
   supported  Boolean value specifying whether sorting is =
supported.       supported  Boolean =
value specifying whether sorting is supported.

      
   =
      REQUIRED.          =
REQUIRED.

      
 

      
   =
etag  A complex type that specifies Etag configuration options. =
   etag  A complex type that specifies Etag =
configuration options.

      
   =
   REQUIRED.       REQUIRED.

      
 

      
   =
   supported  Boolean value specifying whether the operation is =
      supported  Boolean value specifying =
whether the operation is

      
   =
      supported.  REQUIRED.          =
supported.  REQUIRED.

      
 

      
   =
The following multi-valued attribute is defined in addition to =
the    The following multi-valued =
attribute is defined in addition to the

      

      
 =
  common attributes defined in Core =
Schema:    common attributes =
defined in core schema:

      
 

      
   =
authenticationSchemes  A complex type that specifies supported =
   authenticationSchemes  A complex type that =
specifies supported

      

      
 =
     Authentication Scheme properties.  Instead =
of the standard       =
Authentication Scheme properties.  This =
attribute defines the

      
      Canonical Values for type, =
this attribute defines the following       following canonical =
values to represent common schemes: "oauth",

      
 =
     Canonical Values to represent common =
schemes: oauth, oauth2,       "oauth2", =
"oauthbearertoken", "httpbasic", and "httpdigest".  To

      
      oauthbearertoken, =
httpbasic, and httpdigest.  To =
enable seamless       enable seamless =
discovery of configuration, the service =
provider

      
 =
     discovery of configuration, the Service =
Provider SHOULD, with the      =
 SHOULD, with the appropriate security considerations, make the

      
 =
     appropriate security considerations, make the 

      
   =
   authenticationSchemes attribute publicly accessible without =
prior       authenticationSchemes =
attribute publicly accessible without prior

      
   =
   authentication.  REQUIRED.       =
authentication.  REQUIRED.

      
 

      
   =
   name  The common authentication scheme name; e.g., HTTP =
Basic.       name  The common =
authentication scheme name; e.g., HTTP Basic.

      
   =
      REQUIRED.          =
REQUIRED.

      
 

      
   =
   description  A description of the Authentication Scheme. =
      description  A description of the =
Authentication Scheme.

      
   =
      REQUIRED.          =
REQUIRED.

      
 

      
   =
   specUrl  A HTTP addressable URL pointing to the =
Authentication       specUrl  A HTTP =
addressable URL pointing to the Authentication

      
   =
      Scheme's specification.  OPTIONAL.          Scheme's specification.  OPTIONAL.

      
 

      
   =
   documentationUrl  A HTTP addressable URL pointing to the =
      documentationUrl  A HTTP addressable URL =
pointing to the

      
   =
      Authentication Scheme's usage documentation.  OPTIONAL. =
         Authentication Scheme's usage =
documentation.  OPTIONAL.

      
 

      
10. =
 Resource Type Schema 10.  Resource =
Type Schema

      
 

      

      
 =
  The Resource Type schema specifies the =
meta-data about a Resource    The =
"ResourceType" schema specifies the =
meta-data about a resource

      
 =
  Type.  Resource Type Resources are =
READ-ONLY and identified using the    type.  Resource type resources are READ-ONLY and identified =
using the

      
 =
  following URI: 'urn:scim:schemas:core:2.0:ResourceType'.  =
Unlike    following schema URI: "urn:scim:schemas:core:2.0:ResourceType".

      
 =
  other core Resources, all Attributes are REQUIRED unless =
otherwise    Unlike other core resources, all attributes are REQUIRED unless

      
 =
  specified, and the "id" attribute is not =
required for the Resource =
   otherwise specified. =
 The "id" attribute is not required for the

      
   Type =
Resource.    resource type resource.

      
 

      
   =
The following Singular Attributes are defined:    The following Singular Attributes are =
defined:

      
 

      

      
 =
  name  The Resource Type name.  When =
applicable Service Providers MUST =
   id The resource =
type's server unique id.  Often this is the same

      
       value as the "name" attribute.  =
OPTIONAL

      
                     =
                                                     

      
    name  The resource type name.  When applicable service providers MUST

      
   =
   specify the name specified in the core schema specification; =
e.g.,       specify the name specified =
in the core schema specification; e.g.,

      
   =
   "User" or "Group".  This name is referenced by the       "User" or "Group".  This name is referenced by =
the

      

      
 =
     meta.resourceType attribute in all =
resources.       "meta.resourceType" attribute in all =
resources.

      
 

      

      
 =
  description  The Resource Type's human =
readable description.  When    =
description  The resource type's human =
readable description.  When

      
 =
     applicable Service Providers MUST =
specify the description       =
applicable service providers MUST specify =
the description

      
   =
   specified in the core schema specification.       specified in the core schema =
specification.

      
 

      

      
 =
  endpoint  The Resource Type's HTTP =
addressable endpoint relative to    =
endpoint  The resource type's HTTP =
addressable endpoint relative to

      
 =
     the Base URL; e.g., /Users. =
      the Base URL; e.g., "/Users".

      
 

      

      
 =
  schema  The Resource Type's primary =
schema URI; e.g.,    schema  The =
resource type's primary schema URI; =
e.g.,

      
 =
     urn:scim:schemas:core:2.0:User.  This =
MUST be equal to the "id"       "urn:scim:schemas:core:2.0:User".  This MUST be =
equal to the "id"

      
 =
     attribute of the Schema. =
      attribute of the associated "Schema" resource.

      
 

      

      
 =
  schemaExtensions  A list of URIs of the Resource =
Type's schema    =
schemaExtensions  A list of URIs of the resource =
type's schema

      
   =
   extensions.  OPTIONAL.       =
extensions.  OPTIONAL.

      
 

      

      
 =
     schema  The URI of an extended schema; e.g., urn:edu:2.0:Staff.       schema  The URI of an extended schema; e.g., =
"urn:edu:2.0:Staff".

      
 =
        This MUST be equal to the "id" attribute of a Schema.       =
   This MUST be equal to the "id" attribute of a "Schema"

      
 =
        REQUIRED.          resource.  REQUIRED.

      
 

      
   =
   required  A Boolean value that specifies whether the schema =
      required  A Boolean value that specifies =
whether the schema

      

      
 =
        extension is required for the Resource =
Type.  If true, a          =
extension is required for the resource =
type.  If true, a

      
 =
        Resource of this type MUST include =
this schema extension and          =
resource of this type MUST include this =
schema extension and

      
   =
      include any attributes declared as required in this =
schema          include any attributes =
declared as required in this schema

      

      
 =
        extension.  If false, a Resource =
of this type MAY omit this          =
extension.  If false, a resource of this =
type MAY omit this

      
   =
      schema extension.  REQUIRED.     =
     schema extension.  REQUIRED.

      
 

      
11. =
 Schema Schema 11.  Schema =
Schema

      
 

      

      
 =
  The Schema schema specifies the Attribute(s) and meta-data that =
   The "Schema" =
schema specifies the attribute(s) and =
meta-data that

      
 =
  constitute a Schema.  Schema Resources are READ-ONLY and identified =
   constitute a "Schema" =
resource.  Schema resources have =
mutability of

      
 =
  using the following URI: 'urn:scim:schemas:core:2.0:Schema'.  =
Unlike    =
"readOnly" and identified using the following URI:

      
 =
  other core Resources the Schema Resource MAY contain a complex =
object    "urn:scim:schemas:core:2.0:Schema".  Unlike =
other core resources the

      
 =
  within a Sub-Attribute and all Attributes are REQUIRED unless other    =
"Schema" resource MAY contain a complex =
object within a sub-attribute

      
 =
  specified.    and all attributes are REQUIRED unless otherwise specified.

      
 

      
   =
The following Singular Attributes are defined:    The following Singular Attributes are =
defined:

      
 

      

      
 =
  id The unique URI of the schema.  When applicable Service Providers    id The unique URI of the schema.  When applicable =
service providers

      
   =
   MUST specify the URI specified in the core schema =
specification;       MUST specify the =
URI specified in the core schema specification;

      

      
 =
     e.g., "urn:scim:core:2.0:User".  =
Unlike most other schemas, which      =
 e.g., "urn:scim:schemas:core:2.0:User".  =
Unlike most other

      
 =
     use some sort of a GUID for the "id", the Schema "id" is a URI so       schemas, which use some sort of a GUID for the =
"id", the schema

      
 =
     that it can be registered and is portable between =
different       "id" is a URI so that =
it can be registered and is portable between

      
 =
     Service Providers and Clients.      =
 different service providers and clients.

      
 

      

      
 =
  name  The Schema's human readable name.  =
When applicable Service    name  The schema's =
human readable name.  When applicable service

      
      Providers MUST =
specify the name specified in the core schema       providers MUST =
specify the name specified in the core schema

      
   =
   specification; e.g., "User" or "Group".  OPTIONAL.       specification; e.g., "User" or "Group".  =
OPTIONAL.

      
 

      

      
 =
  description  The Schema's human readable =
description.  When    description  =
The schema's human readable description.  =
When

      
 =
     applicable Service Providers MUST =
specify the description       =
applicable service providers MUST specify =
the description

      
   =
   specified in the core schema specification.  OPTIONAL. =
      specified in the core schema =
specification.  OPTIONAL.

      
 

      
   =
The following multi-valued attribute is defined:    The following multi-valued attribute is =
defined:

      
 

      

      
 =
  attributes  A complex type that specifies the set of Resource    =
attributes  A complex type that specifies the set of resource

      
   =
   attributes.       =
attributes.

      
 

      
   =
   name  The attribute's name.       =
name  The attribute's name.

      
 

      

      
 =
     type  The attribute's data type; e.g., String.       =
type  The attribute's data type; e.g., "String".

      
 

      
   =
   multiValued  Boolean value indicating the attribute's =
plurality.       multiValued  Boolean =
value indicating the attribute's plurality.

      
 

      
   =
   description  The attribute's human readable description.  =
When       description  The =
attribute's human readable description.  When

      

      
 =
        applicable Service Providers MUST =
specify the description          =
applicable service providers MUST specify =
the description

      
   =
      specified in the core schema specification.          specified in the core schema =
specification.

      
 

      

      
 =
     readOnly  A Boolean value that specifies if =
the attribute is 

      
         =
mutable. 

      
 =
                                                                        =
 

      
   =
   required  A Boolean value that specifies if the attribute is =
      required  A Boolean value that specifies =
if the attribute is

      
   =
      required.          =
required.

      
 

      
   =
   caseExact  A Boolean value that specifies if the String =
attribute       caseExact  A Boolean =
value that specifies if the String attribute

      
   =
      is case sensitive.          is =
case sensitive.

      
 

      

      
 =
     referenceTypes  The names of the Resource =
Types that may be       mutability  A single keyword indicating what types =
of

      
 =
        referenced; e.g., User.  This is =
only applicable for attributes          modifications an attribute MAY accept as =
follows:

      
 =
        that are of the "reference" data type. 

      
          readOnly  The attribute MAY NOT be =
modified.

      
 

      
          readWrite  The attribute MAY be updated and =
read at any time.

      
             DEFAULT.

      
 

      
          immutable  The attribute MAY be defined at =
resource creation

      
             (e.g. POST) or at record replacement via =
request (e.g. a

      
             PUT).  The attribute MAY NOT be =
updated.

      
 

      
          writeOnly  The attribute MAY be updated at any =
time.  Attribute
             values MAY NOT be returned (e.g. because =
the value is a

      
             stored hash).  Note: an attribute with =
mutability of

      
             "writeOnly" usually also has a returned =
setting of "never".

      
 

      
       returned  A single keyword that indicates when an =
attribute and

      
          associated values are returned in response to =
a GET request or
          in response to a PUT, POST, or PATCH request.  =
Valid keywords

      
          are:

      
 

      
          always  The attribute is always returned =
regardless of the

      
             contents of the "attributes" parameter.  =
For example, "id"

      
             is always returned to identify a SCIM =
resource.

      
 

      
          never  The attribute is never returned.  This =
may occur because

      
             the original attribute value is not =
retained by the service

      
             provider (e.g. such as with a hashed =
value).  A service

      
             provider MAY allow attributes to be used in =
a search filter.
 

      
          default  The attribute is returned by default =
in all SCIM

      
             operation responses where attribute values =
are returned.  If

      
             the GET request "attributes" parameter is =
specified,

      
             attribute values are only returned if the =
attribute is named

      
             in the attributes parameter.  =
DEFAULT.

      
 

      
          request  The attribute is returned in response =
to any PUT,

      
             POST, or PATCH operations if the attribute =
was specified by
             the client (for example, the attribute was =
modified).  The

      
             attribute is returned in a SCIM query =
operation only if

      
             specified in the "attributes" =
parameter.

      
 

      
       uniqueness  A single keyword value that specifies =
how the service

      
          provider enforces uniqueness of attribute =
values.  A server MAY

      
          reject an invalid value based on uniqueness by =
returning HTTP

      
          Response code 400 (Bad Request).  A client MAY =
enforce

      
          uniqueness on the client-side to a greater =
degree than the

      
          service provider enforces.  For example, a =
client could make a

      
          value unique while the server has uniqueness =
of "none".  Valid

      
          keywords are:

      
 

      
          none  The values are not intended to be unique =
in any way.

      
             DEFAULT.

      
 

      
          server  The value SHOULD be unique within the =
context of the

      
             current SCIM endpoint (or tenancy) but MAY =
not be globally

      
             unique (e.g. a "username", email address, =
or other server

      
             generated key or counter).  No two =
resources on the same

      
             server SHOULD possess the same =
value.

      
 

      
          global  The value SHOULD be globally unique =
(e.g. an email

      
             address, a GUID, or other value).  No two =
resources on any
             server SHOULD possess the same =
value.

      
                     =
                                                     

      
       =
referenceTypes  The names of the resource =
types that may be

      
          =
referenced; e.g., "User".  This is only =
applicable for

      
          attributes =
that are of the "reference" Section 3.1.7 =
data type.

      
 

      
   =
      The following multi-valued attributes are defined.  There =
are          The following =
multi-valued attributes are defined.  There are

      
   =
      no canonical type values defined and the primary value =
serves          no canonical type =
values defined and the primary value serves

      
   =
      no useful purpose.          no =
useful purpose.

      
 

      

      
 =
        subAttributes  A list specifying the =
contained attributes. 

      
            =
OPTIONAL. 

      
 =
                                                                        =
 

      
   =
         name  The attribute's name.   =
          name  The attribute's name.

      
 

      
   =
         type  The attribute's data type; e.g., String. =
            type  The attribute's data type; =
e.g., String.

      
 

      

      
 =
           description  The attribute's human readable =
description.          description  =
The attribute's human readable description.  When

      
 =
              When applicable Service =
Providers MUST specify the     =
        applicable service providers MUST =
specify the description
 =
              description specified in the core schema =
specification.             specified =
in the core schema specification.

      
 =
                                                                        =
 

      
 =
           readOnly  A Boolean value that =
specifies if the attribute is 

      
               =
mutable. 

      
 

      
   =
         required  A Boolean value that specifies if the attribute =
is             required  A Boolean =
value that specifies if the attribute is

      
   =
            required.                =
required.

      
 

      
   =
         caseExact  A Boolean value that specifies if the =
String             caseExact  A =
Boolean value that specifies if the String

      
   =
            attribute is case sensitive.                attribute is case sensitive.

      
 

      

      
 =
           referenceTypes  The names of the =
Resource Types that may be     =
     referenceTypes  The names of the resource =
types that may be

      
   =
            referenced; e.g., User.  This is only applicable =
for                referenced; e.g., =
User.  This is only applicable for

      

      
 =
              attributes that are of the "reference" data type. =
            attributes that are of the =
"reference" Section 3.1.7 data

      
             =
type.

      
 

      
   =
         canonicalValues  A collection of canonical values.  =
When             canonicalValues  A =
collection of canonical values.  When

      

      
 =
              applicable Service Providers =
MUST specify the canonical            =
 applicable service providers MUST specify =
the canonical

      
   =
            types specified in the core schema specification; =
               types specified in the core =
schema specification;

      
   =
            e.g.,"work","home".  OPTIONAL.                e.g.,"work","home".  OPTIONAL.

      
 

      

      
          mutability  A single keyword indicating what types =
of

      
             modifications an attribute MAY accept as =
follows:

      
 

      
             readOnly  The attribute MAY NOT be =
modified.

      
 

      
             readWrite  The attribute MAY be updated and =
read at any

      
                time.  DEFAULT.

      
 

      
             immutable  The attribute MAY be defined at =
resource creation

      
                (e.g. POST) or at record replacement via =
request (e.g. a

      
                PUT).  The attribute MAY NOT be =
updated.

      
 

      
             writeOnly  The attribute MAY be updated at =
any time.

      
                Attribute values MAY NOT be returned =
(e.g.  because the

      
                value is a stored hash).  Note: an =
attribute with

      
                mutability of "writeOnly" usually also =
has a returned

      
                setting of "never".

      
 

      
          returned  A single keyword that indicates when =
an attribute and
             associated values are returned in response =
to a GET request
             or in response to a PUT, POST, or PATCH =
request.  Valid

      
             keywords are:

      
 

      
             always  The attribute is always returned =
regardless of the

      
                contents of the "attributes" parameter.  =
For example,

      
                "id" is always returned to identify a =
SCIM resource.

      
 

      
             never  The attribute is never returned.  =
This may occur

      
                because the original attribute value is =
not retained by

      
                the service provider (e.g. such as with =
a hashed value).
                A service provider MAY allow attributes =
to be used in a

      
                search filter.

      
 

      
             default  The attribute is returned by =
default in all SCIM

      
                operation responses where attribute =
values are returned.

      
                If the GET request "attributes" =
parameter is specified,

      
                attribute values are only returned if =
the attribute is
                named in the attributes parameter.  =
DEFAULT.

      
 

      
             request  The attribute is returned in =
response to any PUT,

      
                POST, or PATCH operations if the =
attribute was specified

      
                by the client (for example, the =
attribute was modified).

      
                The attribute is returned in a SCIM =
query operation only

      
                if specified in the "attributes" =
parameter.

      
 

      
          uniqueness  A single keyword value that =
specifies how the

      
             service provider enforces uniqueness of =
attribute values.  A

      
             server MAY reject an invalid value based on =
uniqueness by

      
             returning HTTP Response code 400 (Bad =
Request).  A client

      
             MAY enforce uniqueness on the client-side =
to a greater

      
             degree than the service provider enforces.  =
For example, a

      
             client could make a value unique while the =
server has

      
             uniqueness of "none".  Valid keywords =
are:

      
 

      
             none  The values are not intended to be =
unique in any way.

      
                DEFAULT.

      
 

      
             server  The value SHOULD be unique within =
the context of the

      
                current SCIM endpoint (or tenancy) but =
MAY not be

      
                globally unique (e.g. a "username", =
email address, or

      
                other server generated key or counter).  =
No two resources
                on the same server SHOULD possess the =
same value.

      
 

      
             global  The value SHOULD be globally unique =
(e.g. an email

      
                address, a GUID, or other value).  No =
two resources on
                any server SHOULD possess the same =
value.

      
                     =
                                                     

      
12. =
 JSON Representation 12.  JSON =
Representation

      
 

      
12.1.  Minimal User Representation 12.1.  Minimal User Representation

      
 

      
   =
The following is a non-normative example of the minimal required =
SCIM    The following is a =
non-normative example of the minimal required SCIM

      
   =
representation in JSON format.    =
representation in JSON format.

      
 

      
{ {

      
  =
"schemas": ["urn:scim:schemas:core:2.0:User"],   "schemas": ["urn:scim:schemas:core:2.0:User"],

      
  =
"id": "2819c223-7f76-453a-919d-413861904646",   "id": "2819c223-7f76-453a-919d-413861904646",

      
  =
"userName": "bjensen@example.com",   =
"userName": "bjensen@example.com",

      
  =
"meta": {   "meta": {

      
   =
 "resourceType": "User",     =
"resourceType": "User",
   =
 "created": "2010-01-23T04:56:22Z",    =
 "created": "2010-01-23T04:56:22Z",

      
   =
 "lastModified": "2011-05-13T04:42:34Z",     "lastModified": "2011-05-13T04:42:34Z",

      
   =
 "version": "W\/\"3694e05e9dff590\"",  =
   "version": "W\/\"3694e05e9dff590\"",

      

      
 =
   "location": "https://example.com/v1/Users/2819c223-7f76-453a-919d-413861904646"     "location": =
"https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646"

      
  =
}   }

      
} }

      
 

      
12.2.  Full User Representation 12.2.  Full User Representation

      
 

      
   =
The following is a non-normative example of the fully populated =
SCIM    The following is a =
non-normative example of the fully populated SCIM

      
   =
representation in JSON format.    =
representation in JSON format.

      
 

      
{ {

      
  =
"schemas": ["urn:scim:schemas:core:2.0:User"],   "schemas": ["urn:scim:schemas:core:2.0:User"],

      
 =


      
skipping to change at page 22, line =
24 skipping to =
change at page 25, line 10

      
  =
"userType": "Employee",   "userType": =
"Employee",

      
  =
"title": "Tour Guide",   "title": =
"Tour Guide",

      
  =
"preferredLanguage":"en_US",   =
"preferredLanguage":"en_US",

      
  =
"locale": "en_US",   "locale": =
"en_US",

      
  =
"timezone": "America/Los_Angeles",   =
"timezone": "America/Los_Angeles",

      
  =
"active":true,   =
"active":true,

      
  =
"password":"t1meMa$heen",   =
"password":"t1meMa$heen",

      
  =
"groups": [   "groups": [

      
   =
 {     {

      
   =
   "value": "e9e30dba-f08f-4109-8486-d5c6a331660a",       "value": =
"e9e30dba-f08f-4109-8486-d5c6a331660a",

      

      
 =
     "$ref": "https://example.com/v1/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a",       "$ref": =
"https://example.com/v2/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a",

      
   =
   "display": "Tour Guides"       =
"display": "Tour Guides"

      
   =
 },     },

      
   =
 {     {

      
   =
   "value": "fc348aa8-3835-40eb-a20b-c726e15c55b5",       "value": =
"fc348aa8-3835-40eb-a20b-c726e15c55b5",

      

      
 =
     "$ref": "https://example.com/v1/Groups/fc348aa8-3835-40eb-a20b-c726e15c55b5",       "$ref": =
"https://example.com/v2/Groups/fc348aa8-3835-40eb-a20b-c726e15c55b5",

      
   =
   "display": "Employees"       =
"display": "Employees"

      
   =
 },     },

      
   =
 {     {

      
   =
   "value": "71ddacd2-a8e7-49b8-a5db-ae50d0a5bfd7",       "value": =
"71ddacd2-a8e7-49b8-a5db-ae50d0a5bfd7",

      

      
 =
     "$ref": "https://example.com/v1/Groups/71ddacd2-a8e7-49b8-a5db-ae50d0a5bfd7",       "$ref": =
"https://example.com/v2/Groups/71ddacd2-a8e7-49b8-a5db-ae50d0a5bfd7",

      
   =
   "display": "US Employees"       =
"display": "US Employees"

      
   =
 }     }

      
  =
],   ],

      
  =
"x509Certificates": [   =
"x509Certificates": [

      
   =
 {     {

      
   =
   "value": =
"MIIDQzCCAqygAwIBAgICEAAwDQYJKoZIhvcNAQEFBQAwTjELMAkGA1UEBhMCVVMx=
       "value": =
"MIIDQzCCAqygAwIBAgICEAAwDQYJKoZIhvcNAQEFBQAwTjELMAkGA1UEBhMCVVMx

      
   =
             =
EzARBgNVBAgMCkNhbGlmb3JuaWExFDASBgNVBAoMC2V4YW1wbGUuY29tMRQwEgYD =
                =
EzARBgNVBAgMCkNhbGlmb3JuaWExFDASBgNVBAoMC2V4YW1wbGUuY29tMRQwEgYD

      
   =
             =
VQQDDAtleGFtcGxlLmNvbTAeFw0xMTEwMjIwNjI0MzFaFw0xMjEwMDQwNjI0MzFa =
                =
VQQDDAtleGFtcGxlLmNvbTAeFw0xMTEwMjIwNjI0MzFaFw0xMjEwMDQwNjI0MzFa

      
   =
             =
MH8xCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRQwEgYDVQQKDAtl =
                =
MH8xCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRQwEgYDVQQKDAtl

      
   =
             =
eGFtcGxlLmNvbTEhMB8GA1UEAwwYTXMuIEJhcmJhcmEgSiBKZW5zZW4gSUlJMSIw =
                =
eGFtcGxlLmNvbTEhMB8GA1UEAwwYTXMuIEJhcmJhcmEgSiBKZW5zZW4gSUlJMSIw

      
 =


      
skipping to change at page 23, line =
17 skipping to =
change at page 25, line 51

      
   =
             =
Ng5Tcq+/ByEDrBgnusx0jloUhByPMEVkoMZ3J7j1ZgI8rAbOkNngX8+pKfTiDz1R =
                =
Ng5Tcq+/ByEDrBgnusx0jloUhByPMEVkoMZ3J7j1ZgI8rAbOkNngX8+pKfTiDz1R

      
   =
             =
C4+dx8oU6Za+4NJXUjlL5CvV6BEYb1+QAEJwitTVvxB/A67g42/vzgAtoRUeDov1 =
                =
C4+dx8oU6Za+4NJXUjlL5CvV6BEYb1+QAEJwitTVvxB/A67g42/vzgAtoRUeDov1

      
   =
             +GFiBZ+GNF/cAYKcMtGcrs2i97ZkJMo=3D"                 =
+GFiBZ+GNF/cAYKcMtGcrs2i97ZkJMo=3D"

      
   =
 }     }

      
  =
],   ],

      
  =
"meta": {   "meta": {

      
   =
 "resourceType": "User",     =
"resourceType": "User",
   =
 "created": "2010-01-23T04:56:22Z",    =
 "created": "2010-01-23T04:56:22Z",

      
   =
 "lastModified": "2011-05-13T04:42:34Z",     "lastModified": "2011-05-13T04:42:34Z",

      
   =
 "version": "W\/\"a330bc54f0671c9\"",  =
   "version": "W\/\"a330bc54f0671c9\"",

      

      
 =
   "location": "https://example.com/v1/Users/2819c223-7f76-453a-919d-413=
861904646"     "location": =
"https://example.com/v2/Users/2819c223-7f76-453a-919d-413=
861904646"

      
                     =
                                                     

      
  =
}   }

      
} }

      
 

      
12.3.  Enterprise User Extension Representation =
12.3.  Enterprise User Extension =
Representation

      
 

      
   =
The following is a non-normative example of the fully populated =
User    The following is a =
non-normative example of the fully populated User

      
   =
using the enterprise User extension in JSON format.    using the enterprise User extension in JSON =
format.

      
 

      
{ {

      
  =
"schemas": ["urn:scim:schemas:core:2.0:User", =
"urn:scim:schemas:extension:enterprise:2.0:User"],   "schemas": ["urn:scim:schemas:core:2.0:User", =
"urn:scim:schemas:extension:enterprise:2.0:User"],

      
 =


      
skipping to change at page 26, line =
20 skipping to =
change at page 29, line 5

      
   =
   "managerId": "26118915-6090-4610-87e4-49d8ca9f808d", =
      "managerId": =
"26118915-6090-4610-87e4-49d8ca9f808d",

      
   =
   "$ref": "/Users/26118915-6090-4610-87e4-49d8ca9f808d", =
      "$ref": =
"/Users/26118915-6090-4610-87e4-49d8ca9f808d",

      
   =
   "displayName": "John Smith"       =
"displayName": "John Smith"

      
   =
 }     }

      
  =
},   },

      
  =
"meta": {   "meta": {

      
   =
 "resourceType": "User",     =
"resourceType": "User",
   =
 "created": "2010-01-23T04:56:22Z",    =
 "created": "2010-01-23T04:56:22Z",

      
   =
 "lastModified": "2011-05-13T04:42:34Z",     "lastModified": "2011-05-13T04:42:34Z",

      
   =
 "version": "W\/\"3694e05e9dff591\"",  =
   "version": "W\/\"3694e05e9dff591\"",

      

      
 =
   "location": "https://example.com/v1/Users/2819c223-7f76-453a-919d-413861904646"     "location": =
"https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646"

      
  =
}   }

      
} }

      
 

      
12.4.  Group Representation 12.4.  Group Representation

      
 

      
   =
The following is a non-normative example of SCIM Group =
representation    The following is a =
non-normative example of SCIM Group representation

      
   =
in JSON format.    in JSON =
format.

      
 

      
{ {

      
  =
"schemas": ["urn:scim:schemas:core:2.0:Group"],   "schemas": =
["urn:scim:schemas:core:2.0:Group"],

      
  =
"id": "e9e30dba-f08f-4109-8486-d5c6a331660a",   "id": "e9e30dba-f08f-4109-8486-d5c6a331660a",

      
  =
"displayName": "Tour Guides",   =
"displayName": "Tour Guides",

      
  =
"members": [   "members": [

      
   =
 {     {

      
   =
   "value": "2819c223-7f76-453a-919d-413861904646",       "value": =
"2819c223-7f76-453a-919d-413861904646",

      

      
 =
     "$ref": "https://example.com/v1/Users/2819c223-7f76-453a-919d-413861904646",       "$ref": =
"https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646",

      
   =
   "display": "Babs Jensen"       =
"display": "Babs Jensen"

      
   =
 },     },

      
   =
 {     {

      
   =
   "value": "902c246b-6245-4190-8e05-00816be7344a",       "value": =
"902c246b-6245-4190-8e05-00816be7344a",

      

      
 =
     "$ref": "https://example.com/v1/Users/902c246b-6245-4190-8e05-00816be7344a",       "$ref": =
"https://example.com/v2/Users/902c246b-6245-4190-8e05-00816be7344a",

      
   =
   "display": "Mandy Pepperidge"       =
"display": "Mandy Pepperidge"

      
   =
 }     }

      
  =
],   ],

      
  =
"meta": {   "meta": {

      
   =
 "resourceType": "Group",     =
"resourceType": "Group",

      
   =
 "created": "2010-01-23T04:56:22Z",    =
 "created": "2010-01-23T04:56:22Z",

      
   =
 "lastModified": "2011-05-13T04:42:34Z",     "lastModified": "2011-05-13T04:42:34Z",

      
   =
 "version": "W\/\"3694e05e9dff592\"",  =
   "version": "W\/\"3694e05e9dff592\"",

      

      
 =
   "location": "https://example.com/v1/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a"     "location": =
"https://example.com/v2/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a"

      
  =
}   }

      
} }

      
 

      
12.5.  Service Provider Configuration =
Representation 12.5.  Service Provider =
Configuration Representation

      
 

      

      
 =
  The following is a non-normative example of the SCIM Service Provider    The following is a non-normative example of the SCIM =
service provider

      
   Configuration =
representation in JSON format.    configuration representation in JSON =
format.

      
 

      
{ {

      
  =
"schemas": ["urn:scim:schemas:core:2.0:ServiceProviderConfig"], =
  "schemas": =
["urn:scim:schemas:core:2.0:ServiceProviderConfig"],

      
  =
"documentationUrl":"http://example.com/help/scim.html", =
  =
"documentationUrl":"http://example.com/help/scim.html",

      
  =
"patch": {   "patch": {

      
   =
 "supported":true     =
"supported":true

      
  =
},   },

      
  =
"bulk": {   "bulk": {

      
   =
 "supported":true,     =
"supported":true,

      
   =
 "maxOperations":1000,     =
"maxOperations":1000,

      
 =


      
skipping to change at page 28, line =
30 skipping to =
change at page 30, line 38

      
   =
 },     },

      
   =
 {     {

      
   =
   "name": "HTTP Basic",       "name": =
"HTTP Basic",

      
   =
   "description": "Authentication Scheme using the Http Basic =
Standard",       "description": =
"Authentication Scheme using the Http Basic Standard",

      
   =
   "specUrl":"http://www.ietf.org/rfc/rfc2617.txt",       =
"specUrl":"http://www.ietf.org/rfc/rfc2617.txt",

      
   =
   "documentationUrl":"http://example.com/help/httpBasic.html", =
      =
"documentationUrl":"http://example.com/help/httpBasic.html",

      
   =
   "type":"httpbasic"       =
"type":"httpbasic"

      
   =
  }      }

      
  =
],   ],

      
  =
"meta": {   "meta": {

      

      
     =
"location":"https://example.com/v2/ServiceProviderConfig",

      
   =
 "resourceType": "ServiceProviderConfig",     "resourceType": "ServiceProviderConfig",

      
   =
 "created": "2010-01-23T04:56:22Z",    =
 "created": "2010-01-23T04:56:22Z",

      
   =
 "lastModified": "2011-05-13T04:42:34Z",     "lastModified": "2011-05-13T04:42:34Z",

      
   =
 "version": "W\/\"3694e05e9dff594\""   =
  "version": "W\/\"3694e05e9dff594\""

      
  =
}   }

      
} }

      
 

      
12.6.  Resource Type Representation 12.6.  Resource Type Representation

      
 

      

      
 =
  The following is a non-normative example of the SCIM Resource Type  =
  The following is a non-normative example of the SCIM resource type

      
   =
representation in JSON format.    =
representation in JSON format.

      
 

      
{ {

      
  =
"schemas": ["urn:scim:schemas:core:2.0:ResourceType"],   "schemas": =
["urn:scim:schemas:core:2.0:ResourceType"],

      

      
   "id":"User",

      
  =
"name": "User",   "name": =
"User",

      
  =
"endpoint": "/Users",   "endpoint": =
"/Users",

      
  =
"description": "Core User",   =
"description": "Core User",

      
  =
"schema": "urn:scim:schemas:core:2.0:User",   "schema": "urn:scim:schemas:core:2.0:User",

      
  =
"schemaExtensions": [   =
"schemaExtensions": [

      
   =
 {     {

      
   =
   "schema": =
"urn:scim:schemas:extension:enterprise:2.0:EnterpriseUser", =
      "schema": =
"urn:scim:schemas:extension:enterprise:2.0:EnterpriseUser",

      
   =
   "required": true       "required": =
true

      
   =
 }     }

      
  =
],   ],

      
  =
"meta": {   "meta": {

      

      
     =
"location":"https://example.com/v2/ResourceTypes/User",

      
   =
 "resourceType": "ResourceType",     =
"resourceType": "ResourceType",

      
   =
 "created": "2010-01-23T04:56:22Z",    =
 "created": "2010-01-23T04:56:22Z",

      
   =
 "lastModified": "2011-05-13T04:42:34Z",     "lastModified": "2011-05-13T04:42:34Z",

      
   =
 "version": "W\/\"3694e05e9dff595\""   =
  "version": "W\/\"3694e05e9dff595\""

      
  =
}   }

      
} }

      
 

      
12.7.  Schema Representation 12.7.  Schema Representation

      
 

      

      
 =
  The following is a non-normative example =
of the SCIM Schema    The following =
is intended as normative example of the =
SCIM Schema

      
 =
  representation in JSON format.    =
representation in JSON format.  Where permitted =
individual values and

      
    schema MAY change.  Included but not limited to, are =
schemas for

      
    User, Group, and enterprise user.

      
 

      

      
 {[

      
{ {

      
  =
"id": "urn:scim:schemas:core:2.0:User", =
  "id": "urn:scim:schemas:core:2.0:User",

      
  =
"name": "User",   "name": =
"User",

      
  =
"description": "Core User",   =
"description": "Core User",

      
  =
"attributes":[   =
"attributes":[

      
   =
 {     {

      
   =
   "name":"id",       =
"name":"id",

      
   =
   "type":"string",       =
"type":"string",

      
   =
   "multiValued":false,       =
"multiValued":false,

      
   =
   "description":"Unique identifier for the SCIM resource as defined by =
the Service Provider. Each representation of the resource MUST include a =
non-empty id value. This identifier MUST be unique across the Service =
Provider's entire set of resources. It MUST be a stable, =
non-reassignable identifier that does not change when the same resource =
is returned in subsequent requests. The value of the id attribute is =
always issued by the Service Provider and MUST never be specified by the =
Service Consumer. REQUIRED.",       =
"description":"Unique identifier for the SCIM resource as defined by the =
Service Provider. Each representation of the resource MUST include a =
non-empty id value. This identifier MUST be unique across the Service =
Provider's entire set of resources. It MUST be a stable, =
non-reassignable identifier that does not change when the same resource =
is returned in subsequent requests. The value of the id attribute is =
always issued by the Service Provider and MUST never be specified by the =
Service Consumer. REQUIRED.",

      

      
      =
"readOnly":true, 

      
   =
   "required":true,       =
"required":true,

      

      
 =
     "caseExact":false         "caseExact" : =
false,

      
         "mutability" : "readOnly\n",

      
         "returned" : "always",

      
         "uniqueness" : "server"

      
       },

      
       {

      
         "name" : "externalId",

      
         "type" : "string",

      
         "multiValued" : false,

      
         "description" : "An identifier for the Resource =
as defined by the Service Consumer.",

      
         "required" : true,

      
         "caseExact" : false,

      
         "mutability" : "readWrite\n",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
       },

      
       {

      
         "name" : "userName",

      
         "type" : "string",

      
         "multiValued" : false,

      
         "description" : "Unique identifier for the User =
typically used by the user to directly authenticate to the service =
provider. Each User MUST include a non-empty userName value.  This =
identifier MUST be unique across the Service Consumer's entire set of =
Users.  REQUIRED",

      
         "required" : true,

      
         "caseExact" : false,

      
         "mutability" : "readWrite\n",

      
         "returned" : "default",

      
         "uniqueness" : "server"

      
   =
 },     },

      
   =
 {     {

      
   =
   "name":"name",       =
"name":"name",

      
   =
   "type":"complex",       =
"type":"complex",

      
   =
   "multiValued":false,       =
"multiValued":false,

      
   =
   "description":"The components of the user's real name. Providers MAY =
return just the full name as a single string in the formatted =
sub-attribute, or they MAY return just the individual component =
attributes using the other sub-attributes, or they MAY return both. If =
both variants are returned, they SHOULD be describing the same name, =
with the formatted name indicating how the component attributes should =
be combined.",       =
"description":"The components of the user's real name. Providers MAY =
return just the full name as a single string in the formatted =
sub-attribute, or they MAY return just the individual component =
attributes using the other sub-attributes, or they MAY return both. If =
both variants are returned, they SHOULD be describing the same name, =
with the formatted name indicating how the component attributes should =
be combined.",

      

      
      =
"readOnly":false, 

      
   =
   "required":false,       =
"required":false,

      
   =
   "caseExact":false,       =
"caseExact":false,

      
   =
   "subAttributes":[       =
"subAttributes":[

      
   =
     {         {

      
   =
       "name":"formatted",           =
"name":"formatted",

      
   =
       "type":"string",           =
"type":"string",

      
   =
       "multiValued":false,           =
"multiValued":false,

      
   =
       "description":"The full name, including all middle names, titles, =
and suffixes as appropriate, formatted for display (e.g. Ms. Barbara J =
Jensen, III.)." ,           =
"description":"The full name, including all middle names, titles, and =
suffixes as appropriate, formatted for display (e.g. Ms. Barbara J =
Jensen, III.)." ,

      

      
          =
"readOnly":false, 

      
   =
       "required":false,           =
"required":false,

      

      
 =
         "caseExact":false =
            "caseExact" =
: false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
   =
     },         },

      
   =
     {         {

      
   =
       "name":"familyName",           =
"name":"familyName",

      
   =
       "type":"string",           =
"type":"string",

      
   =
       "multiValued":false,           =
"multiValued":false,

      
   =
       "description":"The family name of the User, or Last Name in most =
Western languages (e.g. Jensen given the full name Ms. Barbara J Jensen, =
III.).",           "description":"The =
family name of the User, or Last Name in most Western languages (e.g. =
Jensen given the full name Ms. Barbara J Jensen, III.).",

      

      
          =
"readOnly":false, 

      
   =
       "required":false,           =
"required":false,

      

      
 =
         "caseExact":false =
            "caseExact" =
: false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
   =
     },         },

      
   =
     {         {

      
   =
       "name":"givenName",           =
"name":"givenName",

      
   =
       "type":"string",           =
"type":"string",

      
   =
       "multiValued":false,           =
"multiValued":false,

      
   =
       "description":"The given name of the User, or First Name in most =
Western languages (e.g. Barbara given the full name Ms. Barbara J =
Jensen, III.).",           =
"description":"The given name of the User, or First Name in most Western =
languages (e.g. Barbara given the full name Ms. Barbara J Jensen, =
III.).",

      

      
          =
"readOnly":false, 

      
   =
       "required":false,           =
"required":false,

      

      
 =
         "caseExact":false =
            "caseExact" =
: false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
   =
     },         },

      
   =
     {         {

      
   =
       "name":"middleName",           =
"name":"middleName",

      
   =
       "type":"string",           =
"type":"string",

      
   =
       "multiValued":false,           =
"multiValued":false,

      
   =
       "description":"The middle name(s) of the User (e.g. Robert given =
the full name Ms. Barbara J Jensen, III.).",           "description":"The middle name(s) of the User =
(e.g. Robert given the full name Ms. Barbara J Jensen, III.).",

      

      
          =
"readOnly":false, 

      
   =
       "required":false,           =
"required":false,

      

      
 =
         "caseExact":false =
            "caseExact" =
: false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
   =
     },         },

      
   =
     {         {

      
   =
       "name":"honorificPrefix",       =
    "name":"honorificPrefix",

      
   =
       "type":"string",           =
"type":"string",

      
   =
       "multiValued":false,           =
"multiValued":false,

      
   =
       "description":"The honorific prefix(es) of the User, or Title in =
most Western languages (e.g. Ms. given the full name Ms. Barbara J =
Jensen, III.).",           =
"description":"The honorific prefix(es) of the User, or Title in most =
Western languages (e.g. Ms. given the full name Ms. Barbara J Jensen, =
III.).",

      

      
          =
"readOnly":false, 

      
   =
       "required":false,           =
"required":false,

      

      
 =
         "caseExact":false =
            "caseExact" =
: false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
   =
     },         },

      
   =
     {         {

      
   =
       "name":"honorificSuffix",       =
    "name":"honorificSuffix",

      
   =
       "type":"string",           =
"type":"string",

      
   =
       "multiValued":false,           =
"multiValued":false,

      
   =
       "description":"The honorific suffix(es) of the User, or Suffix in =
most Western languages (e.g. III. given the full name Ms. Barbara J =
Jensen, III.).",           =
"description":"The honorific suffix(es) of the User, or Suffix in most =
Western languages (e.g. III. given the full name Ms. Barbara J Jensen, =
III.).",

      

      
          =
"readOnly":false, 

      
   =
       "required":false,           =
"required":false,

      

      
 =
         "caseExact":false =
            "caseExact" =
: false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
   =
     }         }

      

      
 =
     ]  =
       ],

      
         "mutability" : "readWrite\n",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
       },

      
       {

      
         "name" : "displayName",

      
         "type" : "string",

      
         "multiValued" : false,

      
         "description" : "The name of the User, suitable =
for display to end-users. The name SHOULD be the full name of the User =
being described if known",

      
         "required" : false,

      
         "caseExact" : false,

      
         "mutability" : "readWrite\n",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
       },

      
       {

      
         "name" : "nickName",

      
         "type" : "string",

      
         "multiValued" : false,

      
         "description" : "The casual way to address the =
user in real life, e.g. \"Bob\" or \"Bobby\" instead of \"Robert\".  =
This attribute SHOULD NOT be used to represent a User's username (e.g. =
bjensen or mpepperidge)",

      
         "required" : false,

      
         "caseExact" : false,

      
         "mutability" : "readWrite\n",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
       },

      
       {

      
         "name" : "profileUrl",

      
         "type" : "string",

      
         "multiValued" : false,

      
         "description" : "A fully qualified URL to a =
page representing the User's online profile",

      
         "required" : false,

      
         "caseExact" : false,

      
         "mutability" : "readWrite\n",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
       },

      
       {

      
         "name" : "title",

      
         "type" : "string",

      
         "multiValued" : false,

      
         "description" : "The user's title, such as =
\"Vice President.\"",

      
         "required" : false,

      
         "caseExact" : false,

      
         "mutability" : "readWrite\n",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
       },

      
       {

      
         "name" : "userType",

      
         "type" : "string",

      
         "multiValued" : false,

      
         "description" : "Used to identify the =
organization to user relationship. Typical values used might be =
\"Contractor\", \"Employee\", \"Intern\", \"Temp\", \"External\", and =
\"Unknown\" but any value may be used ",

      
         "required" : false,

      
         "caseExact" : false,

      
         "mutability" : "readWrite\n",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
       },

      
       {

      
         "name" : "preferredLanguage",

      
         "type" : "string",

      
         "multiValued" : false,

      
         "description" : "Indicates the User's preferred =
written or spoken language.  Generally used for selecting a localized =
User interface. e.g., 'en_US' specifies the language English and country =
US.",

      
         "required" : false,

      
         "caseExact" : false,

      
         "mutability" : "readWrite\n",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
       },

      
       {

      
         "name" : "locale",

      
         "type" : "string",

      
         "multiValued" : false,

      
         "description" : "Used to indicate the User's =
default location for purposes of localizing items such as currency, date =
time format, numerical representations, etc.",

      
         "required" : false,

      
         "caseExact" : false,

      
         "mutability" : "readWrite\n",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
       },

      
       {

      
         "name" : "timezone",

      
         "type" : "string",

      
         "multiValued" : false,

      
         "description" : "The User's time zone in the =
\"Olson\" timezone database format [19]; =
e.g.,'America/Los_Angeles'",

      
         "required" : false,

      
         "caseExact" : false,

      
         "mutability" : "readWrite\n",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
       },

      
       {

      
         "name" : "active",

      
         "type" : "boolean",

      
         "multiValued" : false,

      
         "description" : "A Boolean value indicating the =
User's administrative status.",

      
         "required" : false,

      
         "caseExact" : false,

      
         "mutability" : "readWrite\n",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
       },

      
       {

      
         "name" : "password",

      
         "type" : "string",

      
         "multiValued" : false,

      
         "description" : "The User's clear text =
password.  This attribute is intended to be used as a means to specify =
an initial password when creating a new User or to reset an existing =
User's password.",

      
         "required" : false,

      
         "caseExact" : false,

      
         "mutability" : "writeOnly",

      
         "returned" : "never",

      
         "uniqueness" : "none"

      
   =
 },     },

      
   =
 {     {

      
   =
   "name":"emails",       =
"name":"emails",

      
   =
   "type":"complex",       =
"type":"complex",

      
   =
   "multiValued":true,       =
"multiValued":true,

      
   =
   "description":"E-mail addresses for the user. The value SHOULD be =
canonicalized by the Service Provider, e.g. bjensen@example.com instead =
of bjensen@EXAMPLE.COM. Canonical Type values of work, home, and =
other.",       "description":"E-mail =
addresses for the user. The value SHOULD be canonicalized by the Service =
Provider, e.g. bjensen@example.com instead of bjensen@EXAMPLE.COM. =
Canonical Type values of work, home, and other.",

      

      
      =
"readOnly":false, 

      
   =
   "required":false,       =
"required":false,

      
   =
   "caseExact":false,       =
"caseExact":false,

      
   =
   "subAttributes":[       =
"subAttributes":[

      
   =
     {         {

      
   =
       "name":"value",           =
"name":"value",

      
   =
       "type":"string",           =
"type":"string",

      
   =
       "multiValued":false,           =
"multiValued":false,

      
   =
       "description":"E-mail addresses for the user. The value SHOULD be =
canonicalized by the Service Provider, e.g. bjensen@example.com instead =
of bjensen@EXAMPLE.COM. Canonical Type values of work, home, and =
other.",           =
"description":"E-mail addresses for the user. The value SHOULD be =
canonicalized by the Service Provider, e.g. bjensen@example.com instead =
of bjensen@EXAMPLE.COM. Canonical Type values of work, home, and =
other.",

      

      
          =
"readOnly":false, 

      
   =
       "required":false,           =
"required":false,

      

      
 =
         "caseExact":false =
            "caseExact" =
: false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
   =
     },         },

      
   =
     {         {

      
   =
       "name":"display",           =
"name":"display",

      
   =
       "type":"string",           =
"type":"string",

      
   =
       "multiValued":false,           =
"multiValued":false,

      
   =
       "description":"A human readable name, primarily used for display =
purposes. READ-ONLY.",           =
"description":"A human readable name, primarily used for display =
purposes. READ-ONLY.",

      

      
          =
"readOnly":true, 

      
   =
       "required":false,           =
"required":false,

      

      
 =
         "caseExact":false =
            "caseExact" =
: false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
   =
     },         },

      
   =
     {         {

      
   =
       "name":"type",           =
"name":"type",

      
   =
       "type":"string",           =
"type":"string",

      
   =
       "multiValued":false,           =
"multiValued":false,

      
   =
       "description":"A label indicating the attribute's function; e.g., =
'work' or 'home'.",           =
"description":"A label indicating the attribute's function; e.g., 'work' =
or 'home'.",

      

      
          =
"readOnly":false, 

      
   =
       "required":false,           =
"required":false,

      
   =
       "caseExact":false,           =
"caseExact":false,

      

      
 =
         "canonicalValues":["work","home","other"]=
             "canonicalValues" : [

      
               "work",

      
               "home",

      
               "other"

      
             ],

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
   =
     },         },

      
   =
     {         {

      
   =
       "name":"primary",           =
"name":"primary",

      
   =
       "type":"boolean",           =
"type":"boolean",

      
   =
       "multiValued":false,           =
"multiValued":false,

      
   =
       "description":"A Boolean value indicating the 'primary' or =
preferred attribute value for this attribute, e.g. the preferred mailing =
address or primary e-mail address. The primary attribute value 'true' =
MUST appear no more than once.",       =
    "description":"A Boolean value indicating the 'primary' or preferred =
attribute value for this attribute, e.g. the preferred mailing address =
or primary e-mail address. The primary attribute value 'true' MUST =
appear no more than once.",

      

      
          =
"readOnly":false, 

      
   =
       "required":false,           =
"required":false,

      

      
 =
         "caseExact":false =
            "caseExact" =
: false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
   =
     }         }

      

      
 =
     ]  =
       ],

      
         "mutability" : "readWrite\n",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
       },

      
       {

      
         "name" : "phoneNumbers",

      
         "type" : "complex",

      
         "multiValued" : true,

      
         "description" : "Phone numbers for the User.  =
The value SHOULD be canonicalized by the Service Provider according to =
format in RFC3966 [20] e.g. 'tel:+1-201-555-0123'.  Canonical Type =
values of work, home, mobile, fax, pager and other.",

      
         "required" : false,

      
         "caseExact" : false,

      
         "subAttributes" : [

      
           {

      
             "name" : "value",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "Phone number of the =
User",

      
             "required" : false,

      
             "caseExact" : false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           },

      
           {

      
             "name" : "display",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "A human readable name, =
primarily used for display purposes. READ-ONLY.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           },

      
           {

      
             "name" : "type",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "A label indicating the =
attribute's function; e.g., 'work' or 'home' or 'mobile' =
etc.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "canonicalValues" : [

      
               "work",

      
               "home",

      
               "mobile",

      
               "fax",

      
               "pager",

      
               "other"

      
             ],

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           },

      
           {

      
             "name" : "primary",

      
             "type" : "boolean",

      
             "multiValued" : false,

      
             "description" : "A Boolean value indicating =
the 'primary' or preferred attribute value for this attribute, e.g. the =
preferred phone number or primary phone number. The primary attribute =
value 'true' MUST appear no more than once.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           }

      
         ],

      
         "mutability" : "readWrite\n",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
       },

      
       {

      
         "name" : "ims",

      
         "type" : "complex",

      
         "multiValued" : true,

      
         "description" : "Instant messaging addresses =
for the User.",

      
         "required" : false,

      
         "caseExact" : false,

      
         "subAttributes" : [

      
           {

      
             "name" : "value",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "Instant messaging address =
for the User.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           },

      
           {

      
             "name" : "display",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "A human readable name, =
primarily used for display purposes. READ-ONLY.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           },

      
           {

      
             "name" : "type",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "A label indicating the =
attribute's function; e.g., 'aim', 'gtalk', 'mobile' =
etc.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "canonicalValues" : [

      
               "aim",

      
               "gtalk",

      
               "icq",

      
               "xmpp",

      
               "msn",

      
               "skype",

      
               "qq",

      
               "yahoo"

      
             ],

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           },

      
           {

      
             "name" : "primary",

      
             "type" : "boolean",

      
             "multiValued" : false,

      
             "description" : "A Boolean value indicating =
the 'primary' or preferred attribute value for this attribute, e.g. the =
preferred messenger or primary messenger. The primary attribute value =
'true' MUST appear no more than once.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           }

      
         ],

      
         "mutability" : "readWrite\n",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
       },

      
       {

      
         "name" : "photos",

      
         "type" : "complex",

      
         "multiValued" : true,

      
         "description" : "URLs of photos of the =
User.",

      
         "required" : false,

      
         "caseExact" : false,

      
         "subAttributes" : [

      
           {

      
             "name" : "value",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "URL of a photo of the =
User.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           },

      
           {

      
             "name" : "display",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "A human readable name, =
primarily used for display purposes. READ-ONLY.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
 

      
           },

      
           {

      
             "name" : "type",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "A label indicating the =
attribute's function; e.g., 'photo' or 'thumbnail'.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "canonicalValues" : [

      
               "photo",

      
               "thumbnail"

      
             ],

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           },

      
           {

      
             "name" : "primary",

      
             "type" : "boolean",

      
             "multiValued" : false,

      
             "description" : "A Boolean value indicating =
the 'primary' or preferred attribute value for this attribute, e.g. the =
preferred photo or thumbnail. The primary attribute value 'true' MUST =
appear no more than once.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           }

      
         ],

      
         "mutability" : "readWrite\n",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
   =
 },     },

      
   =
 {     {

      
   =
   "name":"addresses",       =
"name":"addresses",

      
   =
   "type":"complex",       =
"type":"complex",

      
   =
   "multiValued":true,       =
"multiValued":true,

      
   =
   "description":"A physical mailing address for this User, as described =
in (address Element). Canonical Type Values of work, home, and other. =
The value attribute is a complex type with the following =
sub-attributes.",       =
"description":"A physical mailing address for this User, as described in =
(address Element). Canonical Type Values of work, home, and other. The =
value attribute is a complex type with the following =
sub-attributes.",

      

      
      =
"readOnly":false, 

      
   =
   "required":false,       =
"required":false,

      
   =
   "caseExact":false,       =
"caseExact":false,

      
   =
   "subAttributes":[       =
"subAttributes":[

      
   =
     {         {

      
   =
       "name":"formatted",           =
"name":"formatted",

      
   =
       "type":"string",           =
"type":"string",

      
   =
       "multiValued":false,           =
"multiValued":false,

      
   =
       "description":"The full mailing address, formatted for display or =
use with a mailing label. This attribute MAY contain =
newlines.",           =
"description":"The full mailing address, formatted for display or use =
with a mailing label. This attribute MAY contain newlines.",

      

      
          =
"readOnly":false, 

      
   =
       "required":false,           =
"required":false,

      

      
 =
         "caseExact":false =
            "caseExact" =
: false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
   =
     },         },

      
   =
     {         {

      
   =
       "name":"streetAddress",         =
  "name":"streetAddress",

      
   =
       "type":"string",           =
"type":"string",

      
   =
       "multiValued":false,           =
"multiValued":false,

      
   =
       "description":"The full street address component, which may =
include house number, street name, PO BOX, and multi-line extended =
street address information. This attribute MAY contain =
newlines.",           =
"description":"The full street address component, which may include =
house number, street name, PO BOX, and multi-line extended street =
address information. This attribute MAY contain newlines.",

      

      
          =
"readOnly":false, 

      
   =
       "required":false,           =
"required":false,

      

      
 =
         "caseExact":false =
            "caseExact" =
: false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
   =
     },         },

      
   =
     {         {

      
   =
       "name":"locality",           =
"name":"locality",

      
   =
       "type":"string",           =
"type":"string",

      
   =
       "multiValued":false,           =
"multiValued":false,

      
   =
       "description":"The city or locality component.", =
          "description":"The city or locality =
component.",

      

      
          =
"readOnly":false, 

      
   =
       "required":false,           =
"required":false,

      

      
 =
         "caseExact":false =
            "caseExact" =
: false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
   =
     },         },

      
   =
     {         {

      
   =
       "name":"region",           =
"name":"region",

      
   =
       "type":"string",           =
"type":"string",

      
   =
       "multiValued":false,           =
"multiValued":false,

      
   =
       "description":"The state or region component.",           "description":"The state or region =
component.",

      

      
          =
"readOnly":false, 

      
   =
       "required":false,           =
"required":false,

      

      
 =
         "caseExact":false =
            "caseExact" =
: false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
   =
     },         },

      
   =
     {         {

      
   =
       "name":"postalCode",           =
"name":"postalCode",

      
   =
       "type":"string",           =
"type":"string",

      
   =
       "multiValued":false,           =
"multiValued":false,

      
   =
       "description":"The zipcode or postal code component.", =
          "description":"The zipcode or postal =
code component.",

      

      
          =
"readOnly":false, 

      
   =
       "required":false,           =
"required":false,

      

      
 =
         "caseExact":false =
            "caseExact" =
: false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
   =
     },         },

      
   =
     {         {

      
   =
       "name":"country",           =
"name":"country",

      
   =
       "type":"string",           =
"type":"string",

      
   =
       "multiValued":false,           =
"multiValued":false,

      
   =
       "description":"The country name component.",           "description":"The country name =
component.",

      

      
          =
"readOnly":false, 

      
   =
       "required":false,           =
"required":false,

      

      
 =
         "caseExact":false =
            "caseExact" =
: false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
   =
     },         },

      
   =
     {         {

      
   =
       "name":"type",           =
"name":"type",

      
   =
       "type":"string",           =
"type":"string",

      
   =
       "multiValued":false,           =
"multiValued":false,

      
   =
       "description":"A label indicating the attribute's function; e.g., =
'work' or 'home'.",           =
"description":"A label indicating the attribute's function; e.g., 'work' =
or 'home'.",

      

      
             "required" : false,

      
             "caseExact" : false,

      
             "canonicalValues" : [

      
               "work",

      
               "home",

      
               "other"

      
             ],

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           }

      
         ],

      
         "mutability" : "readWrite\n",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
       },

      
       {

      
         "name" : "groups",

      
         "type" : "complex",

      
         "multiValued" : true,

      
         "description" : "A list of groups that the user =
belongs to, either thorough direct membership, nested groups, or =
dynamically calculated",

      
         "required" : false,

      
         "caseExact" : false,

      
         "subAttributes" : [

      
           {

      
             "name" : "value",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "The identifier of the =
User's group.",

      
   =
       "readOnly":false,           =
"readOnly":false,

      
   =
       "required":false,           =
"required":false,

      
   =
       "caseExact":false,           =
"caseExact":false,

      

      
 =
         "canonicalValues":["work","home","other"]=
             "mutability"=
 : "readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           },

      
           {

      
             "name" : "$ref",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "The URI of the =
corresponding Group resource to which the user belongs",

      
             "readOnly" : false,

      
             "required" : false,

      
             "caseExact" : false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           },

      
           {

      
             "name" : "display",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "A human readable name, =
primarily used for display purposes. READ-ONLY.",

      
             "readOnly" : true,

      
             "required" : false,

      
             "caseExact" : false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           },

      
           {

      
             "name" : "type",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "A label indicating the =
attribute's function; e.g., 'direct' or 'indirect'.",

      
             "readOnly" : false,

      
             "required" : false,

      
             "caseExact" : false,

      
             "canonicalValues" : [

      
               "direct",

      
               "indirect"

      
             ],

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           },

      
           {

      
             "name" : "primary",

      
             "type" : "boolean",

      
             "multiValued" : false,

      
             "description" : "A Boolean value indicating =
the 'primary' or preferred attribute value for this attribute. The =
primary attribute value 'true' MUST appear no more than =
once.",

      
             "readOnly" : false,

      
             "required" : false,

      
             "caseExact" : false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
   =
     }         }

      

      
 =
     ]  =
       ],

      
         "mutability" : "readOnly",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
       },

      
       {

      
         "name" : "entitlements",

      
         "type" : "complex",

      
         "multiValued" : true,

      
         "description" : "A list of entitlements for the =
User that represent a thing the User has.",

      
         "required" : false,

      
         "caseExact" : false,

      
         "subAttributes" : [

      
           {

      
             "name" : "value",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "The value of an =
entitlement.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           },

      
           {

      
             "name" : "display",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "A human readable name, =
primarily used for display purposes. READ-ONLY.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           },

      
           {

      
             "name" : "type",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "A label indicating the =
attribute's function.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "canonicalValues" : [],

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           },

      
           {

      
             "name" : "primary",

      
             "type" : "boolean",

      
             "multiValued" : false,

      
             "description" : "A Boolean value indicating =
the 'primary' or preferred attribute value for this attribute. The =
primary attribute value 'true' MUST appear no more than =
once.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           }

      
         ],

      
         "mutability" : "readWrite\n",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
       },

      
       {

      
         "name" : "roles",

      
         "type" : "complex",

      
         "multiValued" : true,

      
         "description" : "A list of roles for the User =
that collectively represent who the User is; e.g., 'Student', =
'Faculty'.",

      
         "required" : false,

      
         "caseExact" : false,

      
         "subAttributes" : [

      
           {

      
             "name" : "value",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "The value of a =
role.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           },

      
           {

      
             "name" : "display",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "A human readable name, =
primarily used for display purposes. READ-ONLY.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           },

      
           {

      
             "name" : "type",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "A label indicating the =
attribute's function.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "canonicalValues" : [],

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           },

      
           {

      
             "name" : "primary",

      
             "type" : "boolean",

      
             "multiValued" : false,

      
             "description" : "A Boolean value indicating =
the 'primary' or preferred attribute value for this attribute. The =
primary attribute value 'true' MUST appear no more than =
once.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           }

      
         ],

      
         "mutability" : "readWrite\n",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
       },

      
       {

      
         "name" : "x509Certificates",

      
         "type" : "complex",

      
         "multiValued" : true,

      
         "description" : "A list of certificates issued =
to the User.",

      
         "required" : false,

      
         "caseExact" : false,

      
         "subAttributes" : [

      
           {

      
             "name" : "value",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "The value of a X509 =
certificate.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           },

      
           {

      
             "name" : "display",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "A human readable name, =
primarily used for display purposes. READ-ONLY.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           },

      
           {

      
             "name" : "type",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "A label indicating the =
attribute's function.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "canonicalValues" : [],

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           },

      
           {

      
             "name" : "primary",

      
             "type" : "boolean",

      
             "multiValued" : false,

      
             "description" : "A Boolean value indicating =
the 'primary' or preferred attribute value for this attribute. The =
primary attribute value 'true' MUST appear no more than =
once.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           }

      
         ],

      
         "mutability" : "readWrite\n",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
   =
 }     }

      
  =
],   ],

      
  =
"meta": {   "meta": {

      
   =
 "resourceType": "Schema",     =
"resourceType": "Schema",

      
   =
 "created": "2010-01-23T04:56:22Z",    =
 "created": "2010-01-23T04:56:22Z",

      

      
 =
   "lastModified": =
"2011-05-13T04:42:34Z",       =
"lastModified" : =
"2014-02-04T00:00:00Z",

      
    "version": =
"W\/\"3694e05e9dff596\"",       "version" : =
"W/\"3694e05e9dff596\"",

      
    "location": =
"https://example.com/v1/Schemas/urn:scim:schemas:core:2.0:User"       "location" =
: =
"https://example.com/v2/Schemas/urn:scim:schemas:core:2.0:User"

      
  =
}   }

      

      
   },

      
   {

      
     "id" : =
"urn:scim:schemas:core:2.0:Group",

      
     "name" : "Group",

      
     "description" : "Core Group",

      
     "attributes" : [

      
       {

      
         "name" : "id",

      
         "type" : "string",

      
         "multiValued" : false,

      
         "description" : "Unique identifier for the SCIM =
resource as defined by the Service Provider. Each representation of the =
resource MUST include a non-empty id value. This identifier MUST be =
unique across the Service Provider's entire set of resources. It MUST be =
a stable, non-reassignable identifier that does not change when the same =
resource is returned in subsequent requests. The value of the id =
attribute is always issued by the Service Provider and MUST never be =
specified by the Service Consumer. REQUIRED.",

      
         "required" : true,

      
         "caseExact" : false,

      
         "mutability" : "readWrite",

      
         "returned" : "always",

      
         "uniqueness" : "server"

      
       },

      
       {

      
         "name" : "externalId",

      
         "type" : "string",

      
         "multiValued" : false,

      
         "description" : "An identifier for the Resource =
as defined by the Service Consumer.",

      
         "required" : true,

      
         "caseExact" : false,

      
         "mutability" : "readWrite",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
       },

      
       {

      
         "name" : "displayName",

      
         "type" : "string",

      
         "multiValued" : false,

      
         "description" : "A human readable name for the =
Group.  REQUIRED.",

      
         "required" : false,

      
         "caseExact" : false,

      
         "mutability" : "readWrite",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
       },

      
       {

      
         "name" : "members",

      
         "type" : "complex",

      
         "multiValued" : false,

      
         "description" : "A list of members of the =
Group.",

      
         "required" : false,

      
         "caseExact" : false,

      
         "subAttributes" : [

      
           {

      
             "name" : "value",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "The identifier of the =
member of this Group.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "mutability" : "immutable",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           },

      
           {

      
             "name" : "$ref",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "The URI of the =
corresponding to the member resource of this Group.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "mutability" : "immutable",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           },

      
           {

      
             "name" : "type",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "A label indicating the =
type of resource; e.g., 'User' or 'Group'.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "canonicalValues" : [

      
               "User",

      
               "Group"

      
             ],

      
             "mutability" : "immutable",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
} }

      

      
         ],

      
         "mutability" : "readWrite\n",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
       }

      
     ],

      
     "meta" : {

      
       "resourceType" : "Schema",

      
       "created" : =
"2010-01-23T04:56:22Z",

      
       "lastModified" : =
"2014-02-04T00:00:00Z",

      
       "version" : =
"W/\"3694e05e9dff596\"",

      
       "location" : =
"https://example.com/v2/Schemas/urn:scim:schemas:core:2.0:Group"

      
     }

      
   },

      
   {

      
     "id" : =
"urn:scim:schemas:extension:enterprise:2.0:User",

      
     "name" : "EnterpriseUser",

      
     "description" : "Enterprise User",

      
     "attributes" : [

      
       {

      
         "name" : "employeeNumber",

      
         "type" : "string",

      
         "multiValued" : false,

      
         "description" : "Numeric or alphanumeric =
identifier assigned to a person, typically based on order of hire or =
association with an organization.",

      
         "required" : false,

      
         "caseExact" : false,

      
         "mutability" : "readWrite\n",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
       },

      
       {

      
         "name" : "costCenter",

      
         "type" : "string",

      
         "multiValued" : false,

      
         "description" : "Identifies the name of a cost =
center.",

      
         "required" : false,

      
         "caseExact" : false,

      
         "mutability" : "readWrite\n",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
       },

      
       {

      
         "name" : "organization",

      
         "type" : "string",

      
         "multiValued" : false,

      
         "description" : "Identifies the name of an =
organization.",

      
         "required" : false,

      
         "caseExact" : false,

      
         "mutability" : "readWrite\n",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
       },

      
       {

      
         "name" : "division",

      
         "type" : "string",

      
         "multiValued" : false,

      
         "description" : "Identifies the name of a =
division.",

      
         "required" : false,

      
         "caseExact" : false,

      
         "mutability" : "readWrite\n",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
       },

      
       {

      
         "name" : "department",

      
         "type" : "string",

      
         "multiValued" : false,

      
         "description" : "Identifies the name of a =
department.",

      
         "required" : false,

      
         "caseExact" : false,

      
         "mutability" : "readWrite\n",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
       },

      
       {

      
         "name" : "manager",

      
         "type" : "complex",

      
         "multiValued" : false,

      
         "description" : "The User's manager. A complex =
type that optionally allows Service Providers to represent =
organizational hierarchy by referencing the \"id\" attribute of another =
User.",

      
         "required" : false,

      
         "caseExact" : false,

      
         "subAttributes" : [

      
           {

      
             "name" : "managerId",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "The id of the SCIM =
resource representing the User's  manager.  REQUIRED.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           },

      
           {

      
             "name" : "$ref",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "The URI of the SCIM =
resource representing the User's manager.  REQUIRED.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "mutability" : =
"readWrite\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           },

      
           {

      
             "name" : "displayName",

      
             "type" : "string",

      
             "multiValued" : false,

      
             "description" : "The displayName of the =
User's manager.  OPTIONAL and READ-ONLY.",

      
             "required" : false,

      
             "caseExact" : false,

      
             "mutability" : "readOnly\n",

      
             "returned" : "default",

      
             "uniqueness" : "none"

      
           }

      
         ],

      
         "mutability" : "readWrite\n",

      
         "returned" : "default",

      
         "uniqueness" : "none"

      
       }

      
     ],

      
     "meta" : {

      
       "resourceType" : "Schema",

      
       "created" : =
"2010-01-23T04:56:22Z",

      
       "lastModified" : =
"2014-02-04T00:00:00Z",

      
       "version" : =
"W/\"3694e05e9dff596\"",

      
       "location" : =
"https://example.com/v2/Schemas/urn:scim:schemas:extension:enterprise:2.0:=
User"

      
     }

      
   }

      
 ]}

      
                     =
                                                     

      
13. =
 Security Considerations 13.  Security =
Considerations

      
 

      
   =
The SCIM Core schema contains personally identifiable information =
as    The SCIM Core schema contains =
personally identifiable information as

      
   =
well as other sensitive data.  Aside from prohibiting password =
values    well as other sensitive =
data.  Aside from prohibiting password values

      
   =
in a SCIM response this specification does not provide any means =
or    in a SCIM response this =
specification does not provide any means or

      
   =
guarantee of confidentiality.    =
guarantee of confidentiality.

      
 

      
14. =
 References 14.  References

      
 

      

      
 =
  [PortableContacts] 14.1.  Normative =
References

      
              Smarr, J., =
"Portable Contacts 1.0 Draft C - Schema Only", 

      
              August =
2008. 

      
 

      
   [RFC2119]  Bradner, S., "Key =
words for use in RFCs to Indicate 

      
              Requirement =
Levels", BCP 14, RFC 2119, March 1997. 

      
 

      
14.2.  URIs =


      
 

      
   [1] =
http://json.org 

      
 

      
   [2] =
http://tools.ietf.org/html/rfc4627 

      
 

      
   [3] =
http://www.w3.org/TR/xmlschema-2/ 

      
 

      
   [4] =
http://tools.ietf.org/html/rfc4627#section-2.5 

      
 

      
   [5] =
http://tools.ietf.org/html/rfc4627#section-2.1 

      
 

      
   [6] =
http://tools.ietf.org/html/rfc4627#section-2.4 

      
 

      
   [7] =
http://tools.ietf.org/html/rfc4627#section-2.4 

      
 

      
   [8] =
http://www.w3.org/TR/xmlschema-2/#dateTime 

      
 

      
   [9] =
http://tools.ietf.org/html/rfc4627#section-2.5 

      
 

      
   [10] =
http://www.w3.org/TR/xmlschema-2/#base64Binary 

      
 

      

      
 =
  [11] =
http://tools.ietf.org/html/rfc4627#section-2.5    [ISO3166]  "ISO 3166:1988 =
(E/F) - Codes for the representation of

      
               names of countries - The International =
Organization for
               Standardization, 3rd edition", 08 =
1988.

      
 

      

      
 =
  [12] =
http://tools.ietf.org/html/rfc3986#section-5.2    [ISO639-2]

      
               ISO 639.2 Registration Authority, =
"ISO639-2: Codes for the

      
               Representation of Names of Languages", =
July 2013.

      
 

      

      
 =
  [13] =
http://tools.ietf.org/html/rfc4627#section-2.2    [Olson-TZ]

      
               "Sources for Time Zone and Daylight =
Saving Time Data", .

      
 

      

      
 =
  [14] =
http://tools.ietf.org/html/rfc4512    [RFC2119]  Bradner, S., "Key =
words for use in RFCs to Indicate

      
               Requirement Levels", BCP 14, RFC 2119, =
March 1997.

      
 

      

      
 =
  [15] =
http://www.loc.gov/standards/iso639-2/php/code_list.php =
   [RFC3966]  =
Schulzrinne, H., "The tel URI for Telephone Numbers", RFC

      
               3966, December 2004.

      
 

      

      
 =
  [16] =
http://www.iso.org/iso/country_codes/iso_3166_code_lists/ =
   [RFC3986]  =
Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform

      
        =
country_names_and_code_elements.htm               Resource =
Identifier (URI): Generic Syntax", STD 66, RFC

      
               3986, January 2005.

      
 

      

      
 =
  [17] =
http://www.loc.gov/standards/iso639-2/php/code_list.php =
   [RFC4627]  =
Crockford, D., "The application/json Media Type for

      
               JavaScript Object Notation (JSON)", RFC =
4627, July 2006.
 

      

      
 =
  [18] =
http://www.iso.org/iso/country_codes/iso_3166_code_lists/ =
   [XML-Schema]

      
        =
country_names_and_code_elements.htm               Biron, P. and A. =
Malhotra, "XML Schema Part 2: Datatypes

      
               Second Edition", October =
2004.

      
 

      

      
   [19] =
http://www.twinsun.com/tz/tz-link.htm 14.2.  Informative =
References

      
 

      

      
 =
  [20] =
http://tools.ietf.org/html/rfc3966    [PortableContacts]

      
               Smarr, J., "Portable Contacts 1.0 Draft C =
- Schema Only",

      
               August 2008.

      
 

      

      
 =
  [21] =
http://www.iso.org/iso/country_codes/iso_3166_code_lists/ =
   [RFC4512]  Zeilenga, =
K., "Lightweight Directory Access Protocol

      
        =
country_names_and_code_elements.htm               (LDAP): Directory =
Information Models", RFC 4512, June

      
               2006.

      
 

      
Appendix A.  Contributors Appendix A.  Contributors

      
 

      
   =
The SCIM Community would like to thank the following people for =
the    The SCIM Community would like =
to thank the following people for the

      
   =
work they've done in the research, formulation, drafting, =
editing,    work they've done in the =
research, formulation, drafting, editing,

      
   =
and support of this specification.    =
and support of this specification.

      
 

      
   =
   Morteza Ansari (morteza.ansari@cisco.com)       Morteza Ansari (morteza.ansari@cisco.com)

      
 

      
   =
   Sidharth Choudhury (schoudhury@salesforce.com)       Sidharth Choudhury =
(schoudhury@salesforce.com)

      
 

      
   =
   Samuel Erdtman (samuel@erdtman.se)  =
     Samuel Erdtman (samuel@erdtman.se)

      
 

      
   =
   Kelly Grizzle (kelly.grizzle@sailpoint.com)       Kelly Grizzle =
(kelly.grizzle@sailpoint.com)

      
 

      
   =
   Chris Phillips (cjphillips@gmail.com)       Chris Phillips (cjphillips@gmail.com)

      
 

      
   =
   Erik Wahlstroem (erik.wahlstrom@nexussafe.com)       Erik Wahlstroem =
(erik.wahlstrom@nexussafe.com)

      
 

      

      
       Phil Hunt (phil.hunt@yahoo.com)

      
                     =
                                                     

      
   =
Special thanks to Joeseph Smarr, who's excellent work on the =
Portable    Special thanks to Joeseph =
Smarr, who's excellent work on the Portable

      
   =
Contacts Specification [PortableContacts] provided a basis for =
the    Contacts Specification =
[PortableContacts] provided a basis for the

      
   =
SCIM schema structure and text.    =
SCIM schema structure and text.

      
 

      

      
 Appendix B.  Change Log

      
 

      
    [[This section to be removed prior to publication as =
an RFC]]

      
 

      
    Draft 02 - KG - Addition of schema =
extensibility

      
 

      
    Draft 03 - PH - Revisions based on following =
tickets:

      
 

      
       09 - Attribute uniquenes

      
 

      
       10 - Returnability of attributes

      
 

      
       35 - Attribute mutability (replaces =
readOnly)

      
 

      
       52 - Minor textual changes

      
 

      
       53 - Standard use of term client (some was =
consumer)

      
 

      
       56 - Make manager attribute consistent with other =
$ref attrs

      
 

      
       58 - Add optional id to ResourceType objects for =
consistency

      
 

      
       59 - Fix capitalization per IETF editor =
practices

      
 

      
       60 - Changed <eref> tags to normal =
<xref> and <reference> tags

      
                     =
                                                     

      
Authors' Addresses Authors' Addresses

      
 

      
   =
Chuck Mortimore (editor)    Chuck =
Mortimore (editor)

      
   =
Salesforce.com    =
Salesforce.com

      
 

      
   =
Email: cmortimore@salesforce.com    =
Email: cmortimore@salesforce.com

      

      
                     =
                                                     

      
    Kelly Grizzle

      
    SailPoint

      
 

      
    Email: kelly.grizzle@sailpoint.com

      
                     =
                                                     

      
   =
Patrick Harding    Patrick =
Harding

      
   =
Ping Identity    Ping Identity

      
 

      
   =
Email: pharding@pingidentity.com    =
Email: pharding@pingidentity.com

      

      
                                 =
                                         

      
   =
Paul Madsen    Paul Madsen

      
   =
Ping Identity    Ping Identity

      
 

      
   =
Email: pmadsen@pingidentity.com    =
Email: pmadsen@pingidentity.com

      
 

      
   =
Trey Drake    Trey Drake

      
   =
UnboundID    UnboundID

      
 

      
   =
Email: trey.drake@unboundid.com    =
Email: trey.drake@unboundid.com


     
 

     
 End of changes. 214 change =
blocks. 

     
442 lines changed or =
deleted 1447 lines changed or =
added

     

This =
html diff was produced by rfcdiff 1.41. The latest version is available =
from http://tools.ietf.org/tools/rfcdiff/ 

   

   
   

--Apple-Mail=_9FD4E9DF-4C58-462A-8317-37413A5F3BBA
Content-Transfer-Encoding: 7bit
Content-Type: text/html;
	charset=us-ascii



--Apple-Mail=_9FD4E9DF-4C58-462A-8317-37413A5F3BBA
Content-Disposition: attachment;
	filename=draft-ietf-scim-api-02-03.diff.txt.html
Content-Type: text/html;
	name="draft-ietf-scim-api-02-03.diff.txt.html"
Content-Transfer-Encoding: 7bit


 
 
 
 
 
 
 
 
   
   
  Diff: draft-ietf-scim-api-02.txt - draft-ietf-scim-api-03.txt 
   
 
 
  
 
  
< draft-ietf-scim-api-02.txt   draft-ietf-scim-api-03.txt >
 
      
 

      
Network Working Group                                      T. Drake, Ed. Network Working Group                                      T. Drake, Ed.

      
Internet-Draft                                                 UnboundID Internet-Draft                                                 UnboundID

      
Intended status: Standards Track                            C. Mortimore Intended status: Standards Track                            C. Mortimore

      

      
Expires: March 3, 2014                                        SalesForce Expires: August 15, 2014                                      SalesForce

      
                                                               M. Ansari                                                                M. Ansari

      
                                                                   Cisco                                                                    Cisco

      
                                                              K. Grizzle                                                               K. Grizzle

      
                                                               SailPoint                                                                SailPoint

      
                                                           E. Wahlstroem                                                            E. Wahlstroem

      
                                                        Technology Nexus                                                         Technology Nexus

      

      
                                                         August 30, 2013                                                        February 11, 2014

      
 

      
          System for Cross-Domain Identity Management:Protocol           System for Cross-Domain Identity Management:Protocol

      

      
                         draft-ietf-scim-api-02                          draft-ietf-scim-api-03

      
 

      
Abstract Abstract

      
 

      
   The System for Cross-Domain Identity Management (SCIM) specification    The System for Cross-Domain Identity Management (SCIM) specification

      
   is designed to make managing user identity in cloud based    is designed to make managing user identity in cloud based

      
   applications and services easier.  The specification suite seeks to    applications and services easier.  The specification suite seeks to

      
   build upon experience with existing schemas and deployments, placing    build upon experience with existing schemas and deployments, placing

      
   specific emphasis on simplicity of development and integration, while    specific emphasis on simplicity of development and integration, while

      
   applying existing authentication, authorization, and privacy models.    applying existing authentication, authorization, and privacy models.

      
   It's intent is to reduce the cost and complexity of user management    It's intent is to reduce the cost and complexity of user management

      
 

      
skipping to change at page 1, line 47 skipping to change at page 1, line 47

      
   Internet-Drafts are working documents of the Internet Engineering    Internet-Drafts are working documents of the Internet Engineering

      
   Task Force (IETF).  Note that other groups may also distribute    Task Force (IETF).  Note that other groups may also distribute

      
   working documents as Internet-Drafts.  The list of current Internet-    working documents as Internet-Drafts.  The list of current Internet-

      
   Drafts is at http://datatracker.ietf.org/drafts/current/.    Drafts is at http://datatracker.ietf.org/drafts/current/.

      
 

      
   Internet-Drafts are draft documents valid for a maximum of six months    Internet-Drafts are draft documents valid for a maximum of six months

      
   and may be updated, replaced, or obsoleted by other documents at any    and may be updated, replaced, or obsoleted by other documents at any

      
   time.  It is inappropriate to use Internet-Drafts as reference    time.  It is inappropriate to use Internet-Drafts as reference

      
   material or to cite them other than as "work in progress."    material or to cite them other than as "work in progress."

      
 

      

      
   This Internet-Draft will expire on March 3, 2014.    This Internet-Draft will expire on August 15, 2014.

      
 

      
Copyright Notice Copyright Notice

      
 

      

      
   Copyright (c) 2013 IETF Trust and the persons identified as the    Copyright (c) 2014 IETF Trust and the persons identified as the

      
   document authors.  All rights reserved.    document authors.  All rights reserved.

      
 

      
   This document is subject to BCP 78 and the IETF Trust's Legal    This document is subject to BCP 78 and the IETF Trust's Legal

      
   Provisions Relating to IETF Documents    Provisions Relating to IETF Documents

      
   (http://trustee.ietf.org/license-info) in effect on the date of    (http://trustee.ietf.org/license-info) in effect on the date of

      
   publication of this document.  Please review these documents    publication of this document.  Please review these documents

      
   carefully, as they describe your rights and restrictions with respect    carefully, as they describe your rights and restrictions with respect

      
   to this document.  Code Components extracted from this document must    to this document.  Code Components extracted from this document must

      
   include Simplified BSD License text as described in Section 4.e of    include Simplified BSD License text as described in Section 4.e of

      
   the Trust Legal Provisions and are provided without warranty as    the Trust Legal Provisions and are provided without warranty as

      
 

      
skipping to change at page 2, line 33 skipping to change at page 2, line 33

      
     1.1.  Intended Audience . . . . . . . . . . . . . . . . . . . .   3      1.1.  Intended Audience . . . . . . . . . . . . . . . . . . . .   3

      
     1.2.  Notational Conventions  . . . . . . . . . . . . . . . . .   3      1.2.  Notational Conventions  . . . . . . . . . . . . . . . . .   3

      
     1.3.  Definitions . . . . . . . . . . . . . . . . . . . . . . .   3      1.3.  Definitions . . . . . . . . . . . . . . . . . . . . . . .   3

      
   2.  Authentication and Authorization  . . . . . . . . . . . . . .   3    2.  Authentication and Authorization  . . . . . . . . . . . . . .   3

      
   3.  API . . . . . . . . . . . . . . . . . . . . . . . . . . . . .   4    3.  API . . . . . . . . . . . . . . . . . . . . . . . . . . . . .   4

      
     3.1.  Creating Resources  . . . . . . . . . . . . . . . . . . .   6      3.1.  Creating Resources  . . . . . . . . . . . . . . . . . . .   6

      
       3.1.1.  Resource Types  . . . . . . . . . . . . . . . . . . .   7        3.1.1.  Resource Types  . . . . . . . . . . . . . . . . . . .   7

      
     3.2.  Retrieving Resources  . . . . . . . . . . . . . . . . . .   7      3.2.  Retrieving Resources  . . . . . . . . . . . . . . . . . .   7

      
       3.2.1.  Retrieving a known Resource . . . . . . . . . . . . .   7        3.2.1.  Retrieving a known Resource . . . . . . . . . . . . .   7

      
       3.2.2.  List/Query Resources  . . . . . . . . . . . . . . . .   9        3.2.2.  List/Query Resources  . . . . . . . . . . . . . . . .   9

      

      
       3.2.3.  Querying Resources Using HTTP POST  . . . . . . . . .  16        3.2.3.  Querying Resources Using HTTP POST  . . . . . . . . .  17

      
     3.3.  Modifying Resources . . . . . . . . . . . . . . . . . . .  19      3.3.  Modifying Resources . . . . . . . . . . . . . . . . . . .  19

      
       3.3.1.  Modifying with PUT  . . . . . . . . . . . . . . . . .  20        3.3.1.  Modifying with PUT  . . . . . . . . . . . . . . . . .  20

      
       3.3.2.  Modifying with PATCH  . . . . . . . . . . . . . . . .  21        3.3.2.  Modifying with PATCH  . . . . . . . . . . . . . . . .  21

      
     3.4.  Deleting Resources  . . . . . . . . . . . . . . . . . . .  29      3.4.  Deleting Resources  . . . . . . . . . . . . . . . . . . .  29

      
     3.5.  Bulk  . . . . . . . . . . . . . . . . . . . . . . . . . .  30      3.5.  Bulk  . . . . . . . . . . . . . . . . . . . . . . . . . .  30

      
     3.6.  Data Input/Output Formats . . . . . . . . . . . . . . . .  45      3.6.  Data Input/Output Formats . . . . . . . . . . . . . . . .  45

      
     3.7.  Additional retrieval query parameters . . . . . . . . . .  46      3.7.  Additional retrieval query parameters . . . . . . . . . .  46

      
     3.8.  Attribute Notation  . . . . . . . . . . . . . . . . . . .  47      3.8.  Attribute Notation  . . . . . . . . . . . . . . . . . . .  47

      
     3.9.  HTTP Response Codes . . . . . . . . . . . . . . . . . . .  47      3.9.  HTTP Response Codes . . . . . . . . . . . . . . . . . . .  47

      

      
     3.10. API Versioning  . . . . . . . . . . . . . . . . . . . . .  50      3.10. API Versioning  . . . . . . . . . . . . . . . . . . . . .  49

      
     3.11. Versioning Resources  . . . . . . . . . . . . . . . . . .  50      3.11. Versioning Resources  . . . . . . . . . . . . . . . . . .  49

      
     3.12. HTTP Method Overloading . . . . . . . . . . . . . . . . .  52      3.12. HTTP Method Overloading . . . . . . . . . . . . . . . . .  51

      
   4.  Multi-Tenancy . . . . . . . . . . . . . . . . . . . . . . . .  52    4.  Multi-Tenancy . . . . . . . . . . . . . . . . . . . . . . . .  51

      
     4.1.  Associating Consumers to Tenants  . . . . . . . . . . . .  53      4.1.  Associating Clients to Tenants  . . . . . . . . . . . . .  52

      
       4.1.1.  URL Prefix Example  . . . . . . . . . . . . . . . . .  53        4.1.1.  URL Prefix Example  . . . . . . . . . . . . . . . . .  53

      
       4.1.2.  Subdomain Example . . . . . . . . . . . . . . . . . .  53        4.1.2.  Subdomain Example . . . . . . . . . . . . . . . . . .  53

      

      
       4.1.3.  HTTP Header . . . . . . . . . . . . . . . . . . . . .  54        4.1.3.  HTTP Header . . . . . . . . . . . . . . . . . . . . .  53

      
     4.2.  SCIM Identifiers with Multiple Tenants  . . . . . . . . .  54      4.2.  SCIM Identifiers with Multiple Tenants  . . . . . . . . .  53

      
   5.  Security Considerations . . . . . . . . . . . . . . . . . . .  54    5.  Security Considerations . . . . . . . . . . . . . . . . . . .  53

      
   6.  Contributors  . . . . . . . . . . . . . . . . . . . . . . . .  54    6.  References  . . . . . . . . . . . . . . . . . . . . . . . . .  53

      
   7.  Acknowledgments . . . . . . . . . . . . . . . . . . . . . . .  54      6.1.  Normative References  . . . . . . . . . . . . . . . . . .  54

      
     8.1.  URIs  . . . . . . . . . . . . . . . . . . . . . . . . . .  55      6.2.  Informative References  . . . . . . . . . . . . . . . . .  54

      
    Appendix A.  Contributors . . . . . . . . . . . . . . . . . . . .  55

      
    Appendix B.  Acknowledgments  . . . . . . . . . . . . . . . . . .  55

      
    Appendix C.  Change Log . . . . . . . . . . . . . . . . . . . . .  55

      
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  55    Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  55

      
 

      
1.  Introduction and Overview 1.  Introduction and Overview

      
 

      
   The SCIM Protocol is an application-level, REST protocol for    The SCIM Protocol is an application-level, REST protocol for

      
   provisioning and managing identity data on the web.  The protocol    provisioning and managing identity data on the web.  The protocol

      
   supports creation, modification, retrieval, and discovery of core    supports creation, modification, retrieval, and discovery of core

      

      
   identity Resources; i.e., Users and Groups, as well as custom    identity resources; i.e., Users and Groups, as well as custom

      
   Resource extensions.    resource extensions.

      
 

      
1.1.  Intended Audience 1.1.  Intended Audience

      
 

      
   This document is intended as a guide to SCIM API usage for both    This document is intended as a guide to SCIM API usage for both

      

      
   identity Service Providers and Consumers.    identity service providers and clients.

      
 

      
1.2.  Notational Conventions 1.2.  Notational Conventions

      
 

      
   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",    The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",

      
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this    "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this

      
   document are to be interpreted as described in [RFC2119].  These    document are to be interpreted as described in [RFC2119].  These

      
   keywords are capitalized when used to unambiguously specify    keywords are capitalized when used to unambiguously specify

      
   requirements of the protocol or application features and behavior    requirements of the protocol or application features and behavior

      
   that affect the interoperability and security of implementations.    that affect the interoperability and security of implementations.

      
   When these words are not capitalized, they are meant in their    When these words are not capitalized, they are meant in their

      
   natural-language sense.    natural-language sense.

      
 

      
   For purposes of readability examples are not URL encoded.    For purposes of readability examples are not URL encoded.

      

      
   Implementers MUST percent encode URLs as described in RFC3896 2.1    Implementers MUST percent encode URLs as described in Section 2.1

      
   [1].    [RFC3896].

      
 

      
1.3.  Definitions 1.3.  Definitions

      
 

      
   Base URL:  The SCIM REST API is always relative to a Base URL.  The    Base URL:  The SCIM REST API is always relative to a Base URL.  The

      

      
      Base URL MUST NOT contain a query string as Consumers may append       Base URL MUST NOT contain a query string as clients may append

      
      additional path information and query parameters as part of       additional path information and query parameters as part of

      

      
      forming the request.  Example: https://example.com/scim/v1/       forming the request.  Example: https://example.com/scim/v2/

      
 

      
2.  Authentication and Authorization 2.  Authentication and Authorization

      
 

      
   The SCIM protocol does not define a scheme for authentication and    The SCIM protocol does not define a scheme for authentication and

      
   authorization therefore implementers are free to choose mechanisms    authorization therefore implementers are free to choose mechanisms

      
   appropriate to their use cases.  The choice of authentication    appropriate to their use cases.  The choice of authentication

      
   mechanism will impact interoperability.  It is RECOMMENDED that    mechanism will impact interoperability.  It is RECOMMENDED that

      
   clients be implemented in such a way that new authentication schemes    clients be implemented in such a way that new authentication schemes

      
   can be deployed.  Implementers SHOULD support existing authentication    can be deployed.  Implementers SHOULD support existing authentication

      

      
   /authorization schemes.  In particular, OAuth2 Bearer Token [2] is    /authorization schemes.  In particular, OAuth2[RFC6750] is

      
   RECOMMENDED.  Appropriate security considerations of the selected    RECOMMENDED.  Appropriate security considerations of the selected

      
   authentication and authorization schemes SHOULD be taken.  Because    authentication and authorization schemes SHOULD be taken.  Because

      
   this protocol uses HTTP response status codes as the primary means of    this protocol uses HTTP response status codes as the primary means of

      
   reporting the result of a request, servers are advised to respond to    reporting the result of a request, servers are advised to respond to

      
   unauthorized or unauthenticated requests using the 401 response code    unauthorized or unauthenticated requests using the 401 response code

      

      
   in accordance with section 10.4.2 of RFC2616 [3].    in accordance with section 10.4.2 of Section 10.4.2 [RFC2616].

      
 

      

      
   All examples assume OAuth2 bearer token; e.g.,    All examples assume OAuth2 bearer token [RFC6750]; e.g.,

      
 

      
   GET /Users/2819c223-7f76-453a-919d-413861904646 HTTP/1.1    GET /Users/2819c223-7f76-453a-919d-413861904646 HTTP/1.1

      
   Host: example.com    Host: example.com

      
   Authorization: Bearer h480djs93hd8    Authorization: Bearer h480djs93hd8

      
 

      
   The context of the request (i.e. the user for whom data is being    The context of the request (i.e. the user for whom data is being

      

      
   requested) MUST be inferred by Service Providers.    requested) MUST be inferred by service providers.

      
 

      
3.  API 3.  API

      
 

      
   The SCIM protocol specifies well known endpoints and HTTP methods for    The SCIM protocol specifies well known endpoints and HTTP methods for

      

      
   managing Resources defined in the core schema; i.e., User and Group    managing resources defined in the core schema; i.e., "User" and

      
   Resources correspond to /Users and /Groups respectively.  Service    "Group" resources correspond to "/Users" and "/Groups" respectively.

      
   Providers that support extended Resources SHOULD define Resource    Service providers that support extended resources SHOULD define

      
   endpoints using the established convention; pluralize the Resource    resource endpoints using the established convention; pluralize the

      
   name defined in the extended schema by appending an 's'.  Given there    resource name defined in the extended schema by appending an 's'.

      
   are cases where Resource pluralization is ambiguous; e.g., a Resource    Given there are cases where resource pluralization is ambiguous;

      
   named 'person' is legitimately 'persons' and 'people' Consumers    e.g., a resource named "Person" is legitimately "Persons" and

      
   SHOULD discover Resource endpoints via the Resource Type attribute    "People" clients SHOULD discover resource endpoints via the "/

      
   'endpoint'.    ResourceTypes" endpoint .

      
 

      

      
   GET  Retrieves a complete or partial Resource.    GET  Retrieves a complete or partial resource.

      
 

      

      
   POST  Create new Resource, perform an extended Search, or bulk modify    POST  Create new resource, perform an extended Search, or bulk modify

      
      Resources.       resources.

      
 

      

      
   PUT  Modifies a Resource with a complete, Consumer specified Resource    PUT  Modifies a resource with a complete, client specified resource

      
      (replace).       (replace).

      
 

      

      
   PATCH  Modifies a Resource with a set of Consumer specified changes    PATCH  Modifies a resource with a set of client specified changes

      
      (partial update).       (partial update).

      
 

      

      
   DELETE  Deletes a Resource.    DELETE  Deletes a resource.

      
 

      
   +------------+--------------------+---------------+-----------------+    +------------+--------------------+---------------+-----------------+

      
   | Resource   | Endpoint           | Operations    | Description     |    | Resource   | Endpoint           | Operations    | Description     |

      
   +------------+--------------------+---------------+-----------------+    +------------+--------------------+---------------+-----------------+

      
   | User       | /Users             | GET (Section  | Retrieve/Add/Mo |    | User       | /Users             | GET (Section  | Retrieve/Add/Mo |

      
   |            |                    | 3.2.1), POST  | dify Users      |    |            |                    | 3.2.1), POST  | dify Users      |

      
   |            |                    | (Section      |                 |    |            |                    | (Section      |                 |

      
   |            |                    | 3.1), PUT     |                 |    |            |                    | 3.1), PUT     |                 |

      
   |            |                    | (Section      |                 |    |            |                    | (Section      |                 |

      
   |            |                    | 3.3.1), PATCH |                 |    |            |                    | 3.3.1), PATCH |                 |

      
 

      
skipping to change at page 5, line 29 skipping to change at page 5, line 29

      
   |            |                    | 3.2.1), POST  | dify Groups     |    |            |                    | 3.2.1), POST  | dify Groups     |

      
   |            |                    | (Section      |                 |    |            |                    | (Section      |                 |

      
   |            |                    | 3.1), PUT     |                 |    |            |                    | 3.1), PUT     |                 |

      
   |            |                    | (Section      |                 |    |            |                    | (Section      |                 |

      
   |            |                    | 3.3.1), PATCH |                 |    |            |                    | 3.3.1), PATCH |                 |

      
   |            |                    | (Section      |                 |    |            |                    | (Section      |                 |

      
   |            |                    | 3.3.2),       |                 |    |            |                    | 3.3.2),       |                 |

      
   |            |                    | DELETE        |                 |    |            |                    | DELETE        |                 |

      
   |            |                    | (Section 3.4) |                 |    |            |                    | (Section 3.4) |                 |

      
   | Service    | /ServiceProviderCo | GET (Section  | Retrieve the    |    | Service    | /ServiceProviderCo | GET (Section  | Retrieve the    |

      

      
   | Provider C | nfigs              | 3.2.1)        | Service         |    | Provider C | nfigs              | 3.2.1)        | service         |

      
   | onfigurati |                    |               | Provider's      |    | onfigurati |                    |               | provider's      |

      
   | on         |                    |               | Configuration   |    | on         |                    |               | configuration   |

      
   | Resource   | /ResourceTypes     | GET (Section  | Retrieve the    |    | Resource   | /ResourceTypes     | GET (Section  | Retrieve the    |

      
   | Type       |                    | 3.2.1)        | supported       |    | Type       |                    | 3.2.1)        | supported       |

      

      
   |            |                    |               | Resource Types  |    |            |                    |               | resource types  |

      
   | Schema     | /Schemas           | GET (Section  | Retrieve a      |    | Schema     | /Schemas           | GET (Section  | Retrieve a      |

      

      
   |            |                    | 3.2.1)        | Resource's      |    |            |                    | 3.2.1)        | resource's      |

      
   |            |                    |               | Schema          |    |            |                    |               | schema          |

      
   | Bulk       | /Bulk              | POST (Section | Bulk modify     |    | Bulk       | /Bulk              | POST (Section | Bulk modify     |

      

      
   |            |                    | 3.5)          | Resources       |    |            |                    | 3.5)          | resources       |

      
   | Search     | [prefix]/.search   | POST (Section | Perform a       |    | Search     | [prefix]/.search   | POST (Section | Perform a       |

      
   |            |                    | 3.2.3)        | search at       |    |            |                    | 3.2.3)        | search at       |

      
   |            |                    |               | system root or  |    |            |                    |               | system root or  |

      
   |            |                    |               | within a        |    |            |                    |               | within a        |

      
   |            |                    |               | resource        |    |            |                    |               | resource        |

      
   |            |                    |               | endpoint for    |    |            |                    |               | endpoint for    |

      
   |            |                    |               | one or more     |    |            |                    |               | one or more     |

      
   |            |                    |               | resource types  |    |            |                    |               | resource types  |

      
   |            |                    |               | using POST.     |    |            |                    |               | using POST.     |

      
   +------------+--------------------+---------------+-----------------+    +------------+--------------------+---------------+-----------------+

      
 

      
                        Table 1: Defined endpoints                         Table 1: Defined endpoints

      
 

      

      
   All requests to the Service Provider are made via HTTP operations [4]    All requests to the service provider are made via Section 9 [RFC2616]

      
   on a URL derived from the Base URL.  Responses are returned in the    on a URL derived from the Base URL.  Responses are returned in the

      
   body of the HTTP response, formatted as JSON.  Response and error    body of the HTTP response, formatted as JSON.  Response and error

      
   codes SHOULD be transmitted via the HTTP status code of the response    codes SHOULD be transmitted via the HTTP status code of the response

      
   (if possible), and SHOULD also be specified in the body of the    (if possible), and SHOULD also be specified in the body of the

      
   response.    response.

      
 

      
3.1.  Creating Resources 3.1.  Creating Resources

      
 

      

      
   To create new Resources, clients send POST requests to the Resource    To create new resources, clients send POST requests to the resource

      
   endpoint; i.e., /Users or /Groups.    endpoint; i.e., "/Users" or "/Groups".

      
 

      

      
   Successful Resource creation is indicated with a 201 ("Created")    Successful resource creation is indicated with a 201 ("Created")

      
   response code.  Upon successful creation, the response body MUST    response code.  Upon successful creation, the response body MUST

      

      
   contain the newly created Resource.  Since the server is free to    contain the newly created resource.  Since the server is free to

      
   alter and/or ignore POSTed content, returning the full representation    alter and/or ignore POSTed content, returning the full representation

      
   can be useful to the client, enabling it to correlate the client and    can be useful to the client, enabling it to correlate the client and

      

      
   server views of the new Resource.  When a Resource is created, its    server views of the new resource.  When a resource is created, its

      
   URI must be returned in the response Location header.    URI must be returned in the response Location header.

      
 

      

      
   If the Service Provider determines creation of the requested Resource    If the service provider determines creation of the requested resource

      
   conflicts with existing resources; e.g., a User Resource with a    conflicts with existing resources; e.g., a "User" resource with a

      
   duplicate userName, the Service Provider MUST return a 409 error and    duplicate "username", the service provider MUST return a 409 error

      
   SHOULD indicate the conflicting attribute(s) in the body of the    and SHOULD indicate the conflicting attribute(s) in the body of the

      
   response.    response.

      
 

      

      
   Below, the client sends a POST request containing a User    Below, the client sends a POST request containing a user

      
 

      
   POST /Users  HTTP/1.1    POST /Users  HTTP/1.1

      
   Host: example.com    Host: example.com

      
   Accept: application/json    Accept: application/json

      
   Content-Type: application/json    Content-Type: application/json

      
   Authorization: Bearer h480djs93hd8    Authorization: Bearer h480djs93hd8

      
   Content-Length: ...    Content-Length: ...

      
 

      
   {    {

      
     "schemas":["urn:scim:schemas:core:2.0:User"],      "schemas":["urn:scim:schemas:core:2.0:User"],

      
     "userName":"bjensen",      "userName":"bjensen",

      
     "externalId":"bjensen",      "externalId":"bjensen",

      
     "name":{      "name":{

      
       "formatted":"Ms. Barbara J Jensen III",        "formatted":"Ms. Barbara J Jensen III",

      
       "familyName":"Jensen",        "familyName":"Jensen",

      
       "givenName":"Barbara"        "givenName":"Barbara"

      
     }      }

      
   }    }

      
   The server signals a successful creation with a status code of 201.    The server signals a successful creation with a status code of 201.

      
   The response includes a Location header indicating the User URI, and    The response includes a Location header indicating the User URI, and

      

      
   a representation of that User in the body of the response.    a representation of that user in the body of the response.

      
 

      
HTTP/1.1 201 Created HTTP/1.1 201 Created

      
Content-Type: application/json Content-Type: application/json

      

      
Location: https://example.com/v1/Users/2819c223-7f76-453a-919d-413861904646 Location: https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646

      
ETag: W/"e180ee84f0671b1" ETag: W/"e180ee84f0671b1"

      
 

      
{ {

      
  "schemas":["urn:scim:schemas:core:2.0:User"],   "schemas":["urn:scim:schemas:core:2.0:User"],

      
  "id":"2819c223-7f76-453a-919d-413861904646",   "id":"2819c223-7f76-453a-919d-413861904646",

      
  "externalId":"bjensen",   "externalId":"bjensen",

      
  "meta":{   "meta":{

      
    "resourceType":"User",     "resourceType":"User",

      
    "created":"2011-08-01T21:32:44.882Z",     "created":"2011-08-01T21:32:44.882Z",

      
    "lastModified":"2011-08-01T21:32:44.882Z",     "lastModified":"2011-08-01T21:32:44.882Z",

      

      
    "location":"https://example.com/v1/Users/2819c223-7f76-453a-919d-413861904646",     "location":"https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646",

      
    "version":"W\/\"e180ee84f0671b1\""     "version":"W\/\"e180ee84f0671b1\""

      
  },   },

      
  "name":{   "name":{

      
    "formatted":"Ms. Barbara J Jensen III",     "formatted":"Ms. Barbara J Jensen III",

      
    "familyName":"Jensen",     "familyName":"Jensen",

      
    "givenName":"Barbara"     "givenName":"Barbara"

      
  },   },

      
  "userName":"bjensen"   "userName":"bjensen"

      
} }

      
 

      
3.1.1.  Resource Types 3.1.1.  Resource Types

      
 

      
   When adding a resource to a specific endpoint, the meta attribute    When adding a resource to a specific endpoint, the meta attribute

      

      
   "resourceType" SHALL be set by the Service Provider to the    "resourceType" SHALL be set by the service provider to the

      
   corresponding Resource Type for the endpoint.  For example, "/Users"    corresponding resource Type for the endpoint.  For example, "/Users"

      
   will set "resourceType" to "User", and "/Groups" will set    will set "resourceType" to "User", and "/Groups" will set

      
   "resourceType" to "Group".    "resourceType" to "Group".

      
 

      
3.2.  Retrieving Resources 3.2.  Retrieving Resources

      
 

      

      
   Users and Group Resources are retrieved via opaque, unique URLs or    "User" and "Group" resources are retrieved via opaque, unique URLs or

      
   via Query.  Service Providers MAY choose to respond with a sub-set of    via Query.  Service providers MAY choose to respond with a sub-set of

      
   Resource attributes, though MUST minimally return the Resource id and    resource attributes, though MUST minimally return the resource id and

      
   meta attributes.    meta attributes.

      
 

      
3.2.1.  Retrieving a known Resource 3.2.1.  Retrieving a known Resource

      
 

      

      
   To retrieve a known Resource, clients send GET requests to the    To retrieve a known resource, clients send GET requests to the

      
   Resource endpoint; e.g., /Users/{id} or /Groups/{id}.    resource endpoint; e.g., "/Users/{id}" or "/Groups/{id}".

      
 

      

      
   If the Resource exists the server responds with a status code of 200    If the resource exists the server responds with a status code of 200

      
   and includes the result in the body of the response.    and includes the result in the body of the response.

      
 

      

      
   The below example retrieves a single User via the /Users endpoint.    The below example retrieves a single User via the "/Users" endpoint.

      
 

      
   GET /Users/2819c223-7f76-453a-919d-413861904646    GET /Users/2819c223-7f76-453a-919d-413861904646

      
   Host: example.com    Host: example.com

      
   Accept: application/json    Accept: application/json

      
   Authorization: Bearer h480djs93hd8    Authorization: Bearer h480djs93hd8

      
 

      
   The server responds with:    The server responds with:

      
 

      
HTTP/1.1 200 OK HTTP/1.1 200 OK

      
Content-Type: application/json Content-Type: application/json

      

      
Location: https://example.com/v1/Users/2819c223-7f76-453a-919d-413861904646 Location: https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646

      
ETag: W/"f250dd84f0671c3" ETag: W/"f250dd84f0671c3"

      
 

      
{ {

      
  "schemas":["urn:scim:schemas:core:2.0:User"],   "schemas":["urn:scim:schemas:core:2.0:User"],

      
  "id":"2819c223-7f76-453a-919d-413861904646",   "id":"2819c223-7f76-453a-919d-413861904646",

      
  "externalId":"bjensen",   "externalId":"bjensen",

      
  "meta":{   "meta":{

      
    "resourceType":"User",     "resourceType":"User",

      
    "created":"2011-08-01T18:29:49.793Z",     "created":"2011-08-01T18:29:49.793Z",

      
    "lastModified":"2011-08-01T18:29:49.793Z",     "lastModified":"2011-08-01T18:29:49.793Z",

      

      
    "location":"https://example.com/v1/Users/2819c223-7f76-453a-919d-413861904646",     "location":"https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646",

      
    "version":"W\/\"f250dd84f0671c3\""     "version":"W\/\"f250dd84f0671c3\""

      
  },   },

      
  "name":{   "name":{

      
    "formatted":"Ms. Barbara J Jensen III",     "formatted":"Ms. Barbara J Jensen III",

      
    "familyName":"Jensen",     "familyName":"Jensen",

      
    "givenName":"Barbara"     "givenName":"Barbara"

      
  },   },

      
  "userName":"bjensen",   "userName":"bjensen",

      
  "phoneNumbers":[   "phoneNumbers":[

      
    {     {

      
 

      
skipping to change at page 9, line 40 skipping to change at page 9, line 4

      
      "type":"work"       "type":"work"

      
    }     }

      
  ],   ],

      
  "emails":[   "emails":[

      
    {     {

      
      "value":"bjensen@example.com",       "value":"bjensen@example.com",

      
      "type":"work"       "type":"work"

      
    }     }

      
  ]   ]

      
} }

      

      
                                                                          

      
3.2.2.  List/Query Resources 3.2.2.  List/Query Resources

      
 

      
   SCIM defines a standard set of operations that can be used to filter,    SCIM defines a standard set of operations that can be used to filter,

      
   sort, and paginate response results.  The operations are specified by    sort, and paginate response results.  The operations are specified by

      

      
   adding query parameters to the Resource's endpoint.  Service    adding query parameters to the resource's endpoint.  Service

      
   Providers MAY support additional query parameters not specified here,    providers MAY support additional query parameters not specified here,

      
   and Providers SHOULD ignore any query parameters they don't    and Providers SHOULD ignore any query parameters they don't

      
   recognize.    recognize.

      
 

      
   List and query responses MUST be identified using the following URI:    List and query responses MUST be identified using the following URI:

      

      
   'urn:scim:schemas:core:2.0:ListResponse'.  The following attributes    "urn:scim:schemas:core:2.0:ListResponse".  The following attributes

      
   are defined for list and query responses:    are defined for list and query responses:

      
 

      
   totalResults  The total number of results returned by the list or    totalResults  The total number of results returned by the list or

      
      query operation.  This may not be equal to the number of elements       query operation.  This may not be equal to the number of elements

      

      
      in the Resources attribute of the list response if pagination       in the resources attribute of the list response if pagination

      
      (Section 3.2.2.4) is requested.  REQUIRED.       (Section 3.2.2.4) is requested.  REQUIRED.

      
 

      
   Resources  A multi-valued list of complex objects containing the    Resources  A multi-valued list of complex objects containing the

      
      requested resources.  This may be a subset of the full set of       requested resources.  This may be a subset of the full set of

      

      
      Resources if pagination (Section 3.2.2.4) is requested.  REQUIRED.       resources if pagination (Section 3.2.2.4) is requested.  REQUIRED.

      
 

      
   startIndex  The 1-based index of the first result in the current set    startIndex  The 1-based index of the first result in the current set

      
      of list results.  REQUIRED if pagination (Section 3.2.2.4) is       of list results.  REQUIRED if pagination (Section 3.2.2.4) is

      
      requested.       requested.

      
 

      

      
   itemsPerPage  The number of Resources returned in a list response    itemsPerPage  The number of resources returned in a list response

      
      page.  REQUIRED if pagination (Section 3.2.2.4) is requested.       page.  REQUIRED if pagination (Section 3.2.2.4) is requested.

      
 

      
   The below example returns the userName for all Users:    The below example returns the userName for all Users:

      
 

      
   GET /Users?attributes=userName    GET /Users?attributes=userName

      
   Host: example.com    Host: example.com

      
   Accept: application/json    Accept: application/json

      
   Authorization: Bearer h480djs93hd8    Authorization: Bearer h480djs93hd8

      

      
                                                                          

      
   HTTP/1.1 200 OK    HTTP/1.1 200 OK

      
   Content-Type: application/json    Content-Type: application/json

      
 

      
   {    {

      
     "schemas":["urn:scim:schemas:core:2.0:ListResponse"],      "schemas":["urn:scim:schemas:core:2.0:ListResponse"],

      
     "totalResults":2,      "totalResults":2,

      
     "Resources":[      "Resources":[

      
       {        {

      
         "userName":"bjensen"          "userName":"bjensen"

      
       },        },

      
 

      
skipping to change at page 10, line 46 skipping to change at page 10, line 22

      
         "userName":"bjensen"          "userName":"bjensen"

      
       },        },

      
       {        {

      
         "userName":"jsmith"          "userName":"jsmith"

      
       }        }

      
     ]      ]

      
   }    }

      
 

      
3.2.2.1.  Query Endpoints 3.2.2.1.  Query Endpoints

      
 

      

      
   Queries MAY be performed against a SCIM:    Queries MAY be performed against a SCIM resources or resource

      
    endpoints.  For example:

      
 

      

      
      Resource (e.g. /Users/{userid}),       "/Users/{userid}"

      
 

      

      
      Resource Type endpoint (e.g. /Users or /Groups), or       "/Users"

      
      Server Root (e.g. /). 

      
 

      

      
   A search against a server root indicates that ALL resources within       "/Groups"

      
   the server SHALL be included subject to filtering.  For example, a 

      
   filter against 'meta.resourceType' could be used to restrict results    A server MAY support searches against the server root (e.g.  "/").  A

      
   to one or more specific resource types.    search against a server root indicates that ALL resources within the

      
    server SHALL be included subject to filtering.  A filter expression

      
    using "meta.resourceType" MAY be used to restrict results to one or

      
    more specific resource types (e.g. "User").

      
 

      
   When processing search operations across endpoints that include more    When processing search operations across endpoints that include more

      
   than one SCIM resource type (e.g. a search from the server root    than one SCIM resource type (e.g. a search from the server root

      
   endpoint), filters MUST be processed in the same fashion as outlined    endpoint), filters MUST be processed in the same fashion as outlined

      
   in Section 3.2.2.2.  For filtered attributes that are not part of a    in Section 3.2.2.2.  For filtered attributes that are not part of a

      
   particular resource type, the service provider SHALL treat the    particular resource type, the service provider SHALL treat the

      
   attribute as if there is no attribute value.  For example, a presence    attribute as if there is no attribute value.  For example, a presence

      
   or equality filter for an undefined attribute evaluates as FALSE.    or equality filter for an undefined attribute evaluates as FALSE.

      
 

      
3.2.2.2.  Filtering 3.2.2.2.  Filtering

      
 

      

      
   Filtering is OPTIONAL.  Consumers may request a subset of Resources    Filtering is OPTIONAL.  Clients may request a subset of resources by

      
   by specifying the 'filter' URL query parameter containing a filter    specifying the 'filter' URL query parameter containing a filter

      
   expression.  When specified only those Resources matching the filter    expression.  When specified only those resources matching the filter

      
   expression SHALL be returned.  The expression language that is used    expression SHALL be returned.  The expression language that is used

      
   in the filter parameter supports references to attributes and    in the filter parameter supports references to attributes and

      
   literals.  The literal values can be strings enclosed in double    literals.  The literal values can be strings enclosed in double

      
   quotes, numbers, date times enclosed in double quotes, and Boolean    quotes, numbers, date times enclosed in double quotes, and Boolean

      

      
   values; i.e., true or false.  String literals MUST be valid JSON    values; i.e., true or false.  String literals MUST be valid

      
   strings [5].    [RFC4627].

      
 

      
   The attribute name and attribute operator are case insensitive.  For    The attribute name and attribute operator are case insensitive.  For

      
   example, the following two expressions will evaluate to the same    example, the following two expressions will evaluate to the same

      
   logical value:    logical value:

      
 

      
   filter=userName Eq "john"    filter=userName Eq "john"

      
 

      
   filter=Username eq "john"    filter=Username eq "john"

      
 

      
   The filter parameter MUST contain at least one valid Boolean    The filter parameter MUST contain at least one valid Boolean

      
 

      
skipping to change at page 12, line 5 skipping to change at page 11, line 31

      
   expressions can be grouped together using "()".    expressions can be grouped together using "()".

      
 

      
   The operators supported in the expression are listed in the following    The operators supported in the expression are listed in the following

      
   table.    table.

      
 

      
   +----------+-------------+------------------------------------------+    +----------+-------------+------------------------------------------+

      
   | Operator | Description | Behavior                                 |    | Operator | Description | Behavior                                 |

      
   +----------+-------------+------------------------------------------+    +----------+-------------+------------------------------------------+

      
   | eq       | equal       | The attribute and operator values must   |    | eq       | equal       | The attribute and operator values must   |

      
   |          |             | be identical for a match.                |    |          |             | be identical for a match.                |

      

      
    | ne       | not equal   | The attribute and operator values are    |

      
    |          |             | not identical.                           |

      
   | co       | contains    | The entire operator value must be a      |    | co       | contains    | The entire operator value must be a      |

      
   |          |             | substring of the attribute value for a   |    |          |             | substring of the attribute value for a   |

      
   |          |             | match.                                   |    |          |             | match.                                   |

      
   | sw       | starts with | The entire operator value must be a      |    | sw       | starts with | The entire operator value must be a      |

      
   |          |             | substring of the attribute value,        |    |          |             | substring of the attribute value,        |

      
   |          |             | starting at the beginning of the         |    |          |             | starting at the beginning of the         |

      
   |          |             | attribute value. This criterion is       |    |          |             | attribute value. This criterion is       |

      
   |          |             | satisfied if the two strings are         |    |          |             | satisfied if the two strings are         |

      
   |          |             | identical.                               |    |          |             | identical.                               |

      

      
    | ew       | ends with   | The entire operator value must be a      |

      
    |          |             | substring of the attribute value,        |

      
    |          |             | matching at the end of the attribute     |

      
    |          |             | value.  This criterion is satisfied if   |

      
    |          |             | the two strings are identical.           |

      
   | pr       | present     | If the attribute has a non-empty value,  |    | pr       | present     | If the attribute has a non-empty value,  |

      
   |          | (has value) | or if it contains a non-empty node for   |    |          | (has value) | or if it contains a non-empty node for   |

      
   |          |             | complex attributes there is a match.     |    |          |             | complex attributes there is a match.     |

      
   | gt       | greater     | If the attribute value is greater than   |    | gt       | greater     | If the attribute value is greater than   |

      
   |          | than        | operator value, there is a match. The    |    |          | than        | operator value, there is a match. The    |

      
   |          |             | actual comparison is dependent on the    |    |          |             | actual comparison is dependent on the    |

      
   |          |             | attribute type. For string attribute     |    |          |             | attribute type. For string attribute     |

      
   |          |             | types, this is a lexicographical         |    |          |             | types, this is a lexicographical         |

      
   |          |             | comparison and for DateTime types, it is |    |          |             | comparison and for DateTime types, it is |

      
   |          |             | a chronological comparison.              |    |          |             | a chronological comparison.              |

      
 

      
skipping to change at page 13, line 12 skipping to change at page 12, line 43

      
 

      
                       Table 2: Attribute Operators                        Table 2: Attribute Operators

      
 

      
   +----------+-------------+------------------------------------------+    +----------+-------------+------------------------------------------+

      
   | Operator | Description | Behavior                                 |    | Operator | Description | Behavior                                 |

      
   +----------+-------------+------------------------------------------+    +----------+-------------+------------------------------------------+

      
   | and      | Logical And | The filter is only a match if both       |    | and      | Logical And | The filter is only a match if both       |

      
   |          |             | expressions evaluate to true.            |    |          |             | expressions evaluate to true.            |

      
   | or       | Logical or  | The filter is a match if either          |    | or       | Logical or  | The filter is a match if either          |

      
   |          |             | expression evaluates to true.            |    |          |             | expression evaluates to true.            |

      

      
    | not      | Not         | The filter is a match if the expression  |

      
    |          | function    | evaluates to false.                      |

      
   +----------+-------------+------------------------------------------+    +----------+-------------+------------------------------------------+

      
 

      
                        Table 3: Logical Operators                         Table 3: Logical Operators

      
 

      
   +----------+-------------+------------------------------------------+    +----------+-------------+------------------------------------------+

      
   | Operator | Description | Behavior                                 |    | Operator | Description | Behavior                                 |

      
   +----------+-------------+------------------------------------------+    +----------+-------------+------------------------------------------+

      
   | ()       | Precedence  | Boolean expressions may be grouped using |    | ()       | Precedence  | Boolean expressions may be grouped using |

      
   |          | grouping    | parentheses to change the standard order |    |          | grouping    | parentheses to change the standard order |

      
   |          |             | of operations; i.e., evaluate OR logical |    |          |             | of operations; i.e., evaluate OR logical |

      
   |          |             | operators before logical AND operators.  |    |          |             | operators before logical AND operators.  |

      

      
    | []       | Complex     | Service providers MAY support complex    |

      
    |          | attribute   | filters where expressions MUST be        |

      
    |          | filter      | applied to the same value of a parent    |

      
    |          | grouping    | attribute specified immediately before   |

      
    |          |             | the left square bracket ("["). The       |

      
    |          |             | expression within square brackets ("["   |

      
    |          |             | and "]") MUST be a valid filter          |

      
    |          |             | expression based upon sub-attributes of  |

      
    |          |             | the parent attribute. Nested expressions |

      
    |          |             | MAY be used. See examples below.         |

      
   +----------+-------------+------------------------------------------+    +----------+-------------+------------------------------------------+

      
 

      
                        Table 4: Grouping Operators                         Table 4: Grouping Operators

      
 

      

      
   Filters MUST be evaluated using standard order of operations [6].    Filters MUST be evaluated using standard order of operations

      
   Attribute operators have the highest precedence, followed by the    [Order-Operations].  Attribute operators have the highest precedence,

      
   grouping operator (i.e, parentheses), followed by the logical AND    followed by the grouping operator (i.e, parentheses), followed by the

      
   operator, followed by the logical OR operator.    logical AND operator, followed by the logical OR operator.

      
 

      
   If the specified attribute in a filter expression is a multi-valued    If the specified attribute in a filter expression is a multi-valued

      

      
   attribute, the Resource MUST match if any of the instances of the    attribute, the resource MUST match if any of the instances of the

      
   given attribute match the specified criterion; e.g. if a User has    given attribute match the specified criterion; e.g. if a User has

      
   multiple emails values, only one has to match for the entire User to    multiple emails values, only one has to match for the entire User to

      
   match.  For complex attributes, a fully qualified Sub-Attribute MUST    match.  For complex attributes, a fully qualified Sub-Attribute MUST

      
   be specified using standard attribute notation (Section 3.8).  For    be specified using standard attribute notation (Section 3.8).  For

      
   example, to filter by userName the parameter value is userName and to    example, to filter by userName the parameter value is userName and to

      
   filter by first name, the parameter value is name.givenName.    filter by first name, the parameter value is name.givenName.

      
 

      
   Providers MAY support additional filter operations if they choose.    Providers MAY support additional filter operations if they choose.

      
   Providers MUST decline to filter results if the specified filter    Providers MUST decline to filter results if the specified filter

      
   operation is not recognized and return a HTTP 400 error with an    operation is not recognized and return a HTTP 400 error with an

      

      
   appropriate human readable response.  For example, if a Consumer    appropriate human readable response.  For example, if a client

      
   specified an unsupported operator named 'regex' the Service Provider    specified an unsupported operator named 'regex' the service provider

      
   should specify an error response description identifying the Consumer    should specify an error response description identifying the client

      
   error; e.g., 'The operator 'regex' is not supported.'    error; e.g., 'The operator 'regex' is not supported.'

      
 

      
   String type attributes are case insensitive by default unless the    String type attributes are case insensitive by default unless the

      
   attribute type is defined as a caseExact string.  Attribute operators    attribute type is defined as a caseExact string.  Attribute operators

      
   'eq', 'co', and 'sw' MUST perform caseIgnore matching for all string    'eq', 'co', and 'sw' MUST perform caseIgnore matching for all string

      
   attributes unless the attribute is defined as caseExact.  By default    attributes unless the attribute is defined as caseExact.  By default

      
   all string attributes are caseIgnore.    all string attributes are caseIgnore.

      
 

      

      
   Examples:    Clients MAY search by schema or schema extensions by using a filter

      
    expression including the "schemas" attribute.

      
 

      
    The following are examples of valid filters.  Some attributes (e.g.

      
    rooms and rooms.number) are hypothetical extensions and are not part

      
    of SCIM core schema:

      
 

      
   filter=userName eq "bjensen"    filter=userName eq "bjensen"

      
 

      
   filter=name.familyName co "O'Malley"    filter=name.familyName co "O'Malley"

      
 

      
   filter=userName sw "J"    filter=userName sw "J"

      
 

      
   filter=title pr    filter=title pr

      
 

      
   filter=meta.lastModified gt "2011-05-13T04:42:34Z"    filter=meta.lastModified gt "2011-05-13T04:42:34Z"

      
 

      
skipping to change at page 14, line 29 skipping to change at page 14, line 32

      
   filter=meta.lastModified ge "2011-05-13T04:42:34Z"    filter=meta.lastModified ge "2011-05-13T04:42:34Z"

      
 

      
   filter=meta.lastModified lt "2011-05-13T04:42:34Z"    filter=meta.lastModified lt "2011-05-13T04:42:34Z"

      
 

      
   filter=meta.lastModified le "2011-05-13T04:42:34Z"    filter=meta.lastModified le "2011-05-13T04:42:34Z"

      
 

      
   filter=title pr and userType eq "Employee"    filter=title pr and userType eq "Employee"

      
 

      
   filter=title pr or userType eq "Intern"    filter=title pr or userType eq "Intern"

      
 

      

      
    filter=schemas eq "urn:scim:schemas:extension:enterprise:2.0:User"

      
                                                                          

      
   filter=userType eq "Employee" and (emails co "example.com" or emails    filter=userType eq "Employee" and (emails co "example.com" or emails

      
   co "example.org")    co "example.org")

      
 

      

      
    filter=userType ne "Employee" and not (emails co "example.com" or

      
      emails co "example.org")

      
 

      
    filter=userType eq "Employee" and (emails.type eq "work")

      
 

      
    filter=userType eq "Employee" and emails[type eq "work" and

      
      value co "@example.com"]

      
 

      
    filter=emails[type eq "work" and value co "@example.com"] or ims[type

      
      eq "xmpp" and value co "@foo.com"]

      
 

      
    filter=addresses[state eq "CA" and rooms[type eq "bedroom" and

      
      number gt 2]]

      
                                                                          

      
3.2.2.3.  Sorting 3.2.2.3.  Sorting

      
 

      

      
   Sort is OPTIONAL.  Sorting allows Consumers to specify the order in    Sort is OPTIONAL.  Sorting allows clients to specify the order in

      
   which Resources are returned by specifying a combination of sortBy    which resources are returned by specifying a combination of sortBy

      
   and sortOrder URL parameters.    and sortOrder URL parameters.

      
 

      
   sortBy:  The sortBy parameter specifies the attribute whose value    sortBy:  The sortBy parameter specifies the attribute whose value

      
      SHALL be used to order the returned responses.  If the sortBy       SHALL be used to order the returned responses.  If the sortBy

      

      
      attribute corresponds to a Singular Attribute, Resources are       attribute corresponds to a singular attribute, resources are

      
      sorted according to that attribute's value; if it's a Multi-valued       sorted according to that attribute's value; if it's a multi-valued

      
      Attribute, Resources are sorted by the value of the primary       attribute, resources are sorted by the value of the primary

      
      attribute, if any, or else the first value in the list, if any.       attribute, if any, or else the first value in the list, if any.

      
      If the attribute is complex the attribute name must be a path to a       If the attribute is complex the attribute name must be a path to a

      

      
      Sub-Attribute in standard attribute notation (Section 3.8) ; e.g.,       sub-attribute in standard attribute notation (Section 3.8) ; e.g.,

      
      sortBy=name.givenName.  For all attribute types, if there is no       "sortBy=name.givenName".  For all attribute types, if there is no

      
      data for the specified sortBy value they are sorted via the       data for the specified "sortBy" value they are sorted via the

      
      'sortOrder' parameter; i.e., they are ordered last if ascending       "sortOrder" parameter; i.e., they are ordered last if ascending

      
      and first if descending.       and first if descending.

      
 

      
   sortOrder:  The order in which the sortBy parameter is applied.    sortOrder:  The order in which the sortBy parameter is applied.

      
      Allowed values are "ascending" and "descending".  If a value for       Allowed values are "ascending" and "descending".  If a value for

      
      sortBy is provided and no sortOrder is specified, the sortOrder       sortBy is provided and no sortOrder is specified, the sortOrder

      
      SHALL default to ascending.  String type attributes are case       SHALL default to ascending.  String type attributes are case

      
      insensitive by default unless the attribute type is defined as a       insensitive by default unless the attribute type is defined as a

      

      
      caseExact string. sortOrder MUST sort according to the attribute       case exact string. "sortOrder" MUST sort according to the

      
      type; i.e., for caseIgnore attributes, sort the result using case       attribute type; i.e., for "caseIgnore" attributes, sort the result

      
      insensitive, Unicode alphabetic sort order, with no specific       using case insensitive, unicode alphabetic sort order, with no

      
      locale implied and for caseExact attribute types, sort the result       specific locale implied and for caseExact attribute types, sort

      
      using case sensitive, Unicode alphabetic sort order.       the result using case sensitive, Unicode alphabetic sort order.

      
 

      
3.2.2.4.  Pagination 3.2.2.4.  Pagination

      
 

      
   Pagination parameters can be used together to "page through" large    Pagination parameters can be used together to "page through" large

      

      
   numbers of Resources so as not to overwhelm the Consumer or Service    numbers of resources so as not to overwhelm the client or service

      
   Provider.  Pagination is not session based hence Consumers SHOULD    provider.  Pagination is not session based hence clients SHOULD never

      
   never assume repeatable results.  For example, a request for a list    assume repeatable results.  For example, a request for a list of 10

      
   of 10 Resources beginning with a startIndex of 1 may return different    resources beginning with a startIndex of 1 may return different

      
   results when repeated as a Resource in the original result could be    results when repeated as a resource in the original result could be

      
   deleted or new ones could be added in-between requests.  Pagination    deleted or new ones could be added in-between requests.  Pagination

      
   parameters and general behavior are derived from the OpenSearch    parameters and general behavior are derived from the OpenSearch

      

      
   Protocol [7].    Protocol [OpenSearch].

      
 

      
   The following table describes the URL pagination parameters.    The following table describes the URL pagination parameters.

      
 

      
   +------------+-------------------+----------------------------------+    +------------+-------------------+----------------------------------+

      
   | Parameter  | Description       | Default                          |    | Parameter  | Description       | Default                          |

      
   +------------+-------------------+----------------------------------+    +------------+-------------------+----------------------------------+

      
   | startIndex | The 1-based index | 1                                |    | startIndex | The 1-based index | 1                                |

      
   |            | of the first      |                                  |    |            | of the first      |                                  |

      
   |            | search result.    |                                  |    |            | search result.    |                                  |

      

      
   | count      | Non-negative      | None. When specified the Service |    | count      | Non-negative      | None. When specified the service |

      
   |            | Integer.          | Provider MUST not return more    |    |            | Integer.          | provider MUST not return more    |

      
   |            | Specifies the     | results than specified though    |    |            | Specifies the     | results than specified though    |

      
   |            | desired maximum   | MAY return fewer results. If     |    |            | desired maximum   | MAY return fewer results. If     |

      
   |            | number of search  | unspecified, the maximum number  |    |            | number of search  | unspecified, the maximum number  |

      

      
   |            | results per page; | of results is set by the Service |    |            | results per page; | of results is set by the service |

      
   |            | e.g., 10.         | Provider.                        |    |            | e.g., 10.         | provider.                        |

      
   +------------+-------------------+----------------------------------+    +------------+-------------------+----------------------------------+

      
 

      
                  Table 5: Pagination Request parameters                   Table 5: Pagination Request parameters

      
 

      
   The following table describes the query response pagination    The following table describes the query response pagination

      

      
   attributes specified by the Service Provider.    attributes specified by the service provider.

      
 

      
   +--------------+----------------------------------------------------+    +--------------+----------------------------------------------------+

      
   | Element      | Description                                        |    | Element      | Description                                        |

      
   +--------------+----------------------------------------------------+    +--------------+----------------------------------------------------+

      
   | itemsPerPage | Non-negative Integer. Specifies the number of      |    | itemsPerPage | Non-negative Integer. Specifies the number of      |

      
   |              | search results returned in a query response page;  |    |              | search results returned in a query response page;  |

      
   |              | e.g., 10.                                          |    |              | e.g., 10.                                          |

      
   | totalResults | Non-negative Integer. Specifies the total number   |    | totalResults | Non-negative Integer. Specifies the total number   |

      

      
   |              | of results matching the Consumer query; e.g.,      |    |              | of results matching the client query; e.g., 1000.  |

      
   |              | 1000.                                              | 

      
   | startIndex   | The 1-based index of the first result in the       |    | startIndex   | The 1-based index of the first result in the       |

      
   |              | current set of search results; e.g., 1.            |    |              | current set of search results; e.g., 1.            |

      
   +--------------+----------------------------------------------------+    +--------------+----------------------------------------------------+

      
 

      
                   Table 6: Pagination Response Elements                    Table 6: Pagination Response Elements

      
 

      
   For example, to retrieve the first 10 Users set the startIndex to 1    For example, to retrieve the first 10 Users set the startIndex to 1

      
   and the count to 10.    and the count to 10.

      
 

      
   GET /Users?startIndex=1&count=10    GET /Users?startIndex=1&count=10

      
 

      
skipping to change at page 17, line 4 skipping to change at page 17, line 27

      
3.2.3.  Querying Resources Using HTTP POST 3.2.3.  Querying Resources Using HTTP POST

      
 

      
   Clients MAY execute queries without passing parameters on the URL by    Clients MAY execute queries without passing parameters on the URL by

      
   using the HTTP POST verb combined with the '/.search' path extension.    using the HTTP POST verb combined with the '/.search' path extension.

      
   The inclusion of '/.search' on the end of a valid SCIM endpoint SHALL    The inclusion of '/.search' on the end of a valid SCIM endpoint SHALL

      
   be used to indicate the HTTP POST verb is intended to be a query    be used to indicate the HTTP POST verb is intended to be a query

      
   operation.    operation.

      
 

      
   To create a new search result set, a SCIM client sends an HTTP POST    To create a new search result set, a SCIM client sends an HTTP POST

      
   request to the desired SCIM resource endpoint (ending in '/.search').    request to the desired SCIM resource endpoint (ending in '/.search').

      

      
                                                                          

      
   The body of the POST request MAY include any of the parameters as    The body of the POST request MAY include any of the parameters as

      
   defined in Section 3.2.2.    defined in Section 3.2.2.

      
 

      
   Search requests MUST be identified using the following URI:    Search requests MUST be identified using the following URI:

      
   'urn:scim:schemas:core:2.0:SearchRequest'.  The following attributes    'urn:scim:schemas:core:2.0:SearchRequest'.  The following attributes

      
   are defined for search requests:    are defined for search requests:

      
 

      
   attributes  A multi-valued list of strings indicating the names of    attributes  A multi-valued list of strings indicating the names of

      

      
      Resource attributes to return in the response.  Attribute names       resource attributes to return in the response.  Attribute names

      
      MUST be in standard attribute notation (Section 3.8) form.  See       MUST be in standard attribute notation (Section 3.8) form.  See

      
      additional retrieval query parameters (Section 3.7).  OPTIONAL.       additional retrieval query parameters (Section 3.7).  OPTIONAL.

      
 

      

      
   filter  The filter string used to request a subset of Resources.  The    filter  The filter string used to request a subset of resources.  The

      
      filter string MUST be a valid filter (Section 3.2.2.2) expression.       filter string MUST be a valid filter (Section 3.2.2.2) expression.

      
      OPTIONAL.       OPTIONAL.

      
 

      
   sortBy  A string indicating the attribute whose value SHALL be used    sortBy  A string indicating the attribute whose value SHALL be used

      
      to order the returned responses.  The sortBy attribute MUST be in       to order the returned responses.  The sortBy attribute MUST be in

      
      standard attribute notation (Section 3.8) form.  See sorting       standard attribute notation (Section 3.8) form.  See sorting

      
      (Section 3.2.2.3).  OPTIONAL.       (Section 3.2.2.3).  OPTIONAL.

      
 

      
   sortOrder  A string indicating the order in which the sortBy    sortOrder  A string indicating the order in which the sortBy

      
      parameter is applied.  Allowed values are "ascending" and       parameter is applied.  Allowed values are "ascending" and

      
 

      
skipping to change at page 19, line 45 skipping to change at page 19, line 45

      
        },         },

      
         ...          ...

      
      ]       ]

      
    }     }

      
 

      
                  Figure 2: Example POST Search Response                   Figure 2: Example POST Search Response

      
 

      
3.3.  Modifying Resources 3.3.  Modifying Resources

      
 

      
   Resources can be modified in whole or in part via PUT or PATCH,    Resources can be modified in whole or in part via PUT or PATCH,

      

      
   respectively.  Implementers MUST support PUT as specified in RFC2616    respectively.  Implementers MUST support PUT as specified in

      
   [8] . Resources such as Groups may be very large hence implementers    Section 9.6 [RFC2616] . Resources such as Groups may be very large

      
   SHOULD support PATCH [9] to enable partial resource modifications.    hence implementers SHOULD support PATCH [RFC5789] to enable partial

      
    resource modifications.

      
 

      
3.3.1.  Modifying with PUT 3.3.1.  Modifying with PUT

      
 

      

      
   PUT performs a full update.  Consumers must retrieve the entire    PUT performs a full update. clients must retrieve the entire resource

      
   Resource and PUT the desired modifications as the operation    and PUT the desired modifications as the operation overwrites all

      
   overwrites all previously stored data with the exception of the    previously stored data with the exception of the password attribute.

      
   password attribute.  If the password attribute of the User resource    If the password attribute of the User resource is unspecified, it

      
   is unspecified, it should be left in-tact.  Since this performs a    should be left in-tact.  Since this performs a full update, clients

      
   full update, Consumers MAY send read-only attributes of the retrieved    MAY send read-only attributes of the retrieved resource and the

      
   resource and the Service Provider MUST ignore any read-only    service provider MUST ignore any read-only attributes that are

      
   attributes that are present in the payload of a PUT request.  Unless    present in the payload of a PUT request.  Unless otherwise specified

      
   otherwise specified a successful PUT operation returns a 200 OK    a successful PUT operation returns a 200 OK response code and the

      
   response code and the entire Resource within the response body,    entire resource within the response body, enabling the client to

      
   enabling the Consumer to correlate the Consumer's and Provider's    correlate the client's and Provider's views of the updated resource.

      
   views of the updated Resource.  Example:    Example:

      
 

      
   PUT /Users/2819c223-7f76-453a-919d-413861904646    PUT /Users/2819c223-7f76-453a-919d-413861904646

      
   Host: example.com    Host: example.com

      
   Accept: application/json    Accept: application/json

      
   Content-Type: application/json    Content-Type: application/json

      
   Authorization: Bearer h480djs93hd8    Authorization: Bearer h480djs93hd8

      
   If-Match: W/"a330bc54f0671c9"    If-Match: W/"a330bc54f0671c9"

      
 

      
   {    {

      
     "schemas":["urn:scim:schemas:core:2.0:User"],      "schemas":["urn:scim:schemas:core:2.0:User"],

      
 

      
skipping to change at page 21, line 8 skipping to change at page 21, line 8

      
           "value":"babs@jensen.org"            "value":"babs@jensen.org"

      
       }        }

      
     ]      ]

      
   }    }

      
 

      
   The service responds with the entire, updated User    The service responds with the entire, updated User

      
 

      
HTTP/1.1 200 OK HTTP/1.1 200 OK

      
Content-Type: application/json Content-Type: application/json

      
ETag: W/"b431af54f0671a2" ETag: W/"b431af54f0671a2"

      

      
Location:"https://example.com/v1/Users/2819c223-7f76-453a-919d-413861904646" Location:"https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646"

      
{ {

      
  "schemas":["urn:scim:schemas:core:2.0:User"],   "schemas":["urn:scim:schemas:core:2.0:User"],

      
  "id":"2819c223-7f76-453a-919d-413861904646",   "id":"2819c223-7f76-453a-919d-413861904646",

      
  "userName":"bjensen",   "userName":"bjensen",

      
  "externalId":"bjensen",   "externalId":"bjensen",

      
  "name":{   "name":{

      
    "formatted":"Ms. Barbara J Jensen III",     "formatted":"Ms. Barbara J Jensen III",

      
    "familyName":"Jensen",     "familyName":"Jensen",

      
    "givenName":"Barbara",     "givenName":"Barbara",

      
    "middleName":"Jane"     "middleName":"Jane"

      
 

      
skipping to change at page 21, line 32 skipping to change at page 21, line 32

      
        "value":"bjensen@example.com"         "value":"bjensen@example.com"

      
    },     },

      
    {     {

      
        "value":"babs@jensen.org"         "value":"babs@jensen.org"

      
    }     }

      
  ],   ],

      
  "meta": {   "meta": {

      
    "resourceType":"User",     "resourceType":"User",

      
    "created":"2011-08-08T04:56:22Z",     "created":"2011-08-08T04:56:22Z",

      
    "lastModified":"2011-08-08T08:00:12Z",     "lastModified":"2011-08-08T08:00:12Z",

      

      
    "location":"https://example.com/v1/Users/2819c223-7f76-453a-919d-413861904646",     "location":"https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646",

      
    "version":"W\/\"b431af54f0671a2\""     "version":"W\/\"b431af54f0671a2\""

      
  }   }

      
} }

      
 

      
3.3.2.  Modifying with PATCH 3.3.2.  Modifying with PATCH

      
 

      

      
   PATCH is OPTIONAL.  PATCH enables consumers to send only those    PATCH is OPTIONAL.  PATCH enables clients to send only those

      
   attributes requiring modification, reducing network and processing    attributes requiring modification, reducing network and processing

      
   overhead.  Attributes may be deleted, replaced, merged, or added in a    overhead.  Attributes may be deleted, replaced, merged, or added in a

      
   single request.    single request.

      
 

      

      
   The body of a PATCH request MUST contain a partial Resource with the    The body of a PATCH request MUST contain a partial resource with the

      
   desired modifications.  The server MUST return either a 200 OK    desired modifications.  The server MUST return either a 200 OK

      

      
   response code and the entire Resource (subject to the "attributes"    response code and the entire resource (subject to the "attributes"

      
   query parameter - see Additional Retrieval Query Parameters    query parameter - see Additional Retrieval Query Parameters

      
   (Section 3.7)) within the response body, or a 204 No Content response    (Section 3.7)) within the response body, or a 204 No Content response

      
   code and the appropriate response headers for a successful PATCH    code and the appropriate response headers for a successful PATCH

      
   request.  The server MUST return a 200 OK if the "attributes"    request.  The server MUST return a 200 OK if the "attributes"

      
   parameter is specified on the request.    parameter is specified on the request.

      
 

      
   The server MUST process a PATCH request by first removing any    The server MUST process a PATCH request by first removing any

      
   attributes specified in the meta.attributes Sub-Attribute (if    attributes specified in the meta.attributes Sub-Attribute (if

      
   present) and then merging the attributes in the PATCH request body    present) and then merging the attributes in the PATCH request body

      

      
   into the Resource.    into the resource.

      
 

      
   The meta.attributes Sub-Attribute MAY contain a list of attributes to    The meta.attributes Sub-Attribute MAY contain a list of attributes to

      

      
   be removed from the Resource.  If the PATCH request body contains an    be removed from the resource.  If the PATCH request body contains an

      
   attribute that is present in the meta.attributes list, the attribute    attribute that is present in the meta.attributes list, the attribute

      

      
   on the Resource is replaced with the value from the PATCH body.  If    on the resource is replaced with the value from the PATCH body.  If

      
   the attribute is complex the attribute name must be a path to a Sub-    the attribute is complex the attribute name must be a path to a Sub-

      
   Attribute in standard attribute notation (Section 3.8); e.g.,    Attribute in standard attribute notation (Section 3.8); e.g.,

      
   name.givenName.    name.givenName.

      
 

      
   Attributes that exist in the PATCH request body but not in the    Attributes that exist in the PATCH request body but not in the

      
   meta.attributes Sub-Attribute will be either be updated or added to    meta.attributes Sub-Attribute will be either be updated or added to

      

      
   the Resource according to the following rules.    the resource according to the following rules.

      
 

      
   Singular attributes:  Singular attributes in the PATCH request body    Singular attributes:  Singular attributes in the PATCH request body

      

      
      replace the attribute on the Resource.       replace the attribute on the resource.

      
 

      
   Complex attributes:  Complex Sub-Attribute values in the PATCH    Complex attributes:  Complex Sub-Attribute values in the PATCH

      
      request body are merged into the complex attribute on the       request body are merged into the complex attribute on the

      

      
      Resource.       resource.

      
 

      
   Multi-valued attributes:  An attribute value in the PATCH request    Multi-valued attributes:  An attribute value in the PATCH request

      
      body is added to the value collection if the value does not exist       body is added to the value collection if the value does not exist

      
      and merged if a matching value is present.  Values are matched by       and merged if a matching value is present.  Values are matched by

      
      comparing the value Sub-Attribute from the PATCH request body to       comparing the value Sub-Attribute from the PATCH request body to

      

      
      the value Sub-Attribute of the Resource.  Attributes that do not       the value Sub-Attribute of the resource.  Attributes that do not

      
      have a value Sub-Attribute; e.g., addresses, or do not have unique       have a value Sub-Attribute; e.g., addresses, or do not have unique

      
      value Sub-Attributes cannot be matched and must instead be deleted       value Sub-Attributes cannot be matched and must instead be deleted

      

      
      then added.  Specific values can be removed from a Resource by       then added.  Specific values can be removed from a resource by

      
      adding an "operation" Sub-Attribute with the value "delete" to the       adding an "operation" Sub-Attribute with the value "delete" to the

      
      attribute in the PATCH request body.  As with adding/updating       attribute in the PATCH request body.  As with adding/updating

      
      attribute value collections, the value to delete is determined by       attribute value collections, the value to delete is determined by

      
      comparing the value Sub-Attribute from the PATCH request body to       comparing the value Sub-Attribute from the PATCH request body to

      

      
      the value Sub-Attribute of the Resource.  Attributes that do not       the value Sub-Attribute of the resource.  Attributes that do not

      
      have a value Sub-Attribute or that have a non-unique value Sub-       have a value Sub-Attribute or that have a non-unique value Sub-

      
      Attribute are matched by comparing all Sub-Attribute values from       Attribute are matched by comparing all Sub-Attribute values from

      
      the PATCH request body to the Sub-Attribute values of the       the PATCH request body to the Sub-Attribute values of the

      

      
      Resource.  A delete operation is ignored if the attribute's name       resource.  A delete operation is ignored if the attribute's name

      
      is in the meta.attributes list.  If the requested value to delete       is in the meta.attributes list.  If the requested value to delete

      

      
      does not match a unique value on the Resource the server MAY       does not match a unique value on the resource the server MAY

      
      return a HTTP 400 error.       return a HTTP 400 error.

      
 

      
   The following example shows how to add a member to a group:    The following example shows how to add a member to a group:

      
 

      
PATCH /Groups/acbf3ae7-8463-4692-b4fd-9b4da3f908ce PATCH /Groups/acbf3ae7-8463-4692-b4fd-9b4da3f908ce

      
Host: example.com Host: example.com

      
Accept: application/json Accept: application/json

      
Content-Type: application/json Content-Type: application/json

      
Authorization: Bearer h480djs93hd8 Authorization: Bearer h480djs93hd8

      
If-Match: W/"a330bc54f0671c9" If-Match: W/"a330bc54f0671c9"

      
 

      
{ {

      
  "schemas": ["urn:scim:schemas:core:2.0:Group"],   "schemas": ["urn:scim:schemas:core:2.0:Group"],

      
  "members": [   "members": [

      
    {     {

      
      "display": "Babs Jensen",       "display": "Babs Jensen",

      

      
      "$ref": "https://example.com/v1/Users/2819c223-7f76-453a-919d-413861904646",       "$ref": "https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646",

      
      "value": "2819c223-7f76-453a-919d-413861904646"       "value": "2819c223-7f76-453a-919d-413861904646"

      
    }     }

      
  ]   ]

      
} }

      
 

      
   The "display" Sub-Attribute in this request is optional since the    The "display" Sub-Attribute in this request is optional since the

      
   value attribute uniquely identifies the user to be added.  If the    value attribute uniquely identifies the user to be added.  If the

      
   user was already a member of this group, no changes should be made to    user was already a member of this group, no changes should be made to

      

      
   the Resource and a success response should be returned.  The server    the resource and a success response should be returned.  The server

      
   responds with either the entire updated Group or no response body:    responds with either the entire updated Group or no response body:

      
 

      
HTTP/1.1 204 No Content HTTP/1.1 204 No Content

      
Authorization: Bearer h480djs93hd8 Authorization: Bearer h480djs93hd8

      
ETag: W/"b431af54f0671a2" ETag: W/"b431af54f0671a2"

      

      
Location: "https://example.com/v1/Groups/acbf3ae7-8463-4692-b4fd-9b4da3f908ce" Location: "https://example.com/v2/Groups/acbf3ae7-8463-4692-b4fd-9b4da3f908ce"

      
 

      
   The following example shows how to remove a member from a group.  As    The following example shows how to remove a member from a group.  As

      
   with the previous example, the "display" Sub-Attribute is optional.    with the previous example, the "display" Sub-Attribute is optional.

      
   If the user was not a member of this group, no changes should be made    If the user was not a member of this group, no changes should be made

      

      
   to the Resource and a success response should be returned.    to the resource and a success response should be returned.

      
 

      
   Note that server responses have been omitted for the rest of the    Note that server responses have been omitted for the rest of the

      
   PATCH examples.    PATCH examples.

      
 

      
PATCH /Groups/acbf3ae7-8463-4692-b4fd-9b4da3f908ce PATCH /Groups/acbf3ae7-8463-4692-b4fd-9b4da3f908ce

      
Host: example.com Host: example.com

      
Accept: application/json Accept: application/json

      
Content-Type: application/json Content-Type: application/json

      
Authorization: Bearer h480djs93hd8 Authorization: Bearer h480djs93hd8

      
If-Match: W/"a330bc54f0671c9" If-Match: W/"a330bc54f0671c9"

      
 

      
{ {

      
  "schemas": ["urn:scim:schemas:core:2.0:Group"],   "schemas": ["urn:scim:schemas:core:2.0:Group"],

      
  "members": [   "members": [

      
    {     {

      
      "display": "Babs Jensen",       "display": "Babs Jensen",

      

      
      "$ref": "https://example.com/v1/Users/2819c223-7f76-453a-919d-413861904646",       "$ref": "https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646",

      
      "value": "2819c223-7f76-453a-919d-413861904646",       "value": "2819c223-7f76-453a-919d-413861904646",

      
      "operation": "delete"       "operation": "delete"

      
    }     }

      
  ]   ]

      
} }

      
 

      
   The following example shows how to remove all members from a group:    The following example shows how to remove all members from a group:

      
 

      
   PATCH /Groups/acbf3ae7-8463-4692-b4fd-9b4da3f908ce    PATCH /Groups/acbf3ae7-8463-4692-b4fd-9b4da3f908ce

      
   Host: example.com    Host: example.com

      
 

      
skipping to change at page 25, line 22 skipping to change at page 25, line 22

      
{ {

      
  "schemas": ["urn:scim:schemas:core:2.0:Group"],   "schemas": ["urn:scim:schemas:core:2.0:Group"],

      
  "meta": {   "meta": {

      
    "attributes": [     "attributes": [

      
      "members"       "members"

      
    ]     ]

      
  },   },

      
  "members": [   "members": [

      
    {     {

      
      "display": "Babs Jensen",       "display": "Babs Jensen",

      

      
      "$ref": "https://example.com/v1/Users/2819c223-7f76-453a-919d-413861904646",       "$ref": "https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646",

      
      "value": "2819c223-7f76-453a-919d-413861904646"       "value": "2819c223-7f76-453a-919d-413861904646"

      
    },     },

      
    {     {

      
      "display": "James Smith",       "display": "James Smith",

      

      
      "$ref": "https://example.com/v1/Users/08e1d05d-121c-4561-8b96-473d93df9210",       "$ref": "https://example.com/v2/Users/08e1d05d-121c-4561-8b96-473d93df9210",

      
      "value": "08e1d05d-121c-4561-8b96-473d93df9210"       "value": "08e1d05d-121c-4561-8b96-473d93df9210"

      
    }     }

      
  ]   ]

      
} }

      
 

      
   The following example shows how to add a member to and remove a    The following example shows how to add a member to and remove a

      
   member from a Group in a single request:    member from a Group in a single request:

      
 

      
PATCH /Groups/acbf3ae7-8463-4692-b4fd-9b4da3f908ce PATCH /Groups/acbf3ae7-8463-4692-b4fd-9b4da3f908ce

      
Host: example.com Host: example.com

      
Accept: application/json Accept: application/json

      
Content-Type: application/json Content-Type: application/json

      
Authorization: Bearer h480djs93hd8 Authorization: Bearer h480djs93hd8

      
If-Match: W/"a330bc54f0671c9" If-Match: W/"a330bc54f0671c9"

      
 

      
{ {

      
  "schemas": ["urn:scim:schemas:core:2.0:Group"],   "schemas": ["urn:scim:schemas:core:2.0:Group"],

      
  "members": [   "members": [

      
    {     {

      
      "display": "Babs Jensen",       "display": "Babs Jensen",

      

      
      "$ref": "https://example.com/v1/Users/2819c223-7f76-453a-919d-413861904646",       "$ref": "https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646",

      
      "value": "2819c223-7f76-453a-919d-413861904646",       "value": "2819c223-7f76-453a-919d-413861904646",

      
      "operation": "delete"       "operation": "delete"

      
    },     },

      
    {     {

      
      "display": "James Smith",       "display": "James Smith",

      

      
      "$ref": "https://example.com/v1/Users/08e1d05d-121c-4561-8b96-473d93df9210",       "$ref": "https://example.com/v2/Users/08e1d05d-121c-4561-8b96-473d93df9210",

      
      "value": "08e1d05d-121c-4561-8b96-473d93df9210"       "value": "08e1d05d-121c-4561-8b96-473d93df9210"

      
    }     }

      
  ]   ]

      
} }

      
 

      
   The following example shows how to change a User's primary email.  If    The following example shows how to change a User's primary email.  If

      
   the User already has the email address, it is made the primary    the User already has the email address, it is made the primary

      
   address and the current primary address (if present) is made non-    address and the current primary address (if present) is made non-

      
   primary.  If the User does not already have the email address, it is    primary.  If the User does not already have the email address, it is

      
   added and made the primary address.    added and made the primary address.

      
 

      
skipping to change at page 28, line 37 skipping to change at page 28, line 37

      
     "schemas": ["urn:scim:schemas:core:2.0:User"],      "schemas": ["urn:scim:schemas:core:2.0:User"],

      
     "meta": {      "meta": {

      
       "attributes": [        "attributes": [

      
         "nickName"          "nickName"

      
       ]        ]

      
     }      }

      
   }    }

      
 

      
   The following example shows how to change a User's familyName.  This    The following example shows how to change a User's familyName.  This

      
   only updates the familyName and formatted on the "name" complex    only updates the familyName and formatted on the "name" complex

      

      
   attribute.  Any other name Sub-Attributes on the Resource remain    attribute.  Any other name Sub-Attributes on the resource remain

      
   unchanged.    unchanged.

      
 

      
   PATCH /Users/2819c223-7f76-453a-919d-413861904646    PATCH /Users/2819c223-7f76-453a-919d-413861904646

      
   Host: example.com    Host: example.com

      
   Accept: application/json    Accept: application/json

      
   Content-Type: application/json    Content-Type: application/json

      
   Authorization: Bearer h480djs93hd8    Authorization: Bearer h480djs93hd8

      
   If-Match: W/"a330bc54f0671c9"    If-Match: W/"a330bc54f0671c9"

      
 

      
   {    {

      
 

      
skipping to change at page 29, line 42 skipping to change at page 29, line 42

      
     "meta": {      "meta": {

      
       "attributes": [        "attributes": [

      
         "name.formatted",          "name.formatted",

      
         "urn:hr:schemas:user:age"          "urn:hr:schemas:user:age"

      
       ]        ]

      
     }      }

      
   }    }

      
 

      
3.4.  Deleting Resources 3.4.  Deleting Resources

      
 

      

      
   Consumers request Resource removal via DELETE.  Service Providers MAY    Clients request resource removal via DELETE.  Service providers MAY

      
   choose not to permanently delete the Resource, but MUST return a 404    choose not to permanently delete the resource, but MUST return a 404

      
   error code for all operations associated with the previously deleted    error code for all operations associated with the previously deleted

      

      
   Id.  Service Providers MUST also omit the Resource from future query    Id.  Service providers MUST also omit the resource from future query

      
   results.  In addition the Service Provider MUST not consider the    results.  In addition the service provider MUST not consider the

      
   deleted resource in conflict calculation.  For example if a User    deleted resource in conflict calculation.  For example if a User

      
   resource is deleted, a CREATE request for a User resource with the    resource is deleted, a CREATE request for a User resource with the

      
   same userName as the previously deleted resource should not fail with    same userName as the previously deleted resource should not fail with

      
   a 409 error due to userName conflict.    a 409 error due to userName conflict.

      
 

      
   DELETE /Users/2819c223-7f76-453a-919d-413861904646    DELETE /Users/2819c223-7f76-453a-919d-413861904646

      
   Host: example.com    Host: example.com

      
   Authorization: Bearer h480djs93hd8    Authorization: Bearer h480djs93hd8

      
   If-Match: W/"c310cd84f0281b7"    If-Match: W/"c310cd84f0281b7"

      
 

      

      
   Server Response:    In response to a successful delete, the server SHALL respond with

      
    successful HTTP status 204 (No Content).  A non-normative example

      
    response:

      
 

      

      
   HTTP/1.1 200 OK    HTTP/1.1 204 No Content

      
 

      

      
   Example: Consumer attempt to retrieve the previously deleted User    Example: client attempt to retrieve the previously deleted User

      
 

      
   GET /Users/2819c223-7f76-453a-919d-413861904646    GET /Users/2819c223-7f76-453a-919d-413861904646

      
   Host: example.com    Host: example.com

      
   Authorization: Bearer h480djs93hd8    Authorization: Bearer h480djs93hd8

      
 

      
   Server Response:    Server Response:

      
 

      
HTTP/1.1 404 NOT FOUND HTTP/1.1 404 NOT FOUND

      
 

      
{ {

      
 

      
skipping to change at page 30, line 36 skipping to change at page 30, line 38

      
  "Errors":[   "Errors":[

      
    {     {

      
      "description":"Resource 2819c223-7f76-453a-919d-413861904646 not found",       "description":"Resource 2819c223-7f76-453a-919d-413861904646 not found",

      
      "code":"404"       "code":"404"

      
    }     }

      
  ]   ]

      
} }

      
 

      
3.5.  Bulk 3.5.  Bulk

      
 

      

      
   Bulk is OPTIONAL.  The bulk operation enables Consumers to send a    Bulk is OPTIONAL.  The bulk operation enables clients to send a

      
   potentially large collection of Resource operations in a single    potentially large collection of resource operations in a single

      
   request.  The body of a a bulk operation contains a set of HTTP    request.  The body of a a bulk operation contains a set of HTTP

      

      
   Resource operations using one of the API supported HTTP methods;    resource operations using one of the API supported HTTP methods;

      
   i.e., POST, PUT, PATCH or DELETE.    i.e., POST, PUT, PATCH or DELETE.

      
 

      
   Bulk requests are identified using the following URI:    Bulk requests are identified using the following URI:

      
   'urn:scim:schemas:core:2.0:BulkRequest'.  Bulk responses are    'urn:scim:schemas:core:2.0:BulkRequest'.  Bulk responses are

      
   identified using the following URI:    identified using the following URI:

      

      
                                                                          

      
   'urn:scim:schemas:core:2.0:BulkResponse'.  Bulk requests and bulk    'urn:scim:schemas:core:2.0:BulkResponse'.  Bulk requests and bulk

      
   responses share many attributes.  Unless otherwise specified, each    responses share many attributes.  Unless otherwise specified, each

      
   attribute below is present in both bulk requests and bulk responses.    attribute below is present in both bulk requests and bulk responses.

      
 

      
   The following Singular Attribute is defined in addition to the common    The following Singular Attribute is defined in addition to the common

      
   attributes defined in SCIM core schema.    attributes defined in SCIM core schema.

      
 

      
   failOnErrors  An Integer specifying the number of errors that the    failOnErrors  An Integer specifying the number of errors that the

      

      
      Service Provider will accept before the operation is terminated       service provider will accept before the operation is terminated

      
      and an error response is returned.  OPTIONAL in a request.  Not       and an error response is returned.  OPTIONAL in a request.  Not

      
      valid in a response.       valid in a response.

      
 

      
   The following Complex Multi-valued Attribute is defined in addition    The following Complex Multi-valued Attribute is defined in addition

      
   to the common attributes defined in core schema.    to the common attributes defined in core schema.

      
 

      
   Operations  Defines operations within a bulk job.  Each operation    Operations  Defines operations within a bulk job.  Each operation

      

      
      corresponds to a single HTTP request against a Resource endpoint.       corresponds to a single HTTP request against a resource endpoint.

      
      REQUIRED.       REQUIRED.

      
 

      
      method  The HTTP method of the current operation.  Possible values       method  The HTTP method of the current operation.  Possible values

      
         are POST, PUT, PATCH or DELETE.  REQUIRED.          are POST, PUT, PATCH or DELETE.  REQUIRED.

      
 

      

      
      bulkId  The transient identifier of a newly created Resource,       bulkId  The transient identifier of a newly created resource,

      
         unique within a bulk request and created by the Consumer.  The          unique within a bulk request and created by the client.  The

      
         bulkId serves as a surrogate Resource id enabling Consumers to          bulkId serves as a surrogate resource id enabling clients to

      
         uniquely identify newly created Resources in the Response and          uniquely identify newly created resources in the Response and

      
         cross reference new Resources in and across operations within a          cross reference new resources in and across operations within a

      
         bulk request.  REQUIRED when method is POST.          bulk request.  REQUIRED when method is POST.

      
 

      

      
      version  The current Resource version.  Version is REQUIRED if the       version  The current resource version.  Version is REQUIRED if the

      
         Service Provider supports ETags and the method is PUT, DELETE,          service provider supports ETags and the method is PUT, DELETE,

      
         or PATCH.          or PATCH.

      
 

      

      
      path  The Resource's relative path.  If the method is POST the       path  The resource's relative path.  If the method is POST the

      
         value must specify a Resource type endpoint; e.g., /Users or /          value must specify a resource type endpoint; e.g., /Users or /

      
         Groups whereas all other method values must specify the path to          Groups whereas all other method values must specify the path to

      

      
         a specific Resource; e.g., /Users/2819c223-7f76-453a-          a specific resource; e.g., /Users/2819c223-7f76-453a-

      
         919d-413861904646.  REQUIRED in a request.          919d-413861904646.  REQUIRED in a request.

      
 

      

      
      data  The Resource data as it would appear for a single POST, PUT       data  The resource data as it would appear for a single POST, PUT

      
         or PATCH Resource operation.  REQUIRED in a request when method          or PATCH resource operation.  REQUIRED in a request when method

      
         is POST, PUT and PATCH.          is POST, PUT and PATCH.

      
 

      

      
      location  The Resource endpoint URL.  REQUIRED in a response,       location  The resource endpoint URL.  REQUIRED in a response,

      
         except in the event of a POST failure.          except in the event of a POST failure.

      
 

      
      status  A complex type that contains information about the success       status  A complex type that contains information about the success

      
         or failure of one operation within the bulk job.  REQUIRED in a          or failure of one operation within the bulk job.  REQUIRED in a

      
         response.          response.

      
 

      
         code  The HTTP response code that would have been returned if a          code  The HTTP response code that would have been returned if a

      
            a single HTTP request would have been used.  REQUIRED.             a single HTTP request would have been used.  REQUIRED.

      
 

      
         description  A human readable error message.  REQUIRED when an          description  A human readable error message.  REQUIRED when an

      
            error occurred.             error occurred.

      
 

      
   If a bulk job is processed successfully the HTTP response code 200 OK    If a bulk job is processed successfully the HTTP response code 200 OK

      
   MUST be returned, otherwise an appropriate HTTP error code MUST be    MUST be returned, otherwise an appropriate HTTP error code MUST be

      
   returned.    returned.

      
 

      

      
   The Service Provider MUST continue performing as many changes as    The service provider MUST continue performing as many changes as

      
   possible and disregard partial failures.  The Consumer MAY override    possible and disregard partial failures.  The client MAY override

      
   this behavior by specifying a value for failOnErrors attribute.  The    this behavior by specifying a value for failOnErrors attribute.  The

      

      
   failOnErrors attribute defines the number of errors that the Service    failOnErrors attribute defines the number of errors that the service

      
   Provider should accept before failing the remaining operations    provider should accept before failing the remaining operations

      
   returning the response.    returning the response.

      
 

      

      
   To be able to reference a newly created Resource the attribute bulkId    To be able to reference a newly created resource the attribute bulkId

      
   MUST be specified when creating new Resources.  The bulkId is defined    MUST be specified when creating new resources.  The bulkId is defined

      
   by the Consumer as a surrogate identifier in a POST operation.  The    by the client as a surrogate identifier in a POST operation.  The

      
   Service Provider MUST return the same bulkId together with the newly    service provider MUST return the same bulkId together with the newly

      
   created Resource.  The bulkId can then be used by the Consumer to map    created resource.  The bulkId can then be used by the client to map

      
   the Service Provider id with the bulkId of the created Resource.    the service provider id with the bulkId of the created resource.

      
 

      

      
   There can be more then one operation per Resource in each bulk job.    There can be more then one operation per resource in each bulk job.

      
   The Service Consumer MUST take notice of the unordered structure of    The Service client MUST take notice of the unordered structure of

      
   JSON and the Service Provider can process operations in any order.    JSON and the service provider can process operations in any order.

      
   For example, if the Service Consumer sends two PUT operations in one    For example, if the Service client sends two PUT operations in one

      
   request, the outcome is non-deterministic.    request, the outcome is non-deterministic.

      
 

      

      
   The Service Provider response MUST include the result of all    The service provider response MUST include the result of all

      
   processed operations.  A location attribute that includes the    processed operations.  A location attribute that includes the

      

      
   Resource's end point MUST be returned for all operations excluding    resource's end point MUST be returned for all operations excluding

      
   failed POSTs.  The status attribute includes information about the    failed POSTs.  The status attribute includes information about the

      
   success or failure of one operation within the bulk job.  The    success or failure of one operation within the bulk job.  The

      
   attribute status MUST include the code attribute that holds the HTTP    attribute status MUST include the code attribute that holds the HTTP

      
   response code that would have been returned if a single HTTP request    response code that would have been returned if a single HTTP request

      
   would have been used.  If an error occurred the status MUST also    would have been used.  If an error occurred the status MUST also

      
   include the description attribute containing a human readable    include the description attribute containing a human readable

      
   explanation of the error.    explanation of the error.

      
 

      
   "status": {    "status": {

      
     "code": "201"      "code": "201"

      
   }    }

      
 

      
   The following is an example of a status in a failed operation.    The following is an example of a status in a failed operation.

      
 

      
"status": { "status": {

      
  "code": "400",   "code": "400",

      
  "description": "Request is unparseable, syntactically incorrect, or violates schema."   "description": "Request is unparseable, syntactically incorrect, or violates schema."

      
} }

      
 

      
   The following example shows how to add, update, and remove a user.    The following example shows how to add, update, and remove a user.

      

      
   The failOnErrors attribute is set to '1' indicating the Service    The failOnErrors attribute is set to '1' indicating the service

      
   Provider should return on the first error.  The POST operation's    provider should return on the first error.  The POST operation's

      
   bulkId value is set to 'qwerty' enabling the Consumer to match the    bulkId value is set to 'qwerty' enabling the client to match the new

      
   new User with the returned Resource id '92b725cd-9465-4e7d-    User with the returned resource id '92b725cd-9465-4e7d-

      
   8c16-01f8e146b87a'.    8c16-01f8e146b87a'.

      
 

      

      
   POST /v1/Bulk    POST /v2/Bulk

      
   Host: example.com    Host: example.com

      
   Accept: application/json    Accept: application/json

      
   Content-Type: application/json    Content-Type: application/json

      
   Authorization: Bearer h480djs93hd8    Authorization: Bearer h480djs93hd8

      
   Content-Length: ...    Content-Length: ...

      
 

      
   {    {

      
     "schemas": ["urn:scim:schemas:core:2.0:BulkRequest"],      "schemas": ["urn:scim:schemas:core:2.0:BulkRequest"],

      
     "failOnErrors":1,      "failOnErrors":1,

      
     "Operations":[      "Operations":[

      
 

      
skipping to change at page 34, line 22 skipping to change at page 34, line 30

      
         }          }

      
       },        },

      
       {        {

      
         "method":"DELETE",          "method":"DELETE",

      
         "path":"/Users/e9025315-6bea-44e1-899c-1e07454e468b",          "path":"/Users/e9025315-6bea-44e1-899c-1e07454e468b",

      
         "version":"W\/\"0ee8add0a938e1a\""          "version":"W\/\"0ee8add0a938e1a\""

      
       }        }

      
     ]      ]

      
   }    }

      
 

      

      
   The Service Provider returns the following response.    The service provider returns the following response.

      
 

      
HTTP/1.1 200 OK HTTP/1.1 200 OK

      
Content-Type: application/json Content-Type: application/json

      
 

      
{ {

      
    "schemas": ["urn:scim:schemas:core:2.0:BulkResponse"],     "schemas": ["urn:scim:schemas:core:2.0:BulkResponse"],

      
    "Operations": [     "Operations": [

      
        {         {

      

      
            "location": "https://example.com/v1/Users/92b725cd-9465-4e7d-8c16-01f8e146b87a",             "location": "https://example.com/v2/Users/92b725cd-9465-4e7d-8c16-01f8e146b87a",

      
            "method": "POST",             "method": "POST",

      
            "bulkId": "qwerty",             "bulkId": "qwerty",

      
            "version": "W\/\"oY4m4wn58tkVjJxK\"",             "version": "W\/\"oY4m4wn58tkVjJxK\"",

      
            "status": {             "status": {

      
                "code": "201"                 "code": "201"

      
            }             }

      
        },         },

      
        {         {

      

      
            "location": "https://example.com/v1/Users/b7c14771-226c-4d05-8860-134711653041",             "location": "https://example.com/v2/Users/b7c14771-226c-4d05-8860-134711653041",

      
            "method": "PUT",             "method": "PUT",

      
            "version": "W\/\"huJj29dMNgu3WXPD\"",             "version": "W\/\"huJj29dMNgu3WXPD\"",

      
            "status": {             "status": {

      
                "code": "200"                 "code": "200"

      
            }             }

      
        },         },

      
        {         {

      

      
            "location": "https://example.com/v1/Users/5d8d29d3-342c-4b5f-8683-a3cb6763ffcc",             "location": "https://example.com/v2/Users/5d8d29d3-342c-4b5f-8683-a3cb6763ffcc",

      
            "method": "PATCH",             "method": "PATCH",

      
            "version": "W\/\"huJj29dMNgu3WXPD\"",             "version": "W\/\"huJj29dMNgu3WXPD\"",

      
            "status": {             "status": {

      
                "code": "200"                 "code": "200"

      
            }             }

      
        },         },

      
        {         {

      

      
            "location": "https://example.com/v1/Users/e9025315-6bea-44e1-899c-1e07454e468b",             "location": "https://example.com/v2/Users/e9025315-6bea-44e1-899c-1e07454e468b",

      
            "method": "DELETE",             "method": "DELETE",

      
            "status": {             "status": {

      

      
                "code": "200"                 "code": "204"

      
            }             }

      
        }         }

      
    ]     ]

      
} }

      
 

      
   The following response is returned if an error occurred when    The following response is returned if an error occurred when

      

      
   attempting to create the User 'Alice'.  The Service Provider stops    attempting to create the User 'Alice'.  The service provider stops

      
   processing the bulk operation and immediately returns a response to    processing the bulk operation and immediately returns a response to

      

      
   the Consumer.  The response contains the error and any successful    the client.  The response contains the error and any successful

      
   results prior to the error.    results prior to the error.

      
 

      
HTTP/1.1 200 OK HTTP/1.1 200 OK

      
Content-Type: application/json Content-Type: application/json

      
 

      
{ {

      
  "schemas": ["urn:scim:schemas:core:2.0:BulkResponse"],   "schemas": ["urn:scim:schemas:core:2.0:BulkResponse"],

      
  "Operations": [   "Operations": [

      
    {     {

      
      "method": "POST",       "method": "POST",

      
      "bulkId": "qwerty",       "bulkId": "qwerty",

      
      "status": {       "status": {

      
        "code": "400",         "code": "400",

      
        "description": "Request is unparseable, syntactically incorrect, or violates schema."         "description": "Request is unparseable, syntactically incorrect, or violates schema."

      
      }       }

      
    }     }

      
  ]   ]

      
} }

      
 

      

      
   If the failOnErrors attribute is not specified or the Service    If the failOnErrors attribute is not specified or the service

      
   Provider has not reached the error limit defined by the Consumer the    provider has not reached the error limit defined by the client the

      
   Service Provider will continue to process all operations.  The    service provider will continue to process all operations.  The

      
   following is an example in which all operations failed.    following is an example in which all operations failed.

      
 

      
HTTP/1.1 200 OK HTTP/1.1 200 OK

      
Content-Type: application/json Content-Type: application/json

      
 

      
{ {

      
  "schemas": ["urn:scim:schemas:core:2.0:BulkResponse"],   "schemas": ["urn:scim:schemas:core:2.0:BulkResponse"],

      
  "Operations": [   "Operations": [

      
    {     {

      
      "method": "POST",       "method": "POST",

      
      "bulkId": "qwerty",       "bulkId": "qwerty",

      
      "status": {       "status": {

      
        "code": "400",         "code": "400",

      
        "description": "Request is unparseable, syntactically incorrect, or violates schema."         "description": "Request is unparseable, syntactically incorrect, or violates schema."

      
      }       }

      
    },     },

      
    {     {

      

      
      "location": "https://example.com/v1/Users/b7c14771-226c-4d05-8860-134711653041",       "location": "https://example.com/v2/Users/b7c14771-226c-4d05-8860-134711653041",

      
      "method": "PUT",       "method": "PUT",

      
      "status": {       "status": {

      
        "code": "412",         "code": "412",

      
        "description": "Failed to update as user changed on the server since you last retrieved it."         "description": "Failed to update as user changed on the server since you last retrieved it."

      
      }       }

      
    },     },

      
    {     {

      

      
      "location": "https://example.com/v1/Users/5d8d29d3-342c-4b5f-8683-a3cb6763ffcc",       "location": "https://example.com/v2/Users/5d8d29d3-342c-4b5f-8683-a3cb6763ffcc",

      
      "method": "PATCH",       "method": "PATCH",

      
      "status": {       "status": {

      
        "code": "412",         "code": "412",

      
        "description": "Failed to update as user changed on the server since you last retrieved it."         "description": "Failed to update as user changed on the server since you last retrieved it."

      
      }       }

      
    },     },

      
    {     {

      

      
      "location": "https://example.com/v1/Users/e9025315-6bea-44e1-899c-1e07454e468b",       "location": "https://example.com/v2/Users/e9025315-6bea-44e1-899c-1e07454e468b",

      
      "method": "DELETE",       "method": "DELETE",

      
      "status": {       "status": {

      
        "code": "404",         "code": "404",

      
        "description": "Specified resource; e.g., User, does not exist."         "description": "Specified resource; e.g., User, does not exist."

      
      }       }

      
    }     }

      
  ]   ]

      
} }

      
 

      

      
   The Consumer can, within one bulk operation, create a new User, a new    The client can, within one bulk operation, create a new User, a new

      
   Group and add the newly created User to the newly created Group.  In    Group and add the newly created User to the newly created Group.  In

      

      
   order to add the new User to the Group the Consumer must use the    order to add the new User to the Group the client must use the

      
   surrogate id attribute, bulkId, to reference the User.  The bulkId    surrogate id attribute, bulkId, to reference the User.  The bulkId

      
   attribute value must be pre-pended with the literal "bulkId:"; e.g.,    attribute value must be pre-pended with the literal "bulkId:"; e.g.,

      

      
   if the bulkId is 'qwerty' the value is "bulkId:qwerty".  The Service    if the bulkId is 'qwerty' the value is "bulkId:qwerty".  The service

      
   Provider MUST replace the string "bulkId:qwerty" with the permanent    provider MUST replace the string "bulkId:qwerty" with the permanent

      
   Resource id once created.    resource id once created.

      
 

      
   The following example creates a User with the userName 'Alice' and a    The following example creates a User with the userName 'Alice' and a

      
   Group with the displayName 'Tour Guides' with Alice as a member.    Group with the displayName 'Tour Guides' with Alice as a member.

      
 

      

      
   POST /v1/Bulk    POST /v2/Bulk

      
   Host: example.com    Host: example.com

      
   Accept: application/json    Accept: application/json

      
   Content-Type: application/json    Content-Type: application/json

      
   Authorization: Bearer h480djs93hd8    Authorization: Bearer h480djs93hd8

      
   Content-Length: ...    Content-Length: ...

      
 

      
   {    {

      
     "schemas": ["urn:scim:schemas:core:2.0:BulkRequest"],      "schemas": ["urn:scim:schemas:core:2.0:BulkRequest"],

      
     "Operations": [      "Operations": [

      
       {        {

      
 

      
skipping to change at page 38, line 47 skipping to change at page 38, line 47

      
             {              {

      
               "type": "user",                "type": "user",

      
               "value": "bulkId:qwerty"                "value": "bulkId:qwerty"

      
             }              }

      
           ]            ]

      
         }          }

      
       }        }

      
     ]      ]

      
   }    }

      
 

      

      
   The Service Provider returns the following response.    The service provider returns the following response.

      
 

      
HTTP/1.1 200 OK HTTP/1.1 200 OK

      
Content-Type: application/json Content-Type: application/json

      
 

      
{ {

      
  "schemas": ["urn:scim:schemas:core:2.0:BulkResponse"],   "schemas": ["urn:scim:schemas:core:2.0:BulkResponse"],

      
  "Operations": [   "Operations": [

      
    {     {

      

      
      "location": "https://example.com/v1/Users/92b725cd-9465-4e7d-8c16-01f8e146b87a",       "location": "https://example.com/v2/Users/92b725cd-9465-4e7d-8c16-01f8e146b87a",

      
      "method": "POST",       "method": "POST",

      
      "bulkId": "qwerty",       "bulkId": "qwerty",

      
      "version": "W\/\"4weymrEsh5O6cAEK\"",       "version": "W\/\"4weymrEsh5O6cAEK\"",

      
      "status": {       "status": {

      
        "code": "201"         "code": "201"

      
      }       }

      
    },     },

      
    {     {

      

      
      "location": "https://example.com/v1/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a",       "location": "https://example.com/v2/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a",

      
      "method": "POST",       "method": "POST",

      
      "bulkId": "ytrewq",       "bulkId": "ytrewq",

      
      "version": "W\/\"lha5bbazU3fNvfe5\"",       "version": "W\/\"lha5bbazU3fNvfe5\"",

      
      "status": {       "status": {

      
        "code": "201"         "code": "201"

      
      }       }

      
    }     }

      
  ]   ]

      
} }

      
 

      
   A subsequent request for the 'Tour Guides' Group ('e9e30dba-    A subsequent request for the 'Tour Guides' Group ('e9e30dba-

      
   f08f-4109-8486-d5c6a331660a') returns the following:    f08f-4109-8486-d5c6a331660a') returns the following:

      
 

      

      
   GET /v1/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a    GET /v2/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a

      
   Host: example.com    Host: example.com

      
   Accept: application/json    Accept: application/json

      
   Authorization: Bearer h480djs93hd8    Authorization: Bearer h480djs93hd8

      
 

      
HTTP/1.1 200 OK HTTP/1.1 200 OK

      
Content-Type: application/json Content-Type: application/json

      

      
Location: https://example.com/v1/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a Location: https://example.com/v2/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a

      
ETag: W/"lha5bbazU3fNvfe5" ETag: W/"lha5bbazU3fNvfe5"

      
 

      
{ {

      
  "schemas": ["urn:scim:schemas:core:2.0:Group"],   "schemas": ["urn:scim:schemas:core:2.0:Group"],

      
  "id": "e9e30dba-f08f-4109-8486-d5c6a331660a",   "id": "e9e30dba-f08f-4109-8486-d5c6a331660a",

      
  "displayName": "Tour Guides",   "displayName": "Tour Guides",

      
  "meta": {   "meta": {

      
    "resourceType": "Group",     "resourceType": "Group",

      
    "created": "2011-08-01T18:29:49.793Z",     "created": "2011-08-01T18:29:49.793Z",

      
    "lastModified": "2011-08-01T20:31:02.315Z",     "lastModified": "2011-08-01T20:31:02.315Z",

      

      
    "location": "https://example.com/v1/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a",     "location": "https://example.com/v2/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a",

      
    "version": "W\/\"lha5bbazU3fNvfe5\""     "version": "W\/\"lha5bbazU3fNvfe5\""

      
  },   },

      
  "members": [   "members": [

      
    {     {

      
      "value": "92b725cd-9465-4e7d-8c16-01f8e146b87a",       "value": "92b725cd-9465-4e7d-8c16-01f8e146b87a",

      

      
      "$ref": "https://example.com/v1/Users/92b725cd-9465-4e7d-8c16-01f8e146b87a",       "$ref": "https://example.com/v2/Users/92b725cd-9465-4e7d-8c16-01f8e146b87a",

      
      "type": "User"       "type": "User"

      
    }     }

      
  ]   ]

      
} }

      
 

      

      
   Extensions that include references to other Resources MUST be handled    Extensions that include references to other resources MUST be handled

      
   in the same way by the Service Provider.  The following example uses    in the same way by the service provider.  The following example uses

      
   the bulkId attribute within the enterprise extension managerId    the bulkId attribute within the enterprise extension managerId

      
   attribute.    attribute.

      
 

      

      
   POST /v1/Bulk    POST /v2/Bulk

      
   Host: example.com    Host: example.com

      
   Accept: application/json    Accept: application/json

      
   Content-Type: application/json    Content-Type: application/json

      
   Authorization: Bearer h480djs93hd8    Authorization: Bearer h480djs93hd8

      
   Content-Length: ...    Content-Length: ...

      
 

      
   {    {

      
     "schemas": ["urn:scim:schemas:core:2.0:BulkRequest"],      "schemas": ["urn:scim:schemas:core:2.0:BulkRequest"],

      
     "Operations": [      "Operations": [

      
       {        {

      
 

      
skipping to change at page 41, line 46 skipping to change at page 41, line 46

      
             "manager": {              "manager": {

      
               "managerId": "batchId:qwerty",                "managerId": "batchId:qwerty",

      
               "displayName": "Alice"                "displayName": "Alice"

      
             }              }

      
           }            }

      
         }          }

      
       }        }

      
     ]      ]

      
   }    }

      
 

      

      
   The Service Provider MUST try to resolve circular cross references    The service provider MUST try to resolve circular cross references

      
   between Resources in a single bulk job but MAY stop after a failed    between resources in a single bulk job but MAY stop after a failed

      
   attempt and instead return the status code 409 Conflict.  The    attempt and instead return the status code 409 Conflict.  The

      
   following example exhibits the potential conflict.    following example exhibits the potential conflict.

      
 

      

      
   POST /v1/Bulk    POST /v2/Bulk

      
   Host: example.com    Host: example.com

      
   Accept: application/json    Accept: application/json

      
   Content-Type: application/json    Content-Type: application/json

      
   Authorization: Bearer h480djs93hd8    Authorization: Bearer h480djs93hd8

      
   Content-Length: ...    Content-Length: ...

      
 

      
   {    {

      
     "schemas": ["urn:scim:schemas:core:2.0:BulkRequest"],      "schemas": ["urn:scim:schemas:core:2.0:BulkRequest"],

      
     "Operations": [      "Operations": [

      
       {        {

      
 

      
skipping to change at page 42, line 48 skipping to change at page 42, line 48

      
             {              {

      
               "type": "group",                "type": "group",

      
               "value": "bulkId:qwerty"                "value": "bulkId:qwerty"

      
             }              }

      
           ]            ]

      
         }          }

      
       }        }

      
     ]      ]

      
   }    }

      
 

      

      
   If the Service Provider resolved the above circular references the    If the service provider resolved the above circular references the

      
   following is returned from a subsequent GET request.    following is returned from a subsequent GET request.

      
 

      

      
   GET /v1/Groups?filter=displayName sw 'Group'    GET /v2/Groups?filter=displayName sw 'Group'

      
   Host: example.com    Host: example.com

      
   Accept: application/json    Accept: application/json

      
   Authorization: Bearer h480djs93hd8    Authorization: Bearer h480djs93hd8

      
 

      
HTTP/1.1 200 OK HTTP/1.1 200 OK

      
Content-Type: application/json Content-Type: application/json

      
 

      
{ {

      
  "schemas": ["urn:scim:schemas:core:2.0:ListResponse"],   "schemas": ["urn:scim:schemas:core:2.0:ListResponse"],

      
  "totalResults": 2,   "totalResults": 2,

      
  "Resources": [   "Resources": [

      
    {     {

      
      "id": "c3a26dd3-27a0-4dec-a2ac-ce211e105f97",       "id": "c3a26dd3-27a0-4dec-a2ac-ce211e105f97",

      
      "schemas": ["urn:scim:schemas:core:2.0:Group"],       "schemas": ["urn:scim:schemas:core:2.0:Group"],

      
      "displayName": "Group A",       "displayName": "Group A",

      
      "meta": {       "meta": {

      
        "resourceType": "Group",         "resourceType": "Group",

      
        "created": "2011-08-01T18:29:49.793Z",         "created": "2011-08-01T18:29:49.793Z",

      
        "lastModified": "2011-08-01T18:29:51.135Z",         "lastModified": "2011-08-01T18:29:51.135Z",

      

      
        "location": "https://example.com/v1/Groups/c3a26dd3-27a0-4dec-a2ac-ce211e105f97",         "location": "https://example.com/v2/Groups/c3a26dd3-27a0-4dec-a2ac-ce211e105f97",

      
        "version": "W\/\"mvwNGaxB5SDq074p\""         "version": "W\/\"mvwNGaxB5SDq074p\""

      
      },       },

      
      "members": [       "members": [

      
        {         {

      
          "value": "6c5bb468-14b2-4183-baf2-06d523e03bd3",           "value": "6c5bb468-14b2-4183-baf2-06d523e03bd3",

      

      
          "$ref": "https://example.com/v1/Groups/6c5bb468-14b2-4183-baf2-06d523e03bd3",           "$ref": "https://example.com/v2/Groups/6c5bb468-14b2-4183-baf2-06d523e03bd3",

      
          "type": "Group"           "type": "Group"

      
        }         }

      
      ]       ]

      
    },     },

      
    {     {

      
      "id": "6c5bb468-14b2-4183-baf2-06d523e03bd3",       "id": "6c5bb468-14b2-4183-baf2-06d523e03bd3",

      
      "schemas": ["urn:scim:schemas:core:2.0:Group"],       "schemas": ["urn:scim:schemas:core:2.0:Group"],

      
      "displayName": "Group B",       "displayName": "Group B",

      
      "meta": {       "meta": {

      
        "resourceType": "Group",         "resourceType": "Group",

      
        "created": "2011-08-01T18:29:50.873Z",         "created": "2011-08-01T18:29:50.873Z",

      
        "lastModified": "2011-08-01T18:29:50.873Z",         "lastModified": "2011-08-01T18:29:50.873Z",

      

      
        "location": "https://example.com/v1/Groups/6c5bb468-14b2-4183-baf2-06d523e03bd3",         "location": "https://example.com/v2/Groups/6c5bb468-14b2-4183-baf2-06d523e03bd3",

      
        "version": "W\/\"wGB85s2QJMjiNnuI\""         "version": "W\/\"wGB85s2QJMjiNnuI\""

      
      },       },

      
      "members": [       "members": [

      
        {         {

      
          "value": "c3a26dd3-27a0-4dec-a2ac-ce211e105f97",           "value": "c3a26dd3-27a0-4dec-a2ac-ce211e105f97",

      

      
          "$ref": "https://example.com/v1/Groups/c3a26dd3-27a0-4dec-a2ac-ce211e105f97",           "$ref": "https://example.com/v2/Groups/c3a26dd3-27a0-4dec-a2ac-ce211e105f97",

      
          "type": "Group"           "type": "Group"

      
        }         }

      
      ]       ]

      
    }     }

      
  ]   ]

      
} }

      

      
   The Service Provider MUST define the maximum number of operations and    The service provider MUST define the maximum number of operations and

      
   maximum payload size a Consumer may send in a single request.  If    maximum payload size a client may send in a single request.  If

      
   either limits are exceeded the Service Provider MUST return the HTTP    either limits are exceeded the service provider MUST return the HTTP

      
   response code 413 Request Entity Too Large.  The returned response    response code 413 Request Entity Too Large.  The returned response

      
   MUST specify the limit exceeded in the body of the error response.    MUST specify the limit exceeded in the body of the error response.

      
 

      

      
   The following example the Consumer sent a request exceeding the    The following example the client sent a request exceeding the service

      
   Service Provider's max payload size of 1 megabyte.    provider's max payload size of 1 megabyte.

      
 

      

      
   POST /v1/Bulk    POST /v2/Bulk

      
   Host: example.com    Host: example.com

      
   Accept: application/json    Accept: application/json

      
   Content-Type: application/json    Content-Type: application/json

      
   Authorization: Bearer h480djs93hd8    Authorization: Bearer h480djs93hd8

      
   Content-Length: 4294967296    Content-Length: 4294967296

      
 

      
   ...    ...

      
 

      
HTTP/1.1 413 Request Entity Too Large HTTP/1.1 413 Request Entity Too Large

      
Content-Type: application/json Content-Type: application/json

      

      
Location: https://example.com/v1/Bulk/yfCrVJhFIJagAHj8 Location: https://example.com/v2/Bulk/yfCrVJhFIJagAHj8

      
 

      
{ {

      
  "schemas":["urn:scim:schemas:core:2.0:Error"],   "schemas":["urn:scim:schemas:core:2.0:Error"],

      
  "Errors":[   "Errors":[

      
    {     {

      
      "description":"The size of the bulk operation exceeds the maxPayloadSize (1048576).",       "description":"The size of the bulk operation exceeds the maxPayloadSize (1048576).",

      
      "code":"413"       "code":"413"

      
    }     }

      
  ]   ]

      
} }

      
 

      
3.6.  Data Input/Output Formats 3.6.  Data Input/Output Formats

      
 

      

      
   Consumers MUST specify the format in which the data is submitted via    Clients MUST specify the format in which the data is submitted via

      
   the HTTP header content-type [10] and MAY specify the desired    the Section 14.17 HTTP header content-type [RFC2616] and MAY specify

      
   response data format via an HTTP Accept Header; e.g.,"Accept:    the desired response data format via an HTTP Accept Header;

      
   application/json" or via URI suffix; e.g.,    e.g.,"Accept: application/json" or via URI suffix; e.g.,

      
 

      
   GET /Users/2819c223-7f76-453a-919d-413861904646.json    GET /Users/2819c223-7f76-453a-919d-413861904646.json

      
   Host: example.com    Host: example.com

      
 

      

      
   Service Providers MUST support the Accept Headers "Accept:    Service providers MUST support the Accept Headers "Accept:

      
   application/json" for JSON [11].  The format defaults to JSON if no    application/json" for [RFC4627].  The format defaults to JSON if no

      
   format is specified.    format is specified.

      
 

      
   Singular attributes are encoded as string name-value-pairs in JSON;    Singular attributes are encoded as string name-value-pairs in JSON;

      
   e.g.,    e.g.,

      
 

      
   "attribute": "value"    "attribute": "value"

      
 

      
   Multi-valued attributes in JSON are encoded as arrays; e.g.,    Multi-valued attributes in JSON are encoded as arrays; e.g.,

      
 

      
   "attributes": [ "value1", "value2" ]    "attributes": [ "value1", "value2" ]

      
 

      
   Elements with nested elements are represented as objects in JSON;    Elements with nested elements are represented as objects in JSON;

      
   e.g,    e.g,

      
 

      
   "attribute": { "subattribute1": "value1", "subattribute2": "value2" }    "attribute": { "subattribute1": "value1", "subattribute2": "value2" }

      
 

      
3.7.  Additional retrieval query parameters 3.7.  Additional retrieval query parameters

      
 

      

      
   Consumers MAY request a partial Resource representation on any    Clients MAY request a partial resource representation on any

      
   operation that returns a Resource within the response by specifying    operation that returns a resource within the response by specifying

      
   the URL query parameter 'attributes'.  When specified, each Resource    the URL query parameter 'attributes'.  When specified, each resource

      
   returned MUST contain the minimal set of Resource attributes and MUST    returned MUST contain the minimal set of resource attributes and MUST

      
   contain no other attributes or Sub-Attributes than those explicitly    contain no other attributes or Sub-Attributes than those explicitly

      
   requested.  The query parameter attributes value is a comma separated    requested.  The query parameter attributes value is a comma separated

      

      
   list of Resource attribute names in standard attribute notation    list of resource attribute names in standard attribute notation

      
   (Section 3.8) form (e.g. userName, name, emails).    (Section 3.8) form (e.g. userName, name, emails).

      
 

      
   GET /Users/2819c223-7f76-453a-919d-413861904646?attributes=userName    GET /Users/2819c223-7f76-453a-919d-413861904646?attributes=userName

      
   Host: example.com    Host: example.com

      
   Accept: application/json    Accept: application/json

      
   Authorization: Bearer h480djs93hd8    Authorization: Bearer h480djs93hd8

      
 

      
   Giving the response    Giving the response

      
 

      
HTTP/1.1 200 OK HTTP/1.1 200 OK

      
Content-Type: application/json Content-Type: application/json

      

      
Location: https://example.com/v1/Users/2819c223-7f76-453a-919d-413861904646 Location: https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646

      
ETag: W/"a330bc54f0671c9" ETag: W/"a330bc54f0671c9"

      
 

      
{ {

      
  "schemas":["urn:scim:schemas:core:2.0:User"],   "schemas":["urn:scim:schemas:core:2.0:User"],

      
  "id":"2819c223-7f76-453a-919d-413861904646",   "id":"2819c223-7f76-453a-919d-413861904646",

      
  "userName":"bjensen",   "userName":"bjensen",

      
  "meta":{   "meta":{

      
    "resourceType": "User",     "resourceType": "User",

      
    "created":"2011-08-01T18:29:49.793Z",     "created":"2011-08-01T18:29:49.793Z",

      
    "lastModified":"2011-08-01T18:29:49.793Z",     "lastModified":"2011-08-01T18:29:49.793Z",

      

      
    "location":"https://example.com/v1/Users/2819c223-7f76-453a-919d-413861904646",     "location":"https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646",

      
    "version":"W\/\"a330bc54f0671c9\""     "version":"W\/\"a330bc54f0671c9\""

      
  }   }

      
} }

      
 

      
3.8.  Attribute Notation 3.8.  Attribute Notation

      
 

      
   All operations share a common scheme for referencing simple and    All operations share a common scheme for referencing simple and

      
   complex attributes.  In general, attributes are identified by    complex attributes.  In general, attributes are identified by

      
   prefixing the attribute name with its schema URN separated by a ':'    prefixing the attribute name with its schema URN separated by a ':'

      

      
   character; e.g., the core User Resource attribute 'userName' is    character; e.g., the core User resource attribute 'userName' is

      
   identified as 'urn:scim:schemas:core:2.0:userName'.  Consumers MAY    identified as 'urn:scim:schemas:core:2.0:User:userName'.  Clients MAY

      
   omit core schema attribute URN prefixes though MUST fully qualify    omit core schema attribute URN prefixes though MUST fully qualify

      

      
   extended attributes with the associated Resource URN; e.g., the    extended attributes with the associated resource URN; e.g., the

      
   attribute 'age' defined in 'urn:hr:schemas:user' is fully encoded as    attribute 'age' defined in 'urn:hr:schemas:user' is fully encoded as

      
   'urn:hr:schemas:user:age'.  A Complex attributes' Sub-Attributes are    'urn:hr:schemas:user:age'.  A Complex attributes' Sub-Attributes are

      
   referenced via nested, dot ('.') notation; i.e., {urn}:{Attribute    referenced via nested, dot ('.') notation; i.e., {urn}:{Attribute

      

      
   name}.{Sub-Attribute name}.  For example, the fully qualified path    name}.{Sub-Attribute name}. For example, the fully qualified path for

      
   for a User's givenName is urn:scim:schemas:core:2.0:name.givenName    a User's givenName is urn:scim:schemas:core:2.0:User:name.givenName

      
   All facets (URN, attribute and Sub-Attribute name) of the fully    All facets (URN, attribute and Sub-Attribute name) of the fully

      
   encoded Attribute name are case insensitive.    encoded Attribute name are case insensitive.

      
 

      
3.9.  HTTP Response Codes 3.9.  HTTP Response Codes

      
 

      

      
   The SCIM Protocol uses the response status codes defined in HTTP [12]    The SCIM Protocol uses the response status codes defined in HTTP

      
   to indicate operation success or failure.  In addition to returning a    Section 10 [RFC2616] to indicate operation success or failure.  In

      
   HTTP response code implementers MUST return the errors in the body of    addition to returning a HTTP response code implementers MUST return

      
   the response in the client requested format containing the error    the errors in the body of the response in the client requested format

      
   response and, per the HTTP specification, human-readable    containing the error response and, per the HTTP specification, human-

      
   explanations.  Error responses are identified using the following    readable explanations.  Error responses are identified using the

      
   URI: 'urn:scim:schemas:core:2.0:Error'.  The following multi-valued    following URI: 'urn:scim:schemas:core:2.0:Error'.  The following

      
   attribute is defined in addition to those attributes defined in SCIM    multi-valued attribute is defined in addition to those attributes

      
   Core Schema:    defined in SCIM Core Schema:

      
 

      

      
   Errors  The list of errors encountered by the Service Provider.  The    Errors  The list of errors encountered by the service provider.  The

      
      value attribute is a complex type with the following sub-       value attribute is a complex type with the following sub-

      
      attributes.       attributes.

      
 

      
      description  A human-readable explanation of the error.  REQUIRED.       description  A human-readable explanation of the error.  REQUIRED.

      
 

      
      code  A string indicating the HTTP response code.  REQUIRED.       code  A string indicating the HTTP response code.  REQUIRED.

      
 

      
   Implementers SHOULD handle the identified errors as described below.    Implementers SHOULD handle the identified errors as described below.

      
 

      

      
   +--------------+---------------------------+------------------------+    +--------------+---------------+------------------------------------+

      
   | Code         | Applicability             | Suggested Explanation  |    | Code         | Applicability             | Suggested Explanation  |

      

      
   +--------------+---------------------------+------------------------+    +--------------+---------------+------------------------------------+

      
   | 400 BAD      | GET,POST,PUT,PATCH,DELETE | Request is             |    | 307          | GET, POST,    | The client is directed to repeat   |

      
   | REQUEST      |                           | unparseable,           |    | TEMPORARY    | PUT, PATCH,   | the same HTTP request at the       |

      
   |              |                           | syntactically          |    | REDIRECT     | DELETE        | location identified. The client    |

      
   |              |                           | incorrect, or violates |    |              |               | SHOULD NOT use the location        |

      
   |              |                           | schema                 |    |              |               | provided in the response as a      |

      
   | 401          | GET,POST,PUT,PATCH,DELETE | Authorization failure  |    |              |               | permanent reference to the         |

      
   | UNAUTHORIZED |                           |                        |    |              |               | resource and SHOULD continue to    |

      
   | 403          | GET,POST,PUT,PATCH,DELETE | Server does not        |    |              |               | use the original request URI       |

      
   | FORBIDDEN    |                           | support requested      |    |              |               | [I-D.ietf-httpbis-p2-semantics].   |

      
   |              |                           | operation              |    | 308          | GET, POST,    | The client is directed to repeat   |

      
   | 404 NOT      | GET,PUT,PATCH,DELETE      | Specified resource;    |    | PERMANENT    | PUT, PATCH,   | the same HTTP request at the       |

      
   | FOUND        |                           | e.g., User, does not   |    | REDIRECT     | DELETE        | location identified. The client    |

      
   |              |                           | exist                  |    |              |               | SHOULD use the location provided   |

      
   | 409 CONFLICT | POST, PUT,PATCH,DELETE    | The specified version  |    |              |               | in the response as the permanent   |

      
   |              |                           | number does not match  |    |              |               | reference to the resource          |

      
   |              |                           | the resource's latest  |    |              |               | [I-D.reschke-http-status-308].     |

      
   |              |                           | version number or a    |    | 400 BAD      | GET, POST,    | Request is unparseable,            |

      
   |              |                           | Service Provider       |    | REQUEST      | PUT, PATCH,   | syntactically incorrect, or        |

      
   |              |                           | refused to create a    |    |              | DELETE        | violates schema                    |

      
   |              |                           | new, duplicate         |    | 401          | GET, POST,    | Authorization failure              |

      
   |              |                           | resource               |    | UNAUTHORIZED | PUT, PATCH,   |                                    |

      
   | 412          | PUT,PATCH,DELETE          | Failed to update as    |    |              | DELETE        |                                    |

      
   | PRECONDITION |                           | Resource {id} changed  |    | 403          | GET, POST,    | Server does not support requested  |

      
   | FAILED       |                           | on the server last     |    | FORBIDDEN    | PUT, PATCH,   | operation                          |

      
   |              |                           | retrieved              |    |              | DELETE        |                                    |

      
    | 404 NOT      | GET, PUT,     | Specified resource; e.g., User,    |

      
    | FOUND        | PATCH, DELETE | does not exist                     |

      
    | 409 CONFLICT | POST, PUT,    | The specified version number does  |

      
    |              | PATCH, DELETE | not match the resource's latest    |

      
    |              |               | version number or a service        |

      
    |              |               | provider refused to create a new,  |

      
    |              |               | duplicate resource                 |

      
    | 412          | PUT, PATCH,D  | Failed to update as resource {id}  |

      
    | PRECONDITION | ELETE         | changed on the server last         |

      
    | FAILED       |               | retrieved                          |

      
   | 413 REQUEST  | POST                      | {"maxOperations":      |    | 413 REQUEST  | POST                      | {"maxOperations":      |

      

      
   | ENTITY TOO   |                           | 1000,"maxPayload":     |    | ENTITY TOO   |               | 1000,"maxPayload": 1048576}        |

      
   | LARGE        |                           | 1048576}               |    | LARGE        |               |                                    |

      
   | 500 INTERNAL | GET,POST,PUT,PATCH,DELETE | An internal error.     |    | 500 INTERNAL | GET, POST,    | An internal error. Implementers    |

      
   | SERVER ERROR |                           | Implementers SHOULD    |    | SERVER ERROR | PUT, PATCH,   | SHOULD provide descriptive         |

      
   |              |                           | provide descriptive    |    |              | DELETE        | debugging advice                   |

      
   |              |                           | debugging advice       |    | 501 NOT      | GET, POST,    | Service Provider does not support  |

      
   | 501 NOT      | GET,POST,PUT,PATCH,DELETE | Service Provider does  |    | IMPLEMENTED  | PUT, PATCH,   | the request operation; e.g., PATCH |

      
   | IMPLEMENTED  |                           | not support the        |    |              | DELETE        |                                    |

      
   |              |                           | request operation;     |    +--------------+---------------+------------------------------------+

      
   |              |                           | e.g., PATCH            | 

      
   +--------------+---------------------------+------------------------+ 

      
 

      
                       Table 7: Defined error cases                        Table 7: Defined error cases

      
 

      
   Error example in response to a non-existent GET request.    Error example in response to a non-existent GET request.

      
 

      
HTTP/1.1 404 NOT FOUND HTTP/1.1 404 NOT FOUND

      
 

      
{ {

      
  "schemas": ["urn:scim:schemas:core:2.0:Error"],   "schemas": ["urn:scim:schemas:core:2.0:Error"],

      
  "Errors":[   "Errors":[

      
 

      
skipping to change at page 50, line 22 skipping to change at page 49, line 36

      
      "code":"404"       "code":"404"

      
    }     }

      
  ]   ]

      
} }

      
 

      
3.10.  API Versioning 3.10.  API Versioning

      
 

      
   The Base URL MAY be appended with a version identifier as a separate    The Base URL MAY be appended with a version identifier as a separate

      
   segment in the URL path.  At this time the only valid identifier is    segment in the URL path.  At this time the only valid identifier is

      
   'v1'.  If specified, the version identifier MUST appear in the URL    'v1'.  If specified, the version identifier MUST appear in the URL

      

      
   path immediately preceding the Resource endpoint and conform to the    path immediately preceding the resource endpoint and conform to the

      
   following scheme: the character 'v' followed by the desired SCIM    following scheme: the character 'v' followed by the desired SCIM

      

      
   version number; e.g., a version 'v1' User request is specified as /v1    version number; e.g., a version 'v1' User request is specified as /v2

      
   /Users.  When specified Service Providers MUST perform the operation    /Users.  When specified service providers MUST perform the operation

      
   using the desired version or reject the request.  When omitted    using the desired version or reject the request.  When omitted

      

      
   Service Providers SHOULD perform the operation using the most recent    service providers SHOULD perform the operation using the most recent

      
   API supported by the Service Provider.    API supported by the service provider.

      
 

      
3.11.  Versioning Resources 3.11.  Versioning Resources

      
 

      

      
   The API supports resource versioning via standard HTTP ETags [13].    The API supports resource versioning via standard HTTP

      
   Service providers MAY support weak ETags as the preferred mechanism    ETagsSection 14.19 [RFC2616].  Service providers MAY support weak

      
   for performing conditional retrievals and ensuring Consumers do not    ETags as the preferred mechanism for performing conditional

      
   inadvertently overwrite each others changes, respectively.  When    retrievals and ensuring clients do not inadvertently overwrite each

      
   supported SCIM ETags MUST be specified as an HTTP header and SHOULD    others changes, respectively.  When supported SCIM ETags MUST be

      
   be specified within the 'version' attribute contained in the    specified as an HTTP header and SHOULD be specified within the

      
   Resource's 'meta' attribute.    'version' attribute contained in the resource's 'meta' attribute.

      
 

      
   Example:    Example:

      
 

      
   POST /Users  HTTP/1.1    POST /Users  HTTP/1.1

      
   Host: example.com    Host: example.com

      
   Content-Type:  application/json    Content-Type:  application/json

      
   Authorization: Bearer h480djs93hd8    Authorization: Bearer h480djs93hd8

      
   Content-Length: ...    Content-Length: ...

      
 

      
   {    {

      
 

      
skipping to change at page 51, line 27 skipping to change at page 50, line 31

      
       "familyName":"Jensen",        "familyName":"Jensen",

      
       "givenName":"Barbara"        "givenName":"Barbara"

      
     }      }

      
   }    }

      
 

      
   The server responds with an ETag in the response header and meta    The server responds with an ETag in the response header and meta

      
   structure.    structure.

      
 

      
HTTP/1.1 201 Created HTTP/1.1 201 Created

      
Content-Type: application/json Content-Type: application/json

      

      
Location: https://example.com/v1/Users/2819c223-7f76-453a-919d-413861904646 Location: https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646

      
ETag: W/"e180ee84f0671b1" ETag: W/"e180ee84f0671b1"

      
 

      
{ {

      
  "schemas":["urn:scim:schemas:core:2.0:User"],   "schemas":["urn:scim:schemas:core:2.0:User"],

      
  "id":"2819c223-7f76-453a-919d-413861904646",   "id":"2819c223-7f76-453a-919d-413861904646",

      
  "meta":{   "meta":{

      
    "resourceType":"User",     "resourceType":"User",

      
    "created":"2011-08-01T21:32:44.882Z",     "created":"2011-08-01T21:32:44.882Z",

      
    "lastModified":"2011-08-01T21:32:44.882Z",     "lastModified":"2011-08-01T21:32:44.882Z",

      

      
    "location":"https://example.com/v1/Users/2819c223-7f76-453a-919d-413861904646",     "location":"https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646",

      
    "version":"W\/\"e180ee84f0671b1\""     "version":"W\/\"e180ee84f0671b1\""

      
  },   },

      
  "name":{   "name":{

      
    "formatted":"Ms. Barbara J Jensen III",     "formatted":"Ms. Barbara J Jensen III",

      
    "familyName":"Jensen",     "familyName":"Jensen",

      
    "givenName":"Barbara"     "givenName":"Barbara"

      
  },   },

      
  "userName":"bjensen"   "userName":"bjensen"

      
} }

      

      
    With the returned ETag, clients MAY choose to retrieve the resource

      
    only if the resource has been modified.

      
 

      

      
   With the returned ETag, Consumers MAY choose to retrieve the Resource    Conditional retrieval example using If-None-Match Section 14.26

      
   only if the Resource has been modified.    [RFC2616] header:

      
                                                                          

      
   Conditional retrieval example using If-None-Match [14] header: 

      
 

      
  GET /Users/2819c223-7f76-453a-919d-413861904646?attributes=displayName   GET /Users/2819c223-7f76-453a-919d-413861904646?attributes=displayName

      
  Host: example.com   Host: example.com

      
  Accept: application/json   Accept: application/json

      
  Authorization: Bearer h480djs93hd8   Authorization: Bearer h480djs93hd8

      
  If-None-Match: W/"e180ee84f0671b1"   If-None-Match: W/"e180ee84f0671b1"

      
 

      

      
   If the Resource has not changed the Service Provider simply returns    If the resource has not changed the service provider simply returns

      
   an empty body with a 304 "Not Modified" response code.    an empty body with a 304 "Not Modified" response code.

      
 

      

      
   If the Service Providers supports versioning of resources the    If the service providers supports versioning of resources the client

      
   Consumer MUST supply an If-Match [15] header for PUT and PATCH    MUST supply an If-Match Section 14.24 [RFC2616] header for PUT and

      
   operations to ensure that the requested operation succeeds only if    PATCH operations to ensure that the requested operation succeeds only

      
   the supplied ETag matches the latest Service Provider Resource; e.g.,    if the supplied ETag matches the latest service provider resource;

      
   If-Match: W/"e180ee84f0671b1"    e.g., If-Match: W/"e180ee84f0671b1"

      
 

      
3.12.  HTTP Method Overloading 3.12.  HTTP Method Overloading

      
 

      
   In recognition that some clients, servers and firewalls prevent PUT,    In recognition that some clients, servers and firewalls prevent PUT,

      
   PATCH and DELETE operations a client MAY override the POST operation    PATCH and DELETE operations a client MAY override the POST operation

      
   by specifying the custom header "X-HTTP-Method-Override" with the    by specifying the custom header "X-HTTP-Method-Override" with the

      
   desired PUT, PATCH, DELETE operation.  For example:    desired PUT, PATCH, DELETE operation.  For example:

      
 

      
   POST /Users/2819c223-7f76-453a-919d-413861904646    POST /Users/2819c223-7f76-453a-919d-413861904646

      
   X-HTTP-Method-Override: DELETE    X-HTTP-Method-Override: DELETE

      
 

      
4.  Multi-Tenancy 4.  Multi-Tenancy

      
 

      

      
   A single Service Provider may expose the SCIM protocol to multiple    A single service provider may expose the SCIM protocol to multiple

      
   Consumers.  Depending on the nature of the service, the Consumers may    clients.  Depending on the nature of the service, the clients may

      
   have authority to access and alter Resources initially created by    have authority to access and alter resources initially created by

      
   other Consumers.  Alternatively, Consumers may expect to access    other clients.  Alternatively, clients may expect to access disjoint

      
   disjoint sets of Resources, and may expect that their resources are    sets of resources, and may expect that their resources are

      
   inaccessible by other Consumers.  These scenarios are called "multi-    inaccessible by other clients.  These scenarios are called "multi-

      
   tenancy", where each Consumer is understood to be or represent a    tenancy", where each client is understood to be or represent a

      
   "tenant" of the Service Provider.  Consumers may also be multi-    "tenant" of the service provider.  Clients may also be multi-

      
   tenanted.    tenanted.

      
 

      
   The following common cases may occur:    The following common cases may occur:

      
 

      

      
   1.  All Consumers share all Resources (no tenancy)    1.  All clients share all resources (no tenancy)

      
    2.  Each single client creates and accesses a private subset of

      
        resources (1 client:1 Tenant)

      
 

      

      
   2.  Each single Consumer creates and accesses a private subset of    3.  Sets of clients share sets of resources (M clients:1 Tenant)

      
       Resources (1 Consumer:1 Tenant) 

      
 

      

      
   3.  Sets of Consumers share sets of Resources (M Consumers:1 Tenant)    4.  One client to Multiple Tenants (1 client:M Tenants)

      
   4.  One Consumer to Multiple Tenants (1 Consumer:M Tenants) 

      
 

      

      
   Service Providers may implement any subset of the above cases.    Service providers may implement any subset of the above cases.

      
 

      
   Multi-Tenancy is OPTIONAL.  The SCIM protocol does not define a    Multi-Tenancy is OPTIONAL.  The SCIM protocol does not define a

      
   scheme for multi-tenancy.    scheme for multi-tenancy.

      
 

      

      
   The SCIM protocol does not prescribe the mechanisms whereby Consumers    The SCIM protocol does not prescribe the mechanisms whereby clients

      
   and Service Providers interact for:    and service providers interact for:

      
 

      
   o  Registering or provisioning Tenants    o  Registering or provisioning Tenants

      
 

      

      
   o  Associating a subset of Consumers with a subset of the Tenants    o  Associating a subset of clients with a subset of the Tenants

      
 

      
   o  Indicating which tenant is associated with the data in a request    o  Indicating which tenant is associated with the data in a request

      
      or response, or indicating which Tenant is the subject of a query       or response, or indicating which Tenant is the subject of a query

      
 

      
   o  Implementers are encouraged to use mechanisms which comply with    o  Implementers are encouraged to use mechanisms which comply with

      
      RESTful conventions.       RESTful conventions.

      
 

      

      
4.1.  Associating Consumers to Tenants 4.1.  Associating Clients to Tenants

      
 

      

      
   The Service Provider MAY use the authentication mechanism (Section 2)    The service provider MAY use the authentication mechanism (Section 2)

      
   to determine the identity of the Consumer, and thus infer the    to determine the identity of the client, and thus infer the

      
   associated Tenant.    associated Tenant.

      
 

      

      
   For implementations where a Consumer is associated with more than one    For implementations where a client is associated with more than one

      
   Tenant, the Service Provider MAY use one of the following methods for    Tenant, the service provider MAY use one of the following methods for

      
   explicit specification of the Tenant.    explicit specification of the Tenant.

      
 

      

      
   If any of these methods of allowing the Consumer to explicitly    If any of these methods of allowing the client to explicitly specify

      
   specify the Tenant are employed, the Service Provider should ensure    the Tenant are employed, the service provider should ensure that

      
   that access controls are in place to prevent or allow cross-tenant    access controls are in place to prevent or allow cross-tenant use

      
   use cases.    cases.

      
 

      

      
   The Service Provider should consider precedence in cases where a    The service provider should consider precedence in cases where a

      
   Consumer may explicitly specify a Tenant while being implicitly    client may explicitly specify a Tenant while being implicitly

      
   associated with a different Tenant.    associated with a different Tenant.

      
 

      
4.1.1.  URL Prefix Example 4.1.1.  URL Prefix Example

      
 

      

      
   https://www.example.com/Tenants/{tenant_id}/v1/Users    https://www.example.com/Tenants/{tenant_id}/v2/Users

      
 

      
4.1.2.  Subdomain Example 4.1.2.  Subdomain Example

      
 

      

      
   https://{tenant_id}.example.com/v1/Groups    https://{tenant_id}.example.com/v2/Groups

      
 

      
4.1.3.  HTTP Header 4.1.3.  HTTP Header

      
 

      

      
   The Service Provider may recognize a {tenant_id} provided by the    The service provider may recognize a {tenant_id} provided by the

      
   Consumer in the HTTP Header "SCIM_TENANT_ID" as the indicator of the    client in the HTTP Header "SCIM_TENANT_ID" as the indicator of the

      
   desired target Tenant.    desired target Tenant.

      
 

      
   In all of these methods, the {tenant_id} is a unique identifier for    In all of these methods, the {tenant_id} is a unique identifier for

      

      
   the Tenant as defined by the Service Provider.    the Tenant as defined by the service provider.

      
 

      
4.2.  SCIM Identifiers with Multiple Tenants 4.2.  SCIM Identifiers with Multiple Tenants

      
 

      
   Considerations for a Multi-Tenant Implementation:    Considerations for a Multi-Tenant Implementation:

      
 

      

      
   The Service Provider may choose to implement SCIM ids which are    The service provider may choose to implement SCIM ids which are

      
   unique across all Resources for all Tenants, but this is not    unique across all resources for all Tenants, but this is not

      
   required.    required.

      
 

      

      
   The externalId, defined by the Consumer, is required to be unique    The externalId, defined by the client, is required to be unique ONLY

      
   ONLY within the Resources associated with the associated Tenant.    within the resources associated with the associated Tenant.

      
 

      
5.  Security Considerations 5.  Security Considerations

      
 

      
   The SCIM Protocol is based on HTTP and thus subject to the security    The SCIM Protocol is based on HTTP and thus subject to the security

      

      
   considerations found in Section 15 of [RFC2616] [16].  SCIM Resources    considerations found in Section 15 of [RFC2616].  SCIM resources

      
   (e.g., Users and Groups) can contain sensitive information.    (e.g., Users and Groups) can contain sensitive information.

      

      
   Therefore, SCIM Consumers and Service Providers MUST implement TLS.    Therefore, SCIM clients and service providers MUST implement TLS.

      
   Which version(s) ought to be implemented will vary over time, and    Which version(s) ought to be implemented will vary over time, and

      
   depend on the widespread deployment and known security    depend on the widespread deployment and known security

      
   vulnerabilities at the time of implementation.  At the time of this    vulnerabilities at the time of implementation.  At the time of this

      

      
   writing, TLS version 1.2 [RFC5246 [17]] is the most recent version,    writing, TLS version 1.2 [RFC5246]] is the most recent version, but

      
   but has very limited actual deployment, and might not be readily    has very limited actual deployment, and might not be readily

      
   available in implementation toolkits.  TLS version 1.0 [RFC2246 [18]]    available in implementation toolkits.  TLS version 1.0 [[RFC2246]] is

      
   is the most widely deployed version, and will give the broadest    the most widely deployed version, and will give the broadest

      
   interoperability.    interoperability.

      
 

      

      
6.  Contributors 6.  References

      
 6.1.  Normative References

      
 

      

      
      Samuel Erdtman (samuel@erdtman.se)    [I-D.ietf-httpbis-p2-semantics]

      
               Fielding, R. and J. Reschke, "Hypertext Transfer Protocol

      
               (HTTP/1.1): Semantics and Content", draft-ietf-

      
               httpbis-p2-semantics-25 (work in progress), November 2013.

      
 

      

      
      Patrick Harding (pharding@pingidentity.com)    [I-D.reschke-http-status-308]

      
               Reschke, J., "The Hypertext Transfer Protocol (HTTP)

      
               Status Code 308 (Permanent Redirect)", draft-reschke-http-

      
               status-308-07 (work in progress), March 2012.

      
 

      

      
7.  Acknowledgments    [IANA.Language]

      
               Internet Assigned Numbers Authority (IANA), "Language

      
               Subtag Registry", 2005.

      
 

      

      
   The editor would like to thank the participants in the the SCIM    [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate

      
   working group for their support of this specification.               Requirement Levels", BCP 14, RFC 2119, March 1997.

      
 

      

      
8.  References    [RFC2246]  Dierks, T. and C. Allen, "The TLS Protocol Version 1.0",

      
               RFC 2246, January 1999.

      
 

      

      
8.1.  URIs    [RFC2616]  Fielding, R., Gettys, J., Mogul, J., Frystyk, H.,

      
               Masinter, L., Leach, P., and T. Berners-Lee, "Hypertext

      
               Transfer Protocol -- HTTP/1.1", RFC 2616, June 1999.

      
 

      

      
   [1] http://tools.ietf.org/html/rfc3986#section-2.1    [RFC3896]  Nicklass, O., "Definitions of Managed Objects for the DS3/

      
               E3 Interface Type", RFC 3896, September 2004.

      
 

      

      
   [2] http://tools.ietf.org/html/draft-ietf-oauth-v2-bearer-14    [RFC4627]  Crockford, D., "The application/json Media Type for

      
               JavaScript Object Notation (JSON)", RFC 4627, July 2006.

      
 

      

      
   [3] http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.2    [RFC5246]  Dierks, T. and E. Rescorla, "The Transport Layer Security

      
               (TLS) Protocol Version 1.2", RFC 5246, August 2008.

      
 

      

      
   [4] http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9    [RFC5789]  Dusseault, L. and J. Snell, "PATCH Method for HTTP", RFC

      
               5789, March 2010.

      
 

      

      
   [5] http://www.json.org    [RFC6750]  Jones, M. and D. Hardt, "The OAuth 2.0 Authorization

      
               Framework: Bearer Token Usage", RFC 6750, October 2012.

      
 

      

      
   [6] http://en.wikipedia.org/wiki/ 6.2.  Informative References

      
       Order_of_operations#Programming_languages 

      
 

      

      
   [7] http://www.opensearch.org/Specifications/OpenSearch/1.1    [OpenSearch]

      
               Clinton, D., "OpenSearch Protocol 1.1, Draft 5", .

      
 

      

      
   [8] http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.6    [Order-Operations]

      
               Wikipedia, "Order of Operations: Programming Languages", .

      
 

      

      
   [9] http://tools.ietf.org/html/rfc5789 Appendix A.  Contributors

      
 

      

      
   [10] http://tools.ietf.org/html/rfc2616#section-14.17       Samuel Erdtman (samuel@erdtman.se)

      
 

      

      
   [11] http://json.org       Patrick Harding (pharding@pingidentity.com)

      
 

      

      
   [12] http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html Appendix B.  Acknowledgments

      
 

      

      
   [13] http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.19    The editor would like to thank the participants in the the SCIM

      
    working group for their support of this specification.

      
 

      

      
   [14] http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.26 Appendix C.  Change Log

      
 

      

      
   [15] http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.24    [[This section to be removed prior to publication as an RFC]]

      
 

      

      
   [16] http://www.w3.org/Protocols/rfc2616/rfc2616-sec15.html#sec15    Draft 02 - KG - Addition of schema extensibility

      
 

      

      
   [17] http://tools.ietf.org/html/rfc5246    Draft 03 - PH - Revisions based on following tickets:

      
 

      

      
   [18] http://tools.ietf.org/html/rfc5246       24 - Add filter negation

      
 

      

      
Authors' Addresses       39 - Clarification on response for DELETE

      
 

      
       42 - Make root searches optional

      
 

      
       49 - Add "ew" filter

      
 

      
       50 - Filters for multi-valued complex attributes

      
 

      
       51 - Search by Schema

      
 

      

      
       53 - Standard use of term client (some was consumer)

      
 

      
       55 - Redirect support (3xx)

      
 

      
       56 - Make manager attribute consistent with other $ref attrs

      
 

      
       57 - Update all "/v1" examples to '?v2"

      
 

      
       59 - Fix capitalization per IETF editor practices

      
 

      
       60 - Changed <eref> tags to normal <xref> and <reference> tags

      
 

      
 Authors' Addresses

      
   Trey Drake (editor)    Trey Drake (editor)

      
   UnboundID    UnboundID

      
 

      
   Email: trey.drake@unboundid.com    Email: trey.drake@unboundid.com

      

      
                                                                          

      
   Chuck Mortimore    Chuck Mortimore

      
   SalesForce    SalesForce

      
 

      
   Email: cmortimore@salesforce.com    Email: cmortimore@salesforce.com

      
 

      
   Morteza Ansari    Morteza Ansari

      
   Cisco    Cisco

      
 

      
   Email: morteza.ansari@cisco.com    Email: morteza.ansari@cisco.com

      
 


     
 

     
 End of changes. 242 change blocks. 

     
429 lines changed or deleted 524 lines changed or added

     

This html diff was produced by rfcdiff 1.41. The latest version is available from http://tools.ietf.org/tools/rfcdiff/ 

   

   
   

--Apple-Mail=_9FD4E9DF-4C58-462A-8317-37413A5F3BBA
Content-Transfer-Encoding: 7bit
Content-Type: text/html;
	charset=us-ascii



--Apple-Mail=_9FD4E9DF-4C58-462A-8317-37413A5F3BBA--

--Apple-Mail=_969C6006-3A48-4536-A407-770E2B51470E--


From wmills@yahoo-inc.com  Tue Feb 11 14:15:33 2014
Return-Path: 
X-Original-To: scim@ietfa.amsl.com
Delivered-To: scim@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E8D91A0773 for ; Tue, 11 Feb 2014 14:15:33 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -15.521
X-Spam-Level: 
X-Spam-Status: No, score=-15.521 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_NEUTRAL=0.779, USER_IN_DEF_WHITELIST=-15] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cu3qH22peQU0 for ; Tue, 11 Feb 2014 14:15:31 -0800 (PST)
Received: from mrout3.yahoo.com (mrout3.yahoo.com [216.145.54.173]) by ietfa.amsl.com (Postfix) with ESMTP id 8DF091A0738 for ; Tue, 11 Feb 2014 14:15:31 -0800 (PST)
Received: from GQ1-EX10-CAHT01.y.corp.yahoo.com (gq1-ex10-caht01.corp.gq1.yahoo.com [10.73.118.80]) by mrout3.yahoo.com (8.14.4/8.14.4/y.out) with ESMTP id s1BMEqQ1012551 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL) for ; Tue, 11 Feb 2014 14:14:53 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=yahoo-inc.com; s=cobra; t=1392156894; bh=dvm5drlIUs9saMBXLcXYDDgDifdUUC/+zZefcQty3Pk=; h=References:Date:From:Reply-To:Subject:In-Reply-To; b=ZmWDpgzsD26fSl7pDNEo7GFG/enlErPkYgrIKIOuloP73rdrjZfXeimOQWeIQ38F7 GKnq9TKF+Qrc4+lexYBa0wlCXI1EAaGvGgt+MMuy0wXf5EJwbhwCKpcGwVaD0+e01l 7w9I1QPgIqQYxb4c6GoXJFoRFdNviuuRoG6qTpBg=
Received: from omp1032.mail.ne1.yahoo.com (98.138.88.232) by GQ1-EX10-CAHT01.y.corp.yahoo.com (10.72.228.24) with Microsoft SMTP Server (TLS) id 14.3.174.1; Tue, 11 Feb 2014 14:14:52 -0800
Received: (qmail 20765 invoked by uid 1000); 11 Feb 2014 22:14:51 -0000
Received: (qmail 93270 invoked by uid 60001); 11 Feb 2014 22:14:51 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo-inc.com; s=ginc1024; t=1392156890; bh=dvm5drlIUs9saMBXLcXYDDgDifdUUC/+zZefcQty3Pk=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=bE51DY6d0xYZKiSjAZgpvN10JqR4wiPd15dLKd/dRmaM2t5vHqo1+mVGGv5dm95TU6iF1JhVFgKk6mhoXy8YnX1yp/UeeDh8EpJqQzS4nz88P729dPix+GI3/4o8MwlS4mDWgfAOmWcdvwmUwGlOz/6Vtc4D1TauWEa04OwrMoQ=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ginc1024; d=yahoo-inc.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=VxJAoVJCZ8JscM/dKJfRpIKbnqwCslWLLJ5ApeeaAwLZH73s5+Rdz5YXcZrHnMi4H+OCVGVA4g6yxtpkro61yz5Bw4okXA1tr0vmA/T4SuVSa5Kp8ivTtHD8HKDckBHMF83W/OiB+30rR++E8t85FDKlCfaxseX8TJvh7bwr7GM=;
X-YMail-OSG: jGA758cVM1ltth7cNo.WKy4AMlDdXp1jrClupx2qShlwboI d6Nky3RvFrGgYc4hU1LpOfqWHwGKcU4bLrFwUt9eI.hKoZTTlPmKUGx71pCr bkyjhS5cke1t8nK.DQyex_jU8knY5uMJ.AHynbQ.RdO9EUBSluxLfirCq32m rM0AC0xxmZv68sGgiy.yuLqQjIJPWs7aC9u21fH2H0jsImyljTiixPnS_kJl Twn.J3gENbMEbPo5X9LHhAjyoQRXFyUfwBOQ227n9F9W0oZ5mAVMOLXl2HYx eVBjLhAswhB9PyBPgPToUXux1
Received: from [209.131.62.115] by web125602.mail.ne1.yahoo.com via HTTP; Tue, 11 Feb 2014 14:14:50 PST
X-Rocket-MIMEInfo: 002.001, CgpUaGlzIGRvZXNuJ3Qgc2NhbiByaWdodC4uLgoKCgoiMy4yLjIuMS7CoMKgUXVlcnkgRW5kcG9pbnRzIAoKUXVlcmllcyBNQVkgYmUgcGVyZm9ybWVkIGFnYWluc3QgYSBTQ0lNIHJlc291cmNlcyBvciByZXNvdXJjZSBlbmRwb2ludHMuwqDCoEZvciBleGFtcGxlOiAiCgoKCgotYmlsbAoKCgotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQpXaWxsaWFtIEouIE1pbGxzCiJQYXJhbm9pZCIgWWFob28hCgoKCgoKT24gVHVlc2RheSwgRmVicnVhcnkgMTEsIDIwMTQgMToyNyBQTSwgUGhpbCBIdW50IDwBMAEBAQE-
X-Mailer: YahooMailWebService/0.8.176.634
References: <0A4561AF-9771-4081-A8DC-429AEB964E18@oracle.com>
Message-ID: <1392156890.89658.YahooMailNeo@web125602.mail.ne1.yahoo.com>
Date: Tue, 11 Feb 2014 14:14:50 -0800
From: Bill Mills 
To: Phil Hunt , "scim@ietf.org WG" 
In-Reply-To: <0A4561AF-9771-4081-A8DC-429AEB964E18@oracle.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Milter-Version: master.31+4-gbc07cd5+
X-CLX-ID: 156893001
Subject: Re: [scim] Prelim changes for draft 03 for tomorrows call
X-BeenThere: scim@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Bill Mills 
List-Id: Simple Cloud Identity Management BOF 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Tue, 11 Feb 2014 22:15:33 -0000

=0A=0AThis doesn't scan right...=0A=0A=0A=0A"3.2.2.1.=A0=A0Query Endpoints =
=0A=0AQueries MAY be performed against a SCIM resources or resource endpoin=
ts.=A0=A0For example: "=0A=0A=0A=0A=0A-bill=0A=0A=0A=0A--------------------=
------------=0AWilliam J. Mills=0A"Paranoid" Yahoo!=0A=0A=0A=0A=0A=0AOn Tue=
sday, February 11, 2014 1:27 PM, Phil Hunt  wrote:=0A=
=0APlease find attached the current spreadsheet on ticket plan and diffs fo=
r the new 03 drafts for tomorrows WG call. =0A=0AComments appreciated. =A0=
=0A=0ANote: AFAIK, we need to publish this week for IETF London. (submissio=
n closes friday)=0A=0A=0APhil=0A=0A@independentid=0Awww.independentid.comph=
il.hunt@oracle.com


From phil.hunt@oracle.com  Tue Feb 11 15:16:53 2014
Return-Path: 
X-Original-To: scim@ietfa.amsl.com
Delivered-To: scim@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E56D81A077F for ; Tue, 11 Feb 2014 15:16:53 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.749
X-Spam-Level: 
X-Spam-Status: No, score=-4.749 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z1-UVI99sSuH for ; Tue, 11 Feb 2014 15:16:51 -0800 (PST)
Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) by ietfa.amsl.com (Postfix) with ESMTP id C2BB81A0626 for ; Tue, 11 Feb 2014 15:16:51 -0800 (PST)
Received: from acsinet22.oracle.com (acsinet22.oracle.com [141.146.126.238]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s1BNGlru025896 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Tue, 11 Feb 2014 23:16:48 GMT
Received: from userz7022.oracle.com (userz7022.oracle.com [156.151.31.86]) by acsinet22.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1BNGk1W026807 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 11 Feb 2014 23:16:47 GMT
Received: from abhmp0010.oracle.com (abhmp0010.oracle.com [141.146.116.16]) by userz7022.oracle.com (8.14.5+Sun/8.14.4) with ESMTP id s1BNGk6p029169; Tue, 11 Feb 2014 23:16:46 GMT
Received: from [192.168.1.124] (/24.86.29.34) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 11 Feb 2014 15:16:46 -0800
Content-Type: text/plain; charset=iso-8859-1
Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\))
From: Phil Hunt 
In-Reply-To: <1392156890.89658.YahooMailNeo@web125602.mail.ne1.yahoo.com>
Date: Tue, 11 Feb 2014 15:16:52 -0800
Content-Transfer-Encoding: quoted-printable
Message-Id: <9DE976F8-B274-4015-ADAD-B3DC006C424B@oracle.com>
References: <0A4561AF-9771-4081-A8DC-429AEB964E18@oracle.com> <1392156890.89658.YahooMailNeo@web125602.mail.ne1.yahoo.com>
To: Bill Mills 
X-Mailer: Apple Mail (2.1510)
X-Source-IP: acsinet22.oracle.com [141.146.126.238]
Cc: "scim@ietf.org WG" 
Subject: Re: [scim] Prelim changes for draft 03 for tomorrows call
X-BeenThere: scim@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Simple Cloud Identity Management BOF 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Tue, 11 Feb 2014 23:16:54 -0000

Bill,

Thanks! I'll fix tonight.

Phil

@independentid
www.independentid.com
phil.hunt@oracle.com

On 2014-02-11, at 2:14 PM, Bill Mills  wrote:

>=20
>=20
> This doesn't scan right...
>=20
>=20
>=20
> "3.2.2.1.  Query Endpoints=20
>=20
> Queries MAY be performed against a SCIM resources or resource =
endpoints.  For example: "
>=20
>=20
>=20
>=20
> -bill
>=20
>=20
>=20
> --------------------------------
> William J. Mills
> "Paranoid" Yahoo!
>=20
>=20
>=20
>=20
>=20
> On Tuesday, February 11, 2014 1:27 PM, Phil Hunt =
 wrote:
>=20
> Please find attached the current spreadsheet on ticket plan and diffs =
for the new 03 drafts for tomorrows WG call.=20
>=20
> Comments appreciated. =20
>=20
> Note: AFAIK, we need to publish this week for IETF London. (submission =
closes friday)
>=20
>=20
> Phil
>=20
> @independentid
> www.independentid.comphil.hunt@oracle.com
>=20
> _______________________________________________
> scim mailing list
> scim@ietf.org
> https://www.ietf.org/mailman/listinfo/scim


From moransar@cisco.com  Tue Feb 11 17:14:43 2014
Return-Path: 
X-Original-To: scim@ietfa.amsl.com
Delivered-To: scim@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6B4C21A060D for ; Tue, 11 Feb 2014 17:14:43 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -17.049
X-Spam-Level: 
X-Spam-Status: No, score=-17.049 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, GB_I_INVITATION=-2, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id phhWaF_DpyVT for ; Tue, 11 Feb 2014 17:14:41 -0800 (PST)
Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) by ietfa.amsl.com (Postfix) with ESMTP id 318131A0308 for ; Tue, 11 Feb 2014 17:14:41 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2926; q=dns/txt; s=iport; t=1392167681; x=1393377281; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=WAM6QNxObDuNZBSb0zx/jCtl1byDnC5HHevpqj4a1PU=; b=gjbUMejNvFfOWapFtTHcVaeOrr+uHlcorxIXcOqu8gO8wP++Imo2orVS +e0eTSPFo8I+hCLoMLpRBYaL+9naXo71bhdNEq7veI4mOPa5MeL9Gf8Mu Qbt3OodcxdUSV1VUR5lswDtF8P9V459S0F3F53kjdP8RCjdsuuR9ewWwe M=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AgQFADDK+lKtJXHA/2dsb2JhbABAFwODDDhXvxyBFhZ0giYBAQICAQEBNxsTBgsQAgEIBw0YBAYGCicLJAECAQMBDQWIBQ02q12dfReONREjEAcRB4QgBJgqkiCCW1KCKg
X-IronPort-AV: E=Sophos;i="4.95,829,1384300800"; d="scan'208";a="303441703"
Received: from rcdn-core2-5.cisco.com ([173.37.113.192]) by rcdn-iport-8.cisco.com with ESMTP; 12 Feb 2014 01:14:40 +0000
Received: from xhc-rcd-x02.cisco.com (xhc-rcd-x02.cisco.com [173.37.183.76]) by rcdn-core2-5.cisco.com (8.14.5/8.14.5) with ESMTP id s1C1EesZ026208 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Wed, 12 Feb 2014 01:14:40 GMT
Received: from xmb-rcd-x08.cisco.com ([169.254.8.26]) by xhc-rcd-x02.cisco.com ([173.37.183.76]) with mapi id 14.03.0123.003; Tue, 11 Feb 2014 19:14:40 -0600
From: "Morteza Ansari (moransar)" 
To: Leif Johansson , Phil Hunt 
Thread-Topic: [scim] Call today?
Thread-Index: AQHPIpP0HDzfyUACyk63qgkLPVTTTZqnYqGAgAlWSAA=
Date: Wed, 12 Feb 2014 01:14:39 +0000
Message-ID: 
References:  <7F7F895E-455D-450D-876E-B6AB466599D6@mnt.se>
In-Reply-To: <7F7F895E-455D-450D-876E-B6AB466599D6@mnt.se>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
user-agent: Microsoft-MacOutlook/14.3.9.131030
x-originating-ip: [10.154.136.65]
Content-Type: text/plain; charset="us-ascii"
Content-ID: 
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: "scim@ietf.org WG" 
Subject: Re: [scim] Call today?
X-BeenThere: scim@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Simple Cloud Identity Management BOF 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Wed, 12 Feb 2014 01:14:43 -0000

Correct, the next meeting is Wed. Fed. 12th at 11am Pacific time.  Meeting
info is here:

To invite others to join, copy and paste everything below into your
invitation.=20
-------------------------------------------------------
Meeting information
-------------------------------------------------------
Topic: SCIM WG interim
Date: Every Wednesday, from Wednesday, August 21, 2013 to no end date
Time: 11:00 am, Pacific Daylight Time (San Francisco, GMT-07:00)
Meeting Number: 340 844 711
Meeting Password: (This meeting does not require a password.)

-------------------------------------------------------
To start or join the online meeting
-------------------------------------------------------
Go to https://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&RT=3DMiM=
0

-------------------------------------------------------
Audio conference information
-------------------------------------------------------
To receive a call back, provide your phone number when you join the
meeting, or call the number below and enter the access code.
US Toll free: 1-855-797-9485
US Toll: +1-415-655-0002
Global call-in numbers:
https://go.webex.com/go/globalcallin.php?serviceType=3DMC&ED=3D153193777&to=
llFr
ee=3D1=20
Toll-free dialing restrictions:
http://www.webex.com/pdf/tollfree_restrictions.pdf

Access code:340 844 711

-------------------------------------------------------
For assistance=20
-------------------------------------------------------
1. Go to https://go.webex.com/go/mc
2. On the left navigation bar, click "Support".
To add this meeting to your calendar program (for example Microsoft
Outlook), click this link:
https://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&ICS=3DMS&LD=3D=
1&RD=3D2&S
T=3D1&SHA2=3DAAAAAXFmPcl25G51pP-VAnTUIPjOJqt0XNEPVKSSFdjwCd-F

To check whether you have the appropriate players installed for UCF
(Universal Communications Format) rich media files, go to
https://go.webex.com/go/systemdiagnosis.php.

http://www.webex.com 

CCM:+14156550002x340844711#

IMPORTANT NOTICE: This WebEx service includes a feature that allows audio
and any documents and other materials exchanged or viewed during the
session to be recorded. You should inform all meeting attendees prior to
recording if you intend to record the meeting. Please note that any such
recordings may be subject to discovery in the event of litigation.


On 2/5/14 10:39 AM, "Leif Johansson"  wrote:

>
>
>> 5 feb 2014 kl. 18:01 skrev Phil Hunt :
>>=20
>> Details?
>>=20
>
>its next week right?
>
>> Phil
>> _______________________________________________
>> scim mailing list
>> scim@ietf.org
>> https://www.ietf.org/mailman/listinfo/scim
>_______________________________________________
>scim mailing list
>scim@ietf.org
>https://www.ietf.org/mailman/listinfo/scim


From phil.hunt@oracle.com  Wed Feb 12 10:20:08 2014
Return-Path: 
X-Original-To: scim@ietfa.amsl.com
Delivered-To: scim@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EB61D1A0620 for ; Wed, 12 Feb 2014 10:20:07 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.749
X-Spam-Level: 
X-Spam-Status: No, score=-4.749 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XGqpv3GJDRjZ for ; Wed, 12 Feb 2014 10:20:05 -0800 (PST)
Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) by ietfa.amsl.com (Postfix) with ESMTP id 13CBC1A0605 for ; Wed, 12 Feb 2014 10:20:05 -0800 (PST)
Received: from acsinet22.oracle.com (acsinet22.oracle.com [141.146.126.238]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s1CIK3tu022653 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Wed, 12 Feb 2014 18:20:04 GMT
Received: from userz7021.oracle.com (userz7021.oracle.com [156.151.31.85]) by acsinet22.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1CIK2HU004361 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Wed, 12 Feb 2014 18:20:02 GMT
Received: from abhmp0016.oracle.com (abhmp0016.oracle.com [141.146.116.22]) by userz7021.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1CIK1KI001887 for ; Wed, 12 Feb 2014 18:20:02 GMT
Received: from [192.168.1.124] (/24.86.29.34) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 12 Feb 2014 10:20:01 -0800
Content-Type: text/plain; charset=iso-8859-1
Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\))
From: Phil Hunt 
In-Reply-To: <1392156890.89658.YahooMailNeo@web125602.mail.ne1.yahoo.com>
Date: Wed, 12 Feb 2014 10:20:11 -0800
Content-Transfer-Encoding: quoted-printable
Message-Id: <1E4FB72E-7B23-41AC-B6CA-5FC373913624@oracle.com>
References: <0A4561AF-9771-4081-A8DC-429AEB964E18@oracle.com> <1392156890.89658.YahooMailNeo@web125602.mail.ne1.yahoo.com>
To: "scim@ietf.org WG" 
X-Mailer: Apple Mail (2.1510)
X-Source-IP: acsinet22.oracle.com [141.146.126.238]
Subject: Re: [scim] Prelim changes for draft 03 for tomorrows call
X-BeenThere: scim@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Simple Cloud Identity Management BOF 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Wed, 12 Feb 2014 18:20:08 -0000

Some feedback from one of my co-workers,
> Hi Phil,
>=20
> I have also done a quick review of the draft 03, and I do not have =
much to add:
>=20
> SCIM core schema document:
>=20
> OO1: There are some '\n' in the schema representation.
>=20
> OO2: The mutability, uniqueness and returned values are not specified =
for each attributes (though we can find then in the schema =
representation), but rather each time the value is different from the =
default one. But these default values are not specified anywhere (I =
guess that mutability default is 'readWrite', uniqueness default is =
'none', and returned default is 'default'). Perhaps, you could add some =
words like it is done in 3.1 about type, optional and readOnly to =
indicate the default behavior.
>=20
> Olivier

I've added these changes plus some other minor edits from Erik.

Thanks everyone for the feedback!

Phil

@independentid
www.independentid.com
phil.hunt@oracle.com

On 2014-02-11, at 2:14 PM, Bill Mills  wrote:

>=20
>=20
> This doesn't scan right...
>=20
>=20
>=20
> "3.2.2.1.  Query Endpoints=20
>=20
> Queries MAY be performed against a SCIM resources or resource =
endpoints.  For example: "
>=20
>=20
>=20
>=20
> -bill
>=20
>=20
>=20
> --------------------------------
> William J. Mills
> "Paranoid" Yahoo!
>=20
>=20
>=20
>=20
>=20
> On Tuesday, February 11, 2014 1:27 PM, Phil Hunt =
 wrote:
>=20
> Please find attached the current spreadsheet on ticket plan and diffs =
for the new 03 drafts for tomorrows WG call.=20
>=20
> Comments appreciated. =20
>=20
> Note: AFAIK, we need to publish this week for IETF London. (submission =
closes friday)
>=20
>=20
> Phil
>=20
> @independentid
> www.independentid.comphil.hunt@oracle.com
>=20
> _______________________________________________
> scim mailing list
> scim@ietf.org
> https://www.ietf.org/mailman/listinfo/scim


From kelly.grizzle@sailpoint.com  Wed Feb 12 11:03:49 2014
Return-Path: 
X-Original-To: scim@ietfa.amsl.com
Delivered-To: scim@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 712C51A0678 for ; Wed, 12 Feb 2014 11:03:49 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.602
X-Spam-Level: 
X-Spam-Status: No, score=-4.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, GB_I_INVITATION=-2, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BiZYS40mFTUA for ; Wed, 12 Feb 2014 11:03:47 -0800 (PST)
Received: from na01-by2-obe.outbound.protection.outlook.com (mail-by2lp0238.outbound.protection.outlook.com [207.46.163.238]) by ietfa.amsl.com (Postfix) with ESMTP id CAFDA1A0676 for ; Wed, 12 Feb 2014 11:03:46 -0800 (PST)
Received: from BN1PR04MB392.namprd04.prod.outlook.com (10.141.60.151) by BN1PR04MB391.namprd04.prod.outlook.com (10.141.60.150) with Microsoft SMTP Server (TLS) id 15.0.873.15; Wed, 12 Feb 2014 19:03:44 +0000
Received: from BN1PR04MB392.namprd04.prod.outlook.com ([169.254.10.164]) by BN1PR04MB392.namprd04.prod.outlook.com ([169.254.10.164]) with mapi id 15.00.0873.009; Wed, 12 Feb 2014 19:03:44 +0000
From: Kelly Grizzle 
To: "Morteza Ansari (moransar)" , Leif Johansson , Phil Hunt 
Thread-Topic: [scim] Call today?
Thread-Index: AQHPIpP1IZTHWec73kSeUzXR9x+KYJqm/gyAgAncZoCAASqIMA==
Date: Wed, 12 Feb 2014 19:03:43 +0000
Message-ID: <118dcf276c044f26adc85c3051dddd29@BN1PR04MB392.namprd04.prod.outlook.com>
References:  <7F7F895E-455D-450D-876E-B6AB466599D6@mnt.se> 
In-Reply-To: 
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [72.182.10.254]
x-forefront-prvs: 01208B1E18
x-forefront-antispam-report: SFV:NSPM; SFS:(10009001)(6009001)(479174003)(377454003)(51704005)(243025003)(199002)(189002)(24454002)(13464003)(16601075003)(53806001)(15202345003)(54316002)(56776001)(63696002)(85306002)(551544002)(79102001)(51856001)(74366001)(54356001)(76482001)(69226001)(74876001)(74706001)(87936001)(80976001)(77982001)(59766001)(66066001)(80022001)(65816001)(33646001)(19580405001)(19580395003)(83322001)(76576001)(74662001)(90146001)(76796001)(31966008)(76786001)(74502001)(81342001)(85852003)(83072002)(15975445006)(92566001)(81686001)(16799955002)(81816001)(81542001)(56816005)(49866001)(4396001)(47736001)(46102001)(47976001)(50986001)(87266001)(95666001)(74316001)(94946001)(94316002)(77096001)(47446002)(93516002)(86362001)(93136001)(2656002)(575784001)(95416001)(24736002); DIR:OUT; SFP:1101; SCL:1; SRVR:BN1PR04MB391; H:BN1PR04MB392.namprd04.prod.outlook.com; CLIP:72.182.10.254; FPR:EC9ED5E7.AC3294C0.F9FFB13B.54E8EDB0.203BE; InfoNoRecordsA:1; MX:1; LANG:en;
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: sailpoint.com
Cc: "scim@ietf.org WG" 
Subject: Re: [scim] Call today?
X-BeenThere: scim@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Simple Cloud Identity Management BOF 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Wed, 12 Feb 2014 19:03:49 -0000

The link the meeting is not working for me.  It is showing a meeting on the=
 19th.

Morteza, can you send the correct link?


-----Original Message-----
From: scim [mailto:scim-bounces@ietf.org] On Behalf Of Morteza Ansari (mora=
nsar)
Sent: Tuesday, February 11, 2014 7:15 PM
To: Leif Johansson; Phil Hunt
Cc: scim@ietf.org WG
Subject: Re: [scim] Call today?

Correct, the next meeting is Wed. Fed. 12th at 11am Pacific time.  Meeting =
info is here:

To invite others to join, copy and paste everything below into your invitat=
ion.=20
-------------------------------------------------------
Meeting information
-------------------------------------------------------
Topic: SCIM WG interim
Date: Every Wednesday, from Wednesday, August 21, 2013 to no end date
Time: 11:00 am, Pacific Daylight Time (San Francisco, GMT-07:00) Meeting Nu=
mber: 340 844 711 Meeting Password: (This meeting does not require a passwo=
rd.)

-------------------------------------------------------
To start or join the online meeting
-------------------------------------------------------
Go to https://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&RT=3DMiM=
0

-------------------------------------------------------
Audio conference information
-------------------------------------------------------
To receive a call back, provide your phone number when you join the meeting=
, or call the number below and enter the access code.
US Toll free: 1-855-797-9485
US Toll: +1-415-655-0002
Global call-in numbers:
https://go.webex.com/go/globalcallin.php?serviceType=3DMC&ED=3D153193777&to=
llFr
ee=3D1
Toll-free dialing restrictions:
http://www.webex.com/pdf/tollfree_restrictions.pdf

Access code:340 844 711

-------------------------------------------------------
For assistance
-------------------------------------------------------
1. Go to https://go.webex.com/go/mc
2. On the left navigation bar, click "Support".
To add this meeting to your calendar program (for example Microsoft Outlook=
), click this link:
https://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&ICS=3DMS&LD=3D=
1&RD=3D2&S
T=3D1&SHA2=3DAAAAAXFmPcl25G51pP-VAnTUIPjOJqt0XNEPVKSSFdjwCd-F

To check whether you have the appropriate players installed for UCF (Univer=
sal Communications Format) rich media files, go to https://go.webex.com/go/=
systemdiagnosis.php.

http://www.webex.com 

CCM:+14156550002x340844711#

IMPORTANT NOTICE: This WebEx service includes a feature that allows audio a=
nd any documents and other materials exchanged or viewed during the session=
 to be recorded. You should inform all meeting attendees prior to recording=
 if you intend to record the meeting. Please note that any such recordings =
may be subject to discovery in the event of litigation.


On 2/5/14 10:39 AM, "Leif Johansson"  wrote:

>
>
>> 5 feb 2014 kl. 18:01 skrev Phil Hunt :
>>=20
>> Details?
>>=20
>
>its next week right?
>
>> Phil
>> _______________________________________________
>> scim mailing list
>> scim@ietf.org
>> https://www.ietf.org/mailman/listinfo/scim
>_______________________________________________
>scim mailing list
>scim@ietf.org
>https://www.ietf.org/mailman/listinfo/scim

_______________________________________________
scim mailing list
scim@ietf.org
https://www.ietf.org/mailman/listinfo/scim


From phil.hunt@oracle.com  Wed Feb 12 11:05:14 2014
Return-Path: 
X-Original-To: scim@ietfa.amsl.com
Delivered-To: scim@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 227781A0548 for ; Wed, 12 Feb 2014 11:05:14 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.749
X-Spam-Level: 
X-Spam-Status: No, score=-6.749 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, GB_I_INVITATION=-2, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wLwQQf2joo8I for ; Wed, 12 Feb 2014 11:05:07 -0800 (PST)
Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) by ietfa.amsl.com (Postfix) with ESMTP id 2C1DE1A066B for ; Wed, 12 Feb 2014 11:05:07 -0800 (PST)
Received: from acsinet21.oracle.com (acsinet21.oracle.com [141.146.126.237]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s1CJ54f7012701 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Wed, 12 Feb 2014 19:05:05 GMT
Received: from userz7021.oracle.com (userz7021.oracle.com [156.151.31.85]) by acsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1CJ53q4026072 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Wed, 12 Feb 2014 19:05:04 GMT
Received: from abhmp0015.oracle.com (abhmp0015.oracle.com [141.146.116.21]) by userz7021.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1CJ52Fi009438; Wed, 12 Feb 2014 19:05:02 GMT
Received: from [192.168.1.124] (/24.86.29.34) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 12 Feb 2014 11:05:02 -0800
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\))
From: Phil Hunt 
In-Reply-To: <118dcf276c044f26adc85c3051dddd29@BN1PR04MB392.namprd04.prod.outlook.com>
Date: Wed, 12 Feb 2014 11:05:11 -0800
Content-Transfer-Encoding: quoted-printable
Message-Id: 
References:  <7F7F895E-455D-450D-876E-B6AB466599D6@mnt.se>  <118dcf276c044f26adc85c3051dddd29@BN1PR04MB392.namprd04.prod.outlook.com>
To: Kelly Grizzle 
X-Mailer: Apple Mail (2.1510)
X-Source-IP: acsinet21.oracle.com [141.146.126.237]
Cc: Leif Johansson , "Morteza Ansari \(moransar\)" , "scim@ietf.org WG" 
Subject: Re: [scim] Call today?
X-BeenThere: scim@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Simple Cloud Identity Management BOF 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Wed, 12 Feb 2014 19:05:14 -0000

Looks to be fixed now.

Phil

@independentid
www.independentid.com
phil.hunt@oracle.com

On 2014-02-12, at 11:03 AM, Kelly Grizzle  =
wrote:

> The link the meeting is not working for me.  It is showing a meeting =
on the 19th.
>=20
> Morteza, can you send the correct link?
>=20
>=20
> -----Original Message-----
> From: scim [mailto:scim-bounces@ietf.org] On Behalf Of Morteza Ansari =
(moransar)
> Sent: Tuesday, February 11, 2014 7:15 PM
> To: Leif Johansson; Phil Hunt
> Cc: scim@ietf.org WG
> Subject: Re: [scim] Call today?
>=20
> Correct, the next meeting is Wed. Fed. 12th at 11am Pacific time.  =
Meeting info is here:
>=20
> To invite others to join, copy and paste everything below into your =
invitation.=20
> -------------------------------------------------------
> Meeting information
> -------------------------------------------------------
> Topic: SCIM WG interim
> Date: Every Wednesday, from Wednesday, August 21, 2013 to no end date
> Time: 11:00 am, Pacific Daylight Time (San Francisco, GMT-07:00) =
Meeting Number: 340 844 711 Meeting Password: (This meeting does not =
require a password.)
>=20
> -------------------------------------------------------
> To start or join the online meeting
> -------------------------------------------------------
> Go to https://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&RT=3D=
MiM0
>=20
> -------------------------------------------------------
> Audio conference information
> -------------------------------------------------------
> To receive a call back, provide your phone number when you join the =
meeting, or call the number below and enter the access code.
> US Toll free: 1-855-797-9485
> US Toll: +1-415-655-0002
> Global call-in numbers:
> =
https://go.webex.com/go/globalcallin.php?serviceType=3DMC&ED=3D153193777&t=
ollFr
> ee=3D1
> Toll-free dialing restrictions:
> http://www.webex.com/pdf/tollfree_restrictions.pdf
>=20
> Access code:340 844 711
>=20
> -------------------------------------------------------
> For assistance
> -------------------------------------------------------
> 1. Go to https://go.webex.com/go/mc
> 2. On the left navigation bar, click "Support".
> To add this meeting to your calendar program (for example Microsoft =
Outlook), click this link:
> =
https://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&ICS=3DMS&LD=3D=
1&RD=3D2&S
> T=3D1&SHA2=3DAAAAAXFmPcl25G51pP-VAnTUIPjOJqt0XNEPVKSSFdjwCd-F
>=20
> To check whether you have the appropriate players installed for UCF =
(Universal Communications Format) rich media files, go to =
https://go.webex.com/go/systemdiagnosis.php.
>=20
> http://www.webex.com 
>=20
> CCM:+14156550002x340844711#
>=20
> IMPORTANT NOTICE: This WebEx service includes a feature that allows =
audio and any documents and other materials exchanged or viewed during =
the session to be recorded. You should inform all meeting attendees =
prior to recording if you intend to record the meeting. Please note that =
any such recordings may be subject to discovery in the event of =
litigation.
>=20
>=20
> On 2/5/14 10:39 AM, "Leif Johansson"  wrote:
>=20
>>=20
>>=20
>>> 5 feb 2014 kl. 18:01 skrev Phil Hunt :
>>>=20
>>> Details?
>>>=20
>>=20
>> its next week right?
>>=20
>>> Phil
>>> _______________________________________________
>>> scim mailing list
>>> scim@ietf.org
>>> https://www.ietf.org/mailman/listinfo/scim
>> _______________________________________________
>> scim mailing list
>> scim@ietf.org
>> https://www.ietf.org/mailman/listinfo/scim
>=20
> _______________________________________________
> scim mailing list
> scim@ietf.org
> https://www.ietf.org/mailman/listinfo/scim
>=20
> _______________________________________________
> scim mailing list
> scim@ietf.org
> https://www.ietf.org/mailman/listinfo/scim


From moransar@cisco.com  Wed Feb 12 11:06:08 2014
Return-Path: 
X-Original-To: scim@ietfa.amsl.com
Delivered-To: scim@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AE5BC1A0548 for ; Wed, 12 Feb 2014 11:06:08 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -17.049
X-Spam-Level: 
X-Spam-Status: No, score=-17.049 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, GB_I_INVITATION=-2, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ns9_pE92uwN9 for ; Wed, 12 Feb 2014 11:06:06 -0800 (PST)
Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) by ietfa.amsl.com (Postfix) with ESMTP id 615781A0502 for ; Wed, 12 Feb 2014 11:06:06 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3745; q=dns/txt; s=iport; t=1392231965; x=1393441565; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=NcFsqICd7Ry/GyecvnscxwK6G9pCz6aAwTkCqRY/0xo=; b=X4OF97l9IkOj6V4E0guAHM4WhRDDsaJkeKifrLgWtkawJvJfsHryhxrf nP/aJLYbFXdLvMswXM0u64wnzU4b31ajQPmXdii/sI0hM0x/ygYqQZYgZ a5hmauQlvMHxecVKlrFYfPDnRVkeLqOqoIPOGU6A3KkeVYDYCGxBwJdoR c=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AgsFAH7F+1KtJV2c/2dsb2JhbABAFwODDjhVvHuBGhYBdIN9AQEBAgIBAQE3GxMGCwwEAgEIBwoDAQEBARQEBgYDBycLFAkHAQIBAwENBYgEDTaqF5VlF45OESMQBwYLB4QeAQOYFpIUgllSgio
X-IronPort-AV: E=Sophos;i="4.95,833,1384300800"; d="scan'208";a="300625966"
Received: from rcdn-core-5.cisco.com ([173.37.93.156]) by rcdn-iport-9.cisco.com with ESMTP; 12 Feb 2014 19:06:05 +0000
Received: from xhc-aln-x08.cisco.com (xhc-aln-x08.cisco.com [173.36.12.82]) by rcdn-core-5.cisco.com (8.14.5/8.14.5) with ESMTP id s1CJ64S4023181 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Wed, 12 Feb 2014 19:06:05 GMT
Received: from xmb-rcd-x08.cisco.com ([169.254.8.26]) by xhc-aln-x08.cisco.com ([173.36.12.82]) with mapi id 14.03.0123.003; Wed, 12 Feb 2014 13:06:04 -0600
From: "Morteza Ansari (moransar)" 
To: Kelly Grizzle , Leif Johansson , Phil Hunt 
Thread-Topic: [scim] Call today?
Thread-Index: AQHPIpP0HDzfyUACyk63qgkLPVTTTZqnYqGAgAlWSACAAbDPgP//eooA
Date: Wed, 12 Feb 2014 19:06:03 +0000
Message-ID: 
References:  <7F7F895E-455D-450D-876E-B6AB466599D6@mnt.se>  <118dcf276c044f26adc85c3051dddd29@BN1PR04MB392.namprd04.prod.outlook.com>
In-Reply-To: <118dcf276c044f26adc85c3051dddd29@BN1PR04MB392.namprd04.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
user-agent: Microsoft-MacOutlook/14.3.9.131030
x-originating-ip: [10.154.204.71]
Content-Type: text/plain; charset="us-ascii"
Content-ID: <90E8602B4278F74DB29F3874F720A298@emea.cisco.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: "scim@ietf.org WG" 
Subject: Re: [scim] Call today?
X-BeenThere: scim@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Simple Cloud Identity Management BOF 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Wed, 12 Feb 2014 19:06:08 -0000

It should be working now.  Not sure what happened but will set up a new
one for next meeting to ensure this is fixed.


Cheers,
Morteza

On 2/12/14 11:03 AM, "Kelly Grizzle"  wrote:

>The link the meeting is not working for me.  It is showing a meeting on
>the 19th.
>
>Morteza, can you send the correct link?
>
>
>-----Original Message-----
>From: scim [mailto:scim-bounces@ietf.org] On Behalf Of Morteza Ansari
>(moransar)
>Sent: Tuesday, February 11, 2014 7:15 PM
>To: Leif Johansson; Phil Hunt
>Cc: scim@ietf.org WG
>Subject: Re: [scim] Call today?
>
>Correct, the next meeting is Wed. Fed. 12th at 11am Pacific time.
>Meeting info is here:
>
>To invite others to join, copy and paste everything below into your
>invitation.=20
>-------------------------------------------------------
>Meeting information
>-------------------------------------------------------
>Topic: SCIM WG interim
>Date: Every Wednesday, from Wednesday, August 21, 2013 to no end date
>Time: 11:00 am, Pacific Daylight Time (San Francisco, GMT-07:00) Meeting
>Number: 340 844 711 Meeting Password: (This meeting does not require a
>password.)
>
>-------------------------------------------------------
>To start or join the online meeting
>-------------------------------------------------------
>Go to https://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&RT=3DMi=
M0
>
>-------------------------------------------------------
>Audio conference information
>-------------------------------------------------------
>To receive a call back, provide your phone number when you join the
>meeting, or call the number below and enter the access code.
>US Toll free: 1-855-797-9485
>US Toll: +1-415-655-0002
>Global call-in numbers:
>https://go.webex.com/go/globalcallin.php?serviceType=3DMC&ED=3D153193777&t=
ollF
>r
>ee=3D1
>Toll-free dialing restrictions:
>http://www.webex.com/pdf/tollfree_restrictions.pdf
>
>Access code:340 844 711
>
>-------------------------------------------------------
>For assistance
>-------------------------------------------------------
>1. Go to https://go.webex.com/go/mc
>2. On the left navigation bar, click "Support".
>To add this meeting to your calendar program (for example Microsoft
>Outlook), click this link:
>https://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&ICS=3DMS&LD=
=3D1&RD=3D2&
>S
>T=3D1&SHA2=3DAAAAAXFmPcl25G51pP-VAnTUIPjOJqt0XNEPVKSSFdjwCd-F
>
>To check whether you have the appropriate players installed for UCF
>(Universal Communications Format) rich media files, go to
>https://go.webex.com/go/systemdiagnosis.php.
>
>http://www.webex.com 
>
>CCM:+14156550002x340844711#
>
>IMPORTANT NOTICE: This WebEx service includes a feature that allows audio
>and any documents and other materials exchanged or viewed during the
>session to be recorded. You should inform all meeting attendees prior to
>recording if you intend to record the meeting. Please note that any such
>recordings may be subject to discovery in the event of litigation.
>
>
>On 2/5/14 10:39 AM, "Leif Johansson"  wrote:
>
>>
>>
>>> 5 feb 2014 kl. 18:01 skrev Phil Hunt :
>>>=20
>>> Details?
>>>=20
>>
>>its next week right?
>>
>>> Phil
>>> _______________________________________________
>>> scim mailing list
>>> scim@ietf.org
>>> https://www.ietf.org/mailman/listinfo/scim
>>_______________________________________________
>>scim mailing list
>>scim@ietf.org
>>https://www.ietf.org/mailman/listinfo/scim
>
>_______________________________________________
>scim mailing list
>scim@ietf.org
>https://www.ietf.org/mailman/listinfo/scim


From phil.hunt@oracle.com  Wed Feb 12 12:06:13 2014
Return-Path: 
X-Original-To: scim@ietfa.amsl.com
Delivered-To: scim@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 713BB1A0654 for ; Wed, 12 Feb 2014 12:06:13 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.748
X-Spam-Level: 
X-Spam-Status: No, score=-4.748 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Qr_VKFxvRRPh for ; Wed, 12 Feb 2014 12:06:11 -0800 (PST)
Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) by ietfa.amsl.com (Postfix) with ESMTP id 42F121A06BF for ; Wed, 12 Feb 2014 12:05:55 -0800 (PST)
Received: from ucsinet21.oracle.com (ucsinet21.oracle.com [156.151.31.93]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s1CK5riH021387 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Wed, 12 Feb 2014 20:05:54 GMT
Received: from aserz7021.oracle.com (aserz7021.oracle.com [141.146.126.230]) by ucsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1CK5qxA026174 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 12 Feb 2014 20:05:53 GMT
Received: from abhmp0017.oracle.com (abhmp0017.oracle.com [141.146.116.23]) by aserz7021.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1CK5qdJ014254 for ; Wed, 12 Feb 2014 20:05:52 GMT
Received: from [192.168.1.124] (/24.86.29.34) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 12 Feb 2014 12:05:52 -0800
From: Phil Hunt 
Content-Type: multipart/alternative; boundary="Apple-Mail=_959E77FE-A006-4D02-9B1E-754D5AAEE414"
Message-Id: 
Date: Wed, 12 Feb 2014 12:06:01 -0800
To: "scim@ietf.org WG" 
Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\))
X-Mailer: Apple Mail (2.1510)
X-Source-IP: ucsinet21.oracle.com [156.151.31.93]
Subject: [scim] Action item: text for immutable attributes and PUT operations
X-BeenThere: scim@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Simple Cloud Identity Management BOF 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Wed, 12 Feb 2014 20:06:13 -0000

--Apple-Mail=_959E77FE-A006-4D02-9B1E-754D5AAEE414
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=windows-1252

On the call today we had some discussion on immutability=85.

Issue:  During an update, it is expected that the entire JSON record be =
present for the replace.  This means that even immutable attributes =
SHOULD be present but unchanged.  Immutable attributes should not be =
omitted in a PUT operation.

Bill has taken an action item to provide some text for draft 03 later =
this aft:

Core Schema: Need to clarify immutable as meaning cannot change once =
set.

API - need clarification on PUT section 3.3.1 to reflect that the entire =
JSON record SHOULD be provided and that immutable attributes that are =
previously set MUST match. =20

I will add an editors note that the issue of immutable attributes being =
required to be included in a PUT is being monitored.

Phil

@independentid
www.independentid.com
phil.hunt@oracle.com


--Apple-Mail=_959E77FE-A006-4D02-9B1E-754D5AAEE414
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=windows-1252




=

--Apple-Mail=_959E77FE-A006-4D02-9B1E-754D5AAEE414--


From wmills_92105@yahoo.com  Wed Feb 12 12:14:27 2014
Return-Path: 
X-Original-To: scim@ietfa.amsl.com
Delivered-To: scim@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2BF9B1A0647 for ; Wed, 12 Feb 2014 12:14:27 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.165
X-Spam-Level: 
X-Spam-Status: No, score=-2.165 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_ADSP_CUSTOM_MED=0.001, DKIM_SIGNED=0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, FREEMAIL_REPLYTO_END_DIGIT=0.25, GB_I_INVITATION=-2, HTML_MESSAGE=0.001, NML_ADSP_CUSTOM_MED=0.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_SORBS_WEB=0.77, RP_MATCHES_RCVD=-0.548, T_DKIM_INVALID=0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vuV5APF1gdfn for ; Wed, 12 Feb 2014 12:14:23 -0800 (PST)
Received: from nm1-vm1.bullet.mail.bf1.yahoo.com (nm1-vm1.bullet.mail.bf1.yahoo.com [98.139.213.163]) by ietfa.amsl.com (Postfix) with ESMTP id 745001A0687 for ; Wed, 12 Feb 2014 12:14:23 -0800 (PST)
Received: from [66.196.81.172] by nm1.bullet.mail.bf1.yahoo.com with NNFMP; 12 Feb 2014 20:14:22 -0000
Received: from [98.139.212.219] by tm18.bullet.mail.bf1.yahoo.com with NNFMP; 12 Feb 2014 20:14:22 -0000
Received: from [127.0.0.1] by omp1028.mail.bf1.yahoo.com with NNFMP; 12 Feb 2014 20:14:22 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 343063.68328.bm@omp1028.mail.bf1.yahoo.com
Received: (qmail 36962 invoked by uid 60001); 12 Feb 2014 20:14:22 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1392236062; bh=R3Tc1keXUPu8uKY0W280snaP9Hppa8Y8WRv+8ZsOuOE=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=2G5FHsKwSKZA1T01oFGe6lCgd5mHMWuQu8FtCQzMilhzaXsdDJN76S9qSjGnJP2MlbJEx7tNnexO5l3tyZyvYfUbZgLcEdr1Zj0IR4PL53eeWK68+6ltHkJQe15a1CkNKlueouAe0q0WGEfqG3KULKsu4UHsYtQ3J+DyAexCc8g=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=VuE1w+10R/6ObosaqcKm1WdScVWJ76eIuN9xjuZUBk5ScWW1CvUlQBgfkUq+Vb8BNpf26xL7ebI/nYH2Pdtvwq6efV3fCDsbW3Bu6jHKFpxISI94XOV6HMaxI2ZtTBqg0yLdKOR6iFS4OwgHgT23UwKxIBhC9/yjU+gUnCh7q3Q=;
X-YMail-OSG: OjWFed0VM1meLFP.tHUTCrtg7vc.UDHqmC5AahNUTfpztkb k7mDT_iTcYCV7Q3DU4ADyCq9l0at2z7R6k_eYy_d8W4gkg7G0HX6XRD3H9BP SErAt8IEzOLzMa7GQDCg9rKzKSQb3gvAiuLdFAJKBRbO.MLiGTZmExwDrOvl 4u.jCJ4wO2EJcXj5TZ92sD5WSYGxseyM_mOnKsk2u6CwmTdYw7quHCK.F9gp R2ml.gO4UYgrnd0PsnPw2kO2SY667g43iCf3pqY6xE3cssnR.w9WXdTtww8s Axl.I7f4EIsK0fSH5FF3IAhQNmhIqfF47cjpfNKKz7O9CMR9rN7.tkopS5Vr lgvCBQ2FJCohz86twKbUlXKcKfy0xrLqKdLkq89IfUNkWQtRly2RznXzAIpX MCYF2sbyLmdhwMmPGxLuEuNn9y1tEVyDQHWaw7UKyvtlQbBUtuJ4vPf2k.rh YSxZW4qGyDbDaAPTln3gxc03yCVwudoG17zB8SH3._3ZAur7nnSOMX4mAFWp 2NR11EuONOqVhELoJHq98UDE1T_7hZIhA3SyXdRlqYwiPwYucrQhaSgEkw0Z PbHht0535hLm_0BWdej6LMTtNsmDmDDBp2.u3Th6cM_hUGPr_KqplRFqZGd8 4Czlp0HCxEJC8DNgT8PPL
Received: from [209.131.50.178] by web142802.mail.bf1.yahoo.com via HTTP; Wed, 12 Feb 2014 12:14:22 PST
X-Rocket-MIMEInfo: 002.001, TXkgYWN0aW9uIGl0ZW0gZnJvbSB0aGUgY2FsbDogwqBQcm9wb3NlIGxhbmd1YWdlIGFyb3VuZCBpbW11dGFiaWxpdHkgYW5kIFBVVC4KCgpJIGRvbid0IGtub3cgd2hldGhlciB0aGlzIGdvZXMgaW50byB0aGUgZGVmaW5pdGlvbiBvZiBpbW11dGFiaWxpdHkgb3IgUFVULCBwcm9iYWJseSBQVVQ6CgoiUFVUIGV4cGVjdHMgdGhlIGVudGlyZSBvYmplY3QgdG8gYmUgcHJlc2VudCwgaWYgdGhlIHNjaGVtYSBpbmNsdWRlcyBlbGVtZW50cyB3aXRoIGltbXV0YWJsZSBvciBSZWFkT25seSBlbGVtZW50cyB0aGVuIHQBMAEBAQE-
X-Mailer: YahooMailWebService/0.8.176.634
References:  <7F7F895E-455D-450D-876E-B6AB466599D6@mnt.se>  <118dcf276c044f26adc85c3051dddd29@BN1PR04MB392.namprd04.prod.outlook.com>  
Message-ID: <1392236062.76159.YahooMailNeo@web142802.mail.bf1.yahoo.com>
Date: Wed, 12 Feb 2014 12:14:22 -0800 (PST)
From: Bill Mills 
To: "Morteza Ansari \(moransar\)" , Kelly Grizzle , Leif Johansson , Phil Hunt 
In-Reply-To: 
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="1397251415-28851257-1392236062=:76159"
Cc: "scim@ietf.org WG" 
Subject: Re: [scim] Call today?
X-BeenThere: scim@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Bill Mills 
List-Id: Simple Cloud Identity Management BOF 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Wed, 12 Feb 2014 20:14:27 -0000

--1397251415-28851257-1392236062=:76159
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

My action item from the call: =A0Propose language around immutability and P=
UT.=0A=0A=0AI don't know whether this goes into the definition of immutabil=
ity or PUT, probably PUT:=0A=0A"PUT expects the entire object to be present=
, if the schema includes elements with immutable or ReadOnly elements then =
the object submitted with a PUT MUST include all existing immutable and Rea=
dOnly data. =A0The server MUST reject the PUT and return an error if the su=
bmitted data for =A0immutable or ReadOnly=A0elemets do=A0not match exactly.=
"=0A=0A=0A=0AOn Wednesday, February 12, 2014 11:06 AM, Morteza Ansari (mora=
nsar)  wrote:=0A =0AIt should be working now.=A0 Not su=
re what happened but will set up a new=0Aone for next meeting to ensure thi=
s is fixed.=0A=0A=0ACheers,=0AMorteza=0A=0A=0AOn 2/12/14 11:03 AM, "Kelly G=
rizzle"  wrote:=0A=0A>The link the meeting is =
not working for me.=A0 It is showing a meeting on=0A>the 19th.=0A>=0A>Morte=
za, can you send the correct link?=0A>=0A>=0A>-----Original Message-----=0A=
>From: scim [mailto:scim-bounces@ietf.org] On Behalf Of Morteza Ansari=0A>(=
moransar)=0A>Sent: Tuesday, February 11, 2014 7:15 PM=0A>To: Leif Johansson=
; Phil Hunt=0A>Cc: scim@ietf.org WG=0A>Subject: Re: [scim] Call today?=0A>=
=0A>Correct, the next meeting is Wed. Fed. 12th at 11am Pacific time.=0A>Me=
eting info is here:=0A>=0A>To invite others to join, copy and paste everyth=
ing below into your=0A>invitation. =0A>------------------------------------=
-------------------=0A>Meeting information=0A>-----------------------------=
--------------------------=0A>Topic: SCIM WG interim=0A>Date: Every Wednesd=
ay, from Wednesday, August 21, 2013 to no end date=0A>Time: 11:00 am, Pacif=
ic Daylight Time (San Francisco, GMT-07:00) Meeting=0A>Number: 340 844 711 =
Meeting Password: (This meeting does not require a=0A>password.)=0A>=0A>---=
----------------------------------------------------=0A>To start or join th=
e online meeting=0A>-------------------------------------------------------=
=0A>Go to https://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&RT=
=3DMiM0=0A>=0A>-------------------------------------------------------=0A>A=
udio conference information=0A>--------------------------------------------=
-----------=0A>To receive a call back, provide your phone number when you j=
oin the=0A>meeting, or call the number below and enter the access code.=0A>=
US Toll free: 1-855-797-9485=0A>US Toll: +1-415-655-0002=0A>Global call-in =
numbers:=0A>https://go.webex.com/go/globalcallin.php?serviceType=3DMC&ED=3D=
153193777&tollF=0A>r=0A>ee=3D1=0A>Toll-free dialing restrictions:=0A>http:/=
/www.webex.com/pdf/tollfree_restrictions.pdf=0A>=0A>Access code:340 844 711=
=0A>=0A>-------------------------------------------------------=0A>For assi=
stance=0A>-------------------------------------------------------=0A>1. Go =
to https://go.webex.com/go/mc=0A>2. On the left navigation bar, click "Supp=
ort".=0A>To add this meeting to your calendar program (for example Microsof=
t=0A>Outlook), click this link:=0A>https://go.webex.com/go/j.php?ED=3D15319=
3777&UID=3D483472947&ICS=3DMS&LD=3D1&RD=3D2&=0A>S=0A>T=3D1&SHA2=3DAAAAAXFmP=
cl25G51pP-VAnTUIPjOJqt0XNEPVKSSFdjwCd-F=0A>=0A>To check whether you have th=
e appropriate players installed for UCF=0A>(Universal Communications Format=
) rich media files, go to=0A>https://go.webex.com/go/systemdiagnosis.php.=
=0A>=0A>http://www.webex.com =0A>=0A>CCM:+1415655000=
2x340844711#=0A>=0A>IMPORTANT NOTICE: This WebEx service includes a feature=
 that allows audio=0A>and any documents and other materials exchanged or vi=
ewed during the=0A>session to be recorded. You should inform all meeting at=
tendees prior to=0A>recording if you intend to record the meeting. Please n=
ote that any such=0A>recordings may be subject to discovery=0A in the event=
 of litigation.=0A>=0A>=0A>On 2/5/14 10:39 AM, "Leif Johansson"  wrote:=0A>=0A>>=0A>>=0A>>> 5 feb 2014 kl. 18:01 skrev Phil Hunt :=0A>>> =0A>>> Details?=0A>>> =0A>>=0A>>its next week right?=
=0A>>=0A>>> Phil=0A>>> _______________________________________________=0A>>=
> scim mailing list=0A>>> scim@ietf.org=0A>>> https://www.ietf.org/mailman/=
listinfo/scim=0A>>_______________________________________________=0A>>scim =
mailing list=0A>>scim@ietf.org=0A>>https://www.ietf.org/mailman/listinfo/sc=
im=0A>=0A>_______________________________________________=0A>scim mailing l=
ist=0A>scim@ietf.org=0A>https://www.ietf.org/mailman/listinfo/scim=0A=0A___=
____________________________________________=0Ascim mailing list=0Ascim@iet=
f.org=0Ahttps://www.ietf.org/mailman/listinfo/scim
--1397251415-28851257-1392236062=:76159
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable


My action item from the ca=
ll:  Propose language around immutability and PUT.


I don't know whether this goes into the =
definition of immutability or PUT, probably PUT:
<=
span id=3D"yiv1639470830yui_3_13_0_ym1_14_1392143779400_27">
=

"PUT expects the entire object to be present, if the schema inclu=
des elements with immutable or ReadOnly elements then the object submitted =
with a PUT MUST include all existing immutable and ReadOnly data.  The=
 server MUST reject the PUT and return an error if the submitted data for
  immutable or ReadOnly elemets do=
 not =
match exactly."
 

 
 
 
 
  On W=
ednesday, February 12, 2014 11:06 AM, Morteza Ansari (moransar) <moransa=
r@cisco.com> wrote:
  
  
It should be working now.  Not sure what ha=
ppened but will set up a new
one for next meeting to ensu=
re this is fixed.


C=
heers,
Morteza

On 2/12=
/14 11:03 AM, "Kelly Grizzle"
 <k=
elly.grizzle@sailpoint.com> wrote:

>The link the meeting is not working for me.  It is showing a m=
eeting on
>the 19th.
>
>Morteza, can you send the correct link?
>=
;
>
>-----Original Message----->From: scim [mailto:scim-bounces@ietf.org] On Behalf Of Morteza Ansar=
i
>(moransar)
>Sent: Tuesday, Feb=
ruary 11, 2014 7:15 PM
>To: Leif Johansson; Phil Hunt<=
br clear=3D"none">>Cc: scim@ietf.org WG
>S=
ubject: Re: [scim] Call today?
>
>=
;Correct, the next meeting is Wed. Fed. 12th at 11am Pacific time.
>Meeting info is here:
>
>To invite others to join, copy and paste everything below into your>invitation. 
>-------------------=
------------------------------------
>Meeting informat=
ion
>-------------------------------------------------=
------
>Topic: SCIM WG interim
>D=
ate: Every Wednesday, from Wednesday, August 21, 2013 to no end date
>Time: 11:00 am, Pacific Daylight Time (San Francisco, GMT-0=
7:00) Meeting
>Number: 340 844 711 Meeting Password: (=
This meeting does not require a
>password.)
>
>-------------------------------------------------------=

>To start or join the online meeting
>-------------------------------------------------------
>Go to https://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&=
RT=3DMiM0
>
>----------------=
---------------------------------------
>Audio confere=
nce information
>-------------------------------------=
------------------
>To receive a call back, provide yo=
ur phone number when you join the
>meeting, or call th=
e number below and enter the access code.
>US Toll fre=
e: 1-855-797-9485
>US Toll: +1-415-655-0002
>Global call-in numbers:
>https://go.webex.com/go/globalcallin.php?serviceType=3DM=
C&ED=3D153193777&tollF
>r
>ee=3D1
>Toll-free dialing restrictions:
>http://www.webex.com/pd=
f/tollfree_restrictions.pdf
>
&g=
t;Access code:340 844 711
>
>----=
---------------------------------------------------
>F=
or assistance
>---------------------------------------=
----------------
>1. Go to https://go.=
webex.com/go/mc
>2. On the
 left navigation bar, click "Support".
>To add this me=
eting to your calendar program (for example Microsoft
>=
;Outlook), click this link:
>https://=
go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&ICS=3DMS&L=
D=3D1&RD=3D2&
>S
>T=
=3D1&SHA2=3DAAAAAXFmPcl25G51pP-VAnTUIPjOJqt0XNEPVKSSFdjwCd-F
>
>To check whether you have the appropri=
ate players installed for UCF
>(Universal Communicatio=
ns Format) rich media files, go to
>https://go.webex.c=
om/go/systemdiagnosis.php.
>
>http://www.webex.com <http://www=
.webex.com/>
>
>CCM:+14156=
550002x340844711#
>
>IMPORTANT NO=
TICE: This WebEx service includes a feature that allows audio
>and any documents and other materials exchanged or viewed during t=
he
>session to be recorded. You should inform all meet=
ing attendees prior to
>recording if you intend to rec=
ord the meeting. Please note that any such
>recordings=
 may be subject to discovery=0A in the event of litigation.
>
>
>On 2/5/14 10:39 AM, "L=
eif Johansson" <leifj@mnt.se&=
gt; wrote:
>
>>
>>
>>> 5 feb 2014 kl. 18:01 skrev Phil=
 Hunt <phil.hunt@=
oracle.com>:
>>> 
>&=
gt;> Details?
>>> 
>>=

>>its next week right?
>><=
br clear=3D"none">>>> Phil
>>> ________=
_______________________________________
>>> scim=
 mailing list
>>> scim@ietf.org
>>> https://www.ietf.org/mailman/listinfo/scim
>>_______________________________________________
=
>>scim mailing list
>>scim@ietf.org
>>https://www.ietf.org/mailman/listinfo/scim
>
>_________________________________________=
______
>scim mailing list
>scim@ietf.org
>https://www.ietf.org/mailman/listinfo/scim
________________________________________=
_______
scim mailing list
scim@ietf.org
https://www.ietf.org/mailman/listinfo/scim


  
 
=
  
 

--1397251415-28851257-1392236062=:76159--


From phil.hunt@oracle.com  Wed Feb 12 13:19:20 2014
Return-Path: 
X-Original-To: scim@ietfa.amsl.com
Delivered-To: scim@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8FCDF1A066B for ; Wed, 12 Feb 2014 13:19:20 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.748
X-Spam-Level: 
X-Spam-Status: No, score=-6.748 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, GB_I_INVITATION=-2, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cgwVhPxOvBlE for ; Wed, 12 Feb 2014 13:19:15 -0800 (PST)
Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) by ietfa.amsl.com (Postfix) with ESMTP id 7EE041A06E4 for ; Wed, 12 Feb 2014 13:19:15 -0800 (PST)
Received: from acsinet22.oracle.com (acsinet22.oracle.com [141.146.126.238]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s1CLJCCW028267 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Wed, 12 Feb 2014 21:19:13 GMT
Received: from aserz7021.oracle.com (aserz7021.oracle.com [141.146.126.230]) by acsinet22.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1CLJBAJ014329 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 12 Feb 2014 21:19:12 GMT
Received: from abhmp0017.oracle.com (abhmp0017.oracle.com [141.146.116.23]) by aserz7021.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1CLJBVC014094; Wed, 12 Feb 2014 21:19:11 GMT
Received: from [192.168.1.124] (/24.86.29.34) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 12 Feb 2014 13:19:11 -0800
Content-Type: multipart/alternative; boundary="Apple-Mail=_8E74421C-7B8A-4FB9-88FA-2473F05A8176"
Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\))
From: Phil Hunt 
In-Reply-To: <1392236062.76159.YahooMailNeo@web142802.mail.bf1.yahoo.com>
Date: Wed, 12 Feb 2014 13:19:19 -0800
Message-Id: <58399EA7-DEB6-4EEC-8A85-21D2B133A626@oracle.com>
References:  <7F7F895E-455D-450D-876E-B6AB466599D6@mnt.se>  <118dcf276c044f26adc85c3051dddd29@BN1PR04MB392.namprd04.prod.outlook.com>  <1392236062.76159.YahooMailNeo@web142802.mail.bf1.yahoo.com>
To: Bill Mills 
X-Mailer: Apple Mail (2.1510)
X-Source-IP: acsinet22.oracle.com [141.146.126.238]
Cc: Leif Johansson , "Morteza Ansari \(moransar\)" , "scim@ietf.org WG" , Kelly Grizzle 
Subject: Re: [scim] Call today?
X-BeenThere: scim@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Simple Cloud Identity Management BOF 
List-Unsubscribe: , 
List-Archive: 
List-Post: 
List-Help: 
List-Subscribe: , 
X-List-Received-Date: Wed, 12 Feb 2014 21:19:20 -0000

--Apple-Mail=_8E74421C-7B8A-4FB9-88FA-2473F05A8176
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=iso-8859-1

Bill,

Thanks for the proposal.

Looks like we also didn't consider readOnly and writeOnly attributes =
such as passwords. =20

Let me think this aft and I'll put a quick proposal together.

Phil

@independentid
www.independentid.com
phil.hunt@oracle.com

On 2014-02-12, at 12:14 PM, Bill Mills  wrote:

> My action item from the call:  Propose language around immutability =
and PUT.
>=20
>=20
> I don't know whether this goes into the definition of immutability or =
PUT, probably PUT:
>=20
> "PUT expects the entire object to be present, if the schema includes =
elements with immutable or ReadOnly elements then the object submitted =
with a PUT MUST include all existing immutable and ReadOnly data.  The =
server MUST reject the PUT and return an error if the submitted data for =
 immutable or ReadOnly elemets do not match exactly."
>=20
>=20
> On Wednesday, February 12, 2014 11:06 AM, Morteza Ansari (moransar) =
 wrote:
> It should be working now.  Not sure what happened but will set up a =
new
> one for next meeting to ensure this is fixed.
>=20
>=20
> Cheers,
> Morteza
>=20
> On 2/12/14 11:03 AM, "Kelly Grizzle"  =
wrote:
>=20
> >The link the meeting is not working for me.  It is showing a meeting =
on
> >the 19th.
> >
> >Morteza, can you send the correct link?
> >
> >
> >-----Original Message-----
> >From: scim [mailto:scim-bounces@ietf.org] On Behalf Of Morteza Ansari
> >(moransar)
> >Sent: Tuesday, February 11, 2014 7:15 PM
> >To: Leif Johansson; Phil Hunt
> >Cc: scim@ietf.org WG
> >Subject: Re: [scim] Call today?
> >
> >Correct, the next meeting is Wed. Fed. 12th at 11am Pacific time.
> >Meeting info is here:
> >
> >To invite others to join, copy and paste everything below into your
> >invitation.=20
> >-------------------------------------------------------
> >Meeting information
> >-------------------------------------------------------
> >Topic: SCIM WG interim
> >Date: Every Wednesday, from Wednesday, August 21, 2013 to no end date
> >Time: 11:00 am, Pacific Daylight Time (San Francisco, GMT-07:00) =
Meeting
> >Number: 340 844 711 Meeting Password: (This meeting does not require =
a
> >password.)
> >
> >-------------------------------------------------------
> >To start or join the online meeting
> >-------------------------------------------------------
> >Go to =
https://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&RT=3DMiM0
> >
> >-------------------------------------------------------
> >Audio conference information
> >-------------------------------------------------------
> >To receive a call back, provide your phone number when you join the
> >meeting, or call the number below and enter the access code.
> >US Toll free: 1-855-797-9485
> >US Toll: +1-415-655-0002
> >Global call-in numbers:
> =
>https://go.webex.com/go/globalcallin.php?serviceType=3DMC&ED=3D153193777&=
tollF
> >r
> >ee=3D1
> >Toll-free dialing restrictions:
> >http://www.webex.com/pdf/tollfree_restrictions.pdf
> >
> >Access code:340 844 711
> >
> >-------------------------------------------------------
> >For assistance
> >-------------------------------------------------------
> >1. Go to https://go.webex.com/go/mc
> >2. On the left navigation bar, click "Support".
> >To add this meeting to your calendar program (for example Microsoft
> >Outlook), click this link:
> =
>https://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&ICS=3DMS&LD=3D=
1&RD=3D2&
> >S
> >T=3D1&SHA2=3DAAAAAXFmPcl25G51pP-VAnTUIPjOJqt0XNEPVKSSFdjwCd-F
> >
> >To check whether you have the appropriate players installed for UCF
> >(Universal Communications Format) rich media files, go to
> >https://go.webex.com/go/systemdiagnosis.php.
> >
> >http://www.webex.com 
> >
> >CCM:+14156550002x340844711#
> >
> >IMPORTANT NOTICE: This WebEx service includes a feature that allows =
audio
> >and any documents and other materials exchanged or viewed during the
> >session to be recorded. You should inform all meeting attendees prior =
to
> >recording if you intend to record the meeting. Please note that any =
such
> >recordings may be subject to discovery in the event of litigation.
> >
> >
> >On 2/5/14 10:39 AM, "Leif Johansson"  wrote:
> >
> >>
> >>
> >>> 5 feb 2014 kl. 18:01 skrev Phil Hunt :
> >>>=20
> >>> Details?
> >>>=20
> >>
> >>its next week right?
> >>
> >>> Phil
> >>> _______________________________________________
> >>> scim mailing list
> >>> scim@ietf.org
> >>> https://www.ietf.org/mailman/listinfo/scim
> >>_______________________________________________
> >>scim mailing list
> >>scim@ietf.org
> >>https://www.ietf.org/mailman/listinfo/scim
> >
> >_______________________________________________
> >scim mailing list
> >scim@ietf.org
> >https://www.ietf.org/mailman/listinfo/scim
>=20
> _______________________________________________
> scim mailing list
> scim@ietf.org
> https://www.ietf.org/mailman/listinfo/scim
>=20
>=20
> _______________________________________________
> scim mailing list
> scim@ietf.org
> https://www.ietf.org/mailman/listinfo/scim


--Apple-Mail=_8E74421C-7B8A-4FB9-88FA-2473F05A8176
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=iso-8859-1




On 2014-02-12, at 12:14 PM, Bill Mills <wmills_92105@yahoo.com> =
wrote:

My action item =
from the call:  Propose language around immutability and =
PUT.
I don't know =
whether this goes into the definition of immutability or PUT, probably =
PUT:

"PUT expects =
the entire object to be present, if the schema includes elements with =
immutable or ReadOnly elements then the object submitted with a PUT MUST =
include all existing immutable and ReadOnly data.  The server MUST =
reject the PUT and return an error if the submitted data for
  immutable or ReadOnly elemets do not match exactly."
 

 
 
 
 
  On Wednesday, February 12, 2014 11:06 AM, =
Morteza Ansari (moransar) <moransar@cisco.com> wrote:
  
  
It should be working now.  =
Not sure what happened but will set up a new
one for =
next meeting to ensure this is fixed.


Cheers,
Morteza

On 2/12/14 11:03 AM, =
"Kelly Grizzle"
 <kelly.grizzle@sailpoint.com> wrote:

>The link the =
meeting is not working for me.  It is showing a meeting on
>the 19th.
>
>Morteza, can you send the correct link?
>
>
>-----Original Message-----
>From: =
scim [mailto:scim-bounces@ietf.org] On =
Behalf Of Morteza Ansari
>(moransar)
>Sent: Tuesday, February 11, 2014 7:15 PM
>To: Leif Johansson; Phil Hunt
>Cc:=
 scim@ietf.org WG
>Subject: Re: [scim] Call today?
>
>Correct, the next meeting is =
Wed. Fed. 12th at 11am Pacific time.
>Meeting info =
is here:
>
>To invite others =
to join, copy and paste everything below into your
>invitation. 
>-------------------------------------------------------=

>Meeting information
>-------------------------------------------------------=

>Topic: SCIM WG interim
>Date: =
Every Wednesday, from Wednesday, August 21, 2013 to no end date
>Time: 11:00 am, Pacific Daylight Time (San Francisco, =
GMT-07:00) Meeting
>Number: 340 844 711 Meeting =
Password: (This meeting does not require a
>password.)
>
>-------------------------------------------------------=

>To start or join the online meeting
>-------------------------------------------------------=

>Go to https://go.webex.com/go/j.php?ED=3D153193777&UID=3D48347=
2947&RT=3DMiM0
>
>-------------------------------------------------------=

>Audio conference information
>-------------------------------------------------------=

>To receive a call back, provide your phone number =
when you join the
>meeting, or call the number =
below and enter the access code.
>US Toll free: =
1-855-797-9485
>US Toll: +1-415-655-0002
>Global call-in numbers:
>https://go.webex.com/go/globalcallin.php?serviceType=3D=
MC&ED=3D153193777&tollF
>r
>ee=3D1
>Toll-free dialing =
restrictions:
>http://www.web=
ex.com/pdf/tollfree_restrictions.pdf
>
>Access code:340 844 711
>
>-------------------------------------------------------=

>For assistance
>-------------------------------------------------------=

>1. Go to https://go.webex.com/go/mc
>2. On the
 left navigation bar, click "Support".
>To add this =
meeting to your calendar program (for example Microsoft
>Outlook), click this link:
>https://go.webex.com/go/j.php?ED=3D=
153193777&UID=3D483472947&ICS=3DMS&LD=3D1&RD=3D2&<=
br clear=3D"none">>S
>T=3D1&SHA2=3DAAAAAXFmPcl25G51pP-VAnTUIPjOJqt0XNEPVK=
SSFdjwCd-F
>
>To check whether =
you have the appropriate players installed for UCF
>(Universal Communications Format) rich media files, =
go to
>https://go.webex.com/=
go/systemdiagnosis.php.
>
>http://www.webex.com <http://www.webex.com/>
>
>CCM:+14156550002x340844711#
>
>IMPORTANT NOTICE: This WebEx =
service includes a feature that allows audio
>and =
any documents and other materials exchanged or viewed during the
>session to be recorded. You should inform all meeting =
attendees prior to
>recording if you intend to =
record the meeting. Please note that any such
>recordings may be subject to discovery
 in the event of litigation.
>
>
>On 2/5/14 10:39 AM, "Leif =
Johansson" <leifj@mnt.se> wrote:
>
>>
>>
>>> 5 feb 2014 kl. =
18:01 skrev Phil Hunt <phil.hunt@oracle.com>:
>>> 
>>> Details?
>>> 
>>
>>its next week right?
>>
>>> Phil
>>> =
_______________________________________________
>>> scim mailing list
>>> scim@ietf.org
>>> https://www.ietf.org/m=
ailman/listinfo/scim
>>_______________________________________________
>>scim mailing list
>>scim@ietf.org
>>https://www.ietf.org/m=
ailman/listinfo/scim
>
>_______________________________________________
>scim mailing list
>scim@ietf.org
>https://www.ietf.org/m=
ailman/listinfo/scim

_______________________________________________
scim mailing list
scim@ietf.org
https://www.ietf.org/m=
ailman/listinfo/scim


  
 
  
 =

_______________________________________________scim mailing list
scim@ietf.org
https://www.ietf.org/ma=
ilman/listinfo/scim

= --Apple-Mail=_8E74421C-7B8A-4FB9-88FA-2473F05A8176-- From wmills_92105@yahoo.com Wed Feb 12 14:18:36 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7EBD01A0018 for ; Wed, 12 Feb 2014 14:18:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.935 X-Spam-Level: X-Spam-Status: No, score=-2.935 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_ADSP_CUSTOM_MED=0.001, DKIM_SIGNED=0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, FREEMAIL_REPLYTO_END_DIGIT=0.25, GB_I_INVITATION=-2, HTML_MESSAGE=0.001, NML_ADSP_CUSTOM_MED=0.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.548, T_DKIM_INVALID=0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l_wec7x0XS4v for ; Wed, 12 Feb 2014 14:18:27 -0800 (PST) Received: from nm41.bullet.mail.bf1.yahoo.com (nm41.bullet.mail.bf1.yahoo.com [216.109.114.57]) by ietfa.amsl.com (Postfix) with ESMTP id 6AEB31A001F for ; Wed, 12 Feb 2014 14:18:27 -0800 (PST) Received: from [98.139.215.140] by nm41.bullet.mail.bf1.yahoo.com with NNFMP; 12 Feb 2014 22:18:26 -0000 Received: from [98.139.212.222] by tm11.bullet.mail.bf1.yahoo.com with NNFMP; 12 Feb 2014 22:18:26 -0000 Received: from [127.0.0.1] by omp1031.mail.bf1.yahoo.com with NNFMP; 12 Feb 2014 22:18:26 -0000 X-Yahoo-Newman-Property: ymail-3 X-Yahoo-Newman-Id: 267530.53598.bm@omp1031.mail.bf1.yahoo.com Received: (qmail 69710 invoked by uid 60001); 12 Feb 2014 22:18:26 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1392243506; bh=Ob+JSrZvvPCSDZcsGeAMq+6VXU/ReyyahgFnT1kCZSo=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=rV9wGSO4tNx5p1lFF42p1ZzwnYiWubdYdgRPAYcmG3Z/FMXa+o+pmT/wgesltftaAalB4HpZIWK1zsHAld6lVgbokzHrWQgM37VBtHqEFH2VfSg9BywWrjDYp5BHA5s9eu7ZmPi+hNLUyBq5pmviMy4bjEXZb4lVY7Q1z/YNVCs= DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=Whdep8nU1Rhdnvo+Gkzm9LMIN4DgocKhtumkp1nC4p4GSL2Yko0IkwA/+YOLs84Pc4cHb5u9HWytEqNXcAkAESALpulz4NfQRnca3UCqTTrgG+6DvQyvyQuKb6/CYQiADq1S3UNY7Lfxu2nFyvapUyK2KxMX0yf5DwRDBNZykWg=; X-YMail-OSG: cKVfUFEVM1l0DP9Z5zS81RdeYxH7RDDmc9m3cXQiGDxUHCh 1n1yLONNh__nHD0Djy7C_PLKscqiOWrbZczJZN.xRelzWX1SlDHRdlqzKOVv qSahrT34Q9jS4Vr7Pfg.IhmGTkeBpCtnzitaDkTk0MCIUV4z.Pf83WuFznXt am2hnOR3FurzBRNJV63XDYdl5t3OB_ezGkzR6Qe1zxqTyRBfjhziCyHCDE1w MKU3lDQo7.BIPYZPyEWkq6_LFFimR_JaMwwscMWqR2dzuqK_6FhcVEaZKo9n 43Pc_RueoxA3WOD4n5H9LneCSVfOJz.Oojy9_p8Aftc96Iodmzixlr7fR1BY d67tgPcNAhm5UUgMbuPA74xmig4cIx2CUfNpeMj.K22jAmdC4t4P7KMIdkf1 gwSONq27CXTgfZcbnTKurdUDHfVK02oR7ZuakJTjVNN40QOGI2LS4zcQ74GH Cwk0cN_NUvmA8DhMjyx_zbQeP_K0nmZtGnXo3g0IECfAhtjq6.baxMhL.dUl v0ZTAM573aFP3l5zdPxTmN.7St9skl26e31ug7TQEkiE1.Wo.0SrFCJiKwDj duWZvLTbBZ1mxGdRNHnGlGsGAjDVs1sqZRx9claKGyV3vn6rfixhXg1H78Nk _7yTkgGbp5eDzf_g_8X8K5JT6rYx5nbn2qp.EDigmhfEJzhKjwhWV_wrhUuP 2xsSJaw5PhBQeE9osNTkw5.Ej96MwUgiwjFeE0Lg7Qo3FPh90YBR3dnzdrA6 gFQ-- Received: from [209.131.50.178] by web142804.mail.bf1.yahoo.com via HTTP; Wed, 12 Feb 2014 14:18:25 PST X-Rocket-MIMEInfo: 002.001, WWVhaCwgV3JpdGVPbmx5IG5lZWRzIHRob3VnaHQsIHdlIGRvbid0IHdhbnQgdG8gZW5kIHVwIHdpdGggUFVUIHRyYW5zYWN0aW9ucyBkZWxldGluZyBwYXNzd29yZHMuIMKgUGFzc3dvcmRzIHBlcmhhcHMgbWlnaHQgbmVlZCBhICJyZXF1aXJlZCIgYXR0cmlidXRlIHdoaWNoIG1lYW5zIHRoYXQgYSBQVVQgdGhhdCBkb2Vzbid0IGluY2x1ZGUgaXQgd291bGQgZmFpbC4KCgoKCk9uIFdlZG5lc2RheSwgRmVicnVhcnkgMTIsIDIwMTQgMToxOSBQTSwgUGhpbCBIdW50IDxwaGlsLmh1bnRAb3JhY2xlLmNvbT4gd3IBMAEBAQE- X-Mailer: YahooMailWebService/0.8.177.636 References: <7F7F895E-455D-450D-876E-B6AB466599D6@mnt.se> <118dcf276c044f26adc85c3051dddd29@BN1PR04MB392.namprd04.prod.outlook.com> <1392236062.76159.YahooMailNeo@web142802.mail.bf1.yahoo.com> <58399EA7-DEB6-4EEC-8A85-21D2B133A626@oracle.com> Message-ID: <1392243505.21463.YahooMailNeo@web142804.mail.bf1.yahoo.com> Date: Wed, 12 Feb 2014 14:18:25 -0800 (PST) From: Bill Mills To: Phil Hunt In-Reply-To: <58399EA7-DEB6-4EEC-8A85-21D2B133A626@oracle.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="-2129327256-1288704277-1392243505=:21463" Cc: Leif Johansson , Kelly Grizzle , "Morteza Ansari \(moransar\)" , "scim@ietf.org WG" Subject: Re: [scim] Call today? X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: Bill Mills List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Feb 2014 22:18:36 -0000 ---2129327256-1288704277-1392243505=:21463 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable Yeah, WriteOnly needs thought, we don't want to end up with PUT transaction= s deleting passwords. =A0Passwords perhaps might need a "required" attribut= e which means that a PUT that doesn't include it would fail.=0A=0A=0A=0A=0A= On Wednesday, February 12, 2014 1:19 PM, Phil Hunt w= rote:=0A =0ABill,=0A=0AThanks for the proposal.=0A=0ALooks like we also did= n't consider readOnly and writeOnly attributes such as passwords. =A0=0A=0A= Let me think this aft and I'll put a quick proposal together.=0A=0APhil=0A= =0A@independentid=0Awww.independentid.comphil.hunt@oracle.com=0A=0AOn 2014-= 02-12, at 12:14 PM, Bill Mills wrote:=0A=0AMy acti= on item from the call: =A0Propose language around immutability and PUT.=0A>= =0A>=0A>=0A>=0A>I don't know whether this goes into the definition of immut= ability or PUT, probably PUT:=0A>=0A>=0A>"PUT expects the entire object to = be present, if the schema includes elements with immutable or ReadOnly elem= ents then the object submitted with a PUT MUST include all existing immutab= le and ReadOnly data. =A0The server MUST reject the PUT and return an error= if the submitted data for =A0immutable or ReadOnly=A0elemets do=A0not matc= h exactly."=0A>=0A>=0A>=0A>On Wednesday, February 12, 2014 11:06 AM, Mortez= a Ansari (moransar) wrote:=0A> =0A>It should be workin= g now.=A0 Not sure what happened but will set up a new=0A>one for next meet= ing to ensure this is fixed.=0A>=0A>=0A>Cheers,=0A>Morteza=0A>=0A>=0A>On 2/= 12/14 11:03 AM, "Kelly Grizzle"=0A wrote:=0A>= =0A>>The link the meeting is not working for me.=A0 It is showing a meeting= on=0A>>the 19th.=0A>>=0A>>Morteza, can you send the correct link?=0A>>=0A>= >=0A>>-----Original Message-----=0A>>From: scim [mailto:scim-bounces@ietf.o= rg] On Behalf Of Morteza Ansari=0A>>(moransar)=0A>>Sent: Tuesday, February = 11, 2014 7:15 PM=0A>>To: Leif Johansson; Phil Hunt=0A>>Cc: scim@ietf.org WG= =0A>>Subject: Re: [scim] Call today?=0A>>=0A>>Correct, the next meeting is = Wed. Fed. 12th at 11am Pacific time.=0A>>Meeting info is here:=0A>>=0A>>To = invite others to join, copy and paste everything below into your=0A>>invita= tion. =0A>>-------------------------------------------------------=0A>>Meet= ing information=0A>>-------------------------------------------------------= =0A>>Topic: SCIM WG interim=0A>>Date: Every Wednesday, from Wednesday, Augu= st 21, 2013 to no end date=0A>>Time: 11:00 am, Pacific Daylight Time (San F= rancisco, GMT-07:00) Meeting=0A>>Number: 340 844 711 Meeting Password: (Thi= s meeting does not require a=0A>>password.)=0A>>=0A>>----------------------= ---------------------------------=0A>>To start or join the online meeting= =0A>>-------------------------------------------------------=0A>>Go to http= s://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&RT=3DMiM0=0A>>=0A>= >-------------------------------------------------------=0A>>Audio conferen= ce information=0A>>-------------------------------------------------------= =0A>>To receive a call back, provide your phone number when you join the=0A= >>meeting, or call the number below and enter the access code.=0A>>US Toll = free: 1-855-797-9485=0A>>US Toll: +1-415-655-0002=0A>>Global call-in number= s:=0A>>https://go.webex.com/go/globalcallin.php?serviceType=3DMC&ED=3D15319= 3777&tollF=0A>>r=0A>>ee=3D1=0A>>Toll-free dialing restrictions:=0A>>http://= www.webex.com/pdf/tollfree_restrictions.pdf=0A>>=0A>>Access code:340 844 71= 1=0A>>=0A>>-------------------------------------------------------=0A>>For = assistance=0A>>-------------------------------------------------------=0A>>= 1. Go to https://go.webex.com/go/mc=0A>>2. On the=0A left navigation bar, c= lick "Support".=0A>>To add this meeting to your calendar program (for examp= le Microsoft=0A>>Outlook), click this link:=0A>>https://go.webex.com/go/j.p= hp?ED=3D153193777&UID=3D483472947&ICS=3DMS&LD=3D1&RD=3D2&=0A>>S=0A>>T=3D1&S= HA2=3DAAAAAXFmPcl25G51pP-VAnTUIPjOJqt0XNEPVKSSFdjwCd-F=0A>>=0A>>To check wh= ether you have the appropriate players installed for UCF=0A>>(Universal Com= munications Format) rich media files, go to=0A>>https://go.webex.com/go/sys= temdiagnosis.php.=0A>>=0A>>http://www.webex.com =0A>= >=0A>>CCM:+14156550002x340844711#=0A>>=0A>>IMPORTANT NOTICE: This WebEx ser= vice includes a feature that allows audio=0A>>and any documents and other m= aterials exchanged or viewed during the=0A>>session to be recorded. You sho= uld inform all meeting attendees prior to=0A>>recording if you intend to re= cord the meeting. Please note that any such=0A>>recordings may be subject t= o discovery=0A in the event of litigation.=0A>>=0A>>=0A>>On 2/5/14 10:39 AM= , "Leif Johansson" wrote:=0A>>=0A>>>=0A>>>=0A>>>> 5 feb 2014= kl. 18:01 skrev Phil Hunt :=0A>>>> =0A>>>> Details?= =0A>>>> =0A>>>=0A>>>its next week right?=0A>>>=0A>>>> Phil=0A>>>> _________= ______________________________________=0A>>>> scim mailing list=0A>>>> scim= @ietf.org=0A>>>> https://www.ietf.org/mailman/listinfo/scim=0A>>>__________= _____________________________________=0A>>>scim mailing list=0A>>>scim@ietf= .org=0A>>>https://www.ietf.org/mailman/listinfo/scim=0A>>=0A>>_____________= __________________________________=0A>>scim mailing list=0A>>scim@ietf.org= =0A>>https://www.ietf.org/mailman/listinfo/scim=0A>=0A>____________________= ___________________________=0A>scim mailing list=0A>scim@ietf.org=0A>https:= //www.ietf.org/mailman/listinfo/scim=0A>=0A>=0A>___________________________= ____________________=0A>scim mailing list=0A>scim@ietf.org=0A>https://www.i= etf.org/mailman/listinfo/scim=0A>=0A=0A=0A_________________________________= ______________=0Ascim mailing list=0Ascim@ietf.org=0Ahttps://www.ietf.org/m= ailman/listinfo/scim ---2129327256-1288704277-1392243505=:21463 Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable
Yeah, WriteOnly needs thought, we don't want to en= d up with PUT transactions deleting passwords.  Passwords perhaps migh= t need a "required" attribute which means that a PUT that doesn't include i= t would fail.

=

On Wednesday, February 12, 2014 1:19 PM, Phil Hunt <phi= l.hunt@oracle.com> wrote:
Bill,

Thanks for the proposal.

Look= s like we also didn't consider readOnly and writeOnly attributes such as pa= sswords.  

Let me think this a= ft and I'll put a quick proposal together.

=0A
On 2014-02-12, at 12:14 = PM, Bill Mills <wmills_92105@yahoo.com> wrote:

My action item from the call:  Propose language aroun= d immutability and PUT.


I don't know whether this goes into the definition of immutability or PUT, p= robably PUT:

"PUT expects the entire object to be present, if t= he schema includes elements with immutable or ReadOnly elements then the ob= ject submitted with a PUT MUST include all existing immutable and ReadOnly = data.  The server MUST reject the PUT and return an error if the submitted = data for=0A  = ;immutable or Rea= dOnly elemet= s do not match exactly."

=0A
On Wednesday, February 12, 2014 11:06 AM, Morteza An= sari (moransar) <mora= nsar@cisco.com> wrote:
It should be working now.  Not sure = what happened but will set up a new
one for next meeting = to ensure this is fixed.


Cheers,
Morteza

On 2/12/14 11:03 AM, "Kelly Grizzle"=0A <kelly.grizzle@sailpoint.= com> wrote:

>The link the me= eting is not working for me.  It is showing a meeting on
>the 19th.
>
>Morteza, ca= n you send the correct link?
>
><= br clear=3D"none">>-----Original Message-----
>From= : scim [mailto:sci= m-bounces@ietf.org] On Behalf Of Morteza Ansari
>(= moransar)
>Sent: Tuesday, February 11, 2014 7:15 PM>To: Leif Johansson; Phil Hunt
>Cc:= scim@ietf.org WG
>S= ubject: Re: [scim] Call today?
>
>= ;Correct, the next meeting is Wed. Fed. 12th at 11am Pacific time.
>Meeting info is here:
>
>To invite others to join, copy and paste everything below into your>invitation.
>-------------------= ------------------------------------
>Meeting informat= ion
>-------------------------------------------------= ------
>Topic: SCIM WG interim
>D= ate: Every Wednesday, from Wednesday, August 21, 2013 to no end date
>Time: 11:00 am, Pacific Daylight Time (San Francisco, GMT-0= 7:00) Meeting
>Number: 340 844 711 Meeting Password: (= This meeting does not require a
>password.)
>
>-------------------------------------------------------=
>To start or join the online meeting
>-------------------------------------------------------
>Go to https://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&= RT=3DMiM0
>
>----------------= ---------------------------------------
>Audio confere= nce information
>-------------------------------------= ------------------
>To receive a call back, provide yo= ur phone number when you join the
>meeting, or call th= e number below and enter the access code.
>US Toll fre= e: 1-855-797-9485
>US Toll: +1-415-655-0002
>Global call-in numbers:
>https://go.webex.com/go/globalcallin.php?serviceType=3DM= C&ED=3D153193777&tollF
>r
>ee=3D1
>Toll-free dialing restrictions:
>http://www.webex.com/pd= f/tollfree_restrictions.pdf
>
&g= t;Access code:340 844 711
>
>----= ---------------------------------------------------
>F= or assistance
>---------------------------------------= ----------------
>1. Go to https://go.= webex.com/go/mc
>2. On the=0A left navigation bar,= click "Support".
>To add this meeting to your calenda= r program (for example Microsoft
>Outlook), click this= link:
>https://go.webex.com/go/j.php= ?ED=3D153193777&UID=3D483472947&ICS=3DMS&LD=3D1&RD=3D2&=
>S
>T=3D1&SHA2=3DAAAAAXF= mPcl25G51pP-VAnTUIPjOJqt0XNEPVKSSFdjwCd-F
>
>To check whether you have the appropriate players installed f= or UCF
>(Universal Communications Format) rich media f= iles, go to
>https://go= .webex.com/go/systemdiagnosis.php.
>
>http://www= .webex.com <http://www.webex.com/>
>
>CCM:+14156550002x340844711#
&= gt;
>IMPORTANT NOTICE: This WebEx service includes a f= eature that allows audio
>and any documents and other = materials exchanged or viewed during the
>session to b= e recorded. You should inform all meeting attendees prior to
>recording if you intend to record the meeting. Please note that any= such
>recordings may be subject to discovery=0A in th= e event of litigation.
>
>
>On 2/5/14 10:39 AM, "Leif Johansson" <leifj@mnt.se> wrote:
>
>>
>>
>&g= t;> 5 feb 2014 kl. 18:01 skrev Phil Hunt <phil.hunt@oracle.com>:
>>>
>>> Details?
= >>>
>>
>>its next= week right?
>>
>>> Phil=
>>> ___________________________________________= ____
>>> scim mailing list
>= ;>> scim@ietf.org
>>> https://www.ietf.org/mailman/listinfo/scim
>>_______________________________________________
= >>scim mailing list
>>scim@ietf.org
>>https://www.ietf.org/mailman/listinfo/scim
>
>_________________________________________= ______
>scim mailing list
>scim@ietf.org
>https://www.ietf.org/mailman/listinfo/scim
________________________________________= _______
scim mailing list
scim@ietf.org
https://www.ietf.org/mailman/listinfo/scim


=
____________________________________= ___________
scim mailing list
scim@ietf.org
https://www.ietf.org/mailman/listinfo/scim


_________________________= ______________________
scim mailing list
scim@ietf.org
https://www.ietf.o= rg/mailman/listinfo/scim


=
---2129327256-1288704277-1392243505=:21463-- From phil.hunt@oracle.com Wed Feb 12 15:17:41 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0235D1A0032 for ; Wed, 12 Feb 2014 15:17:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.748 X-Spam-Level: X-Spam-Status: No, score=-6.748 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, GB_I_INVITATION=-2, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JYZtLO6_iCaw for ; Wed, 12 Feb 2014 15:17:36 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) by ietfa.amsl.com (Postfix) with ESMTP id 241811A0035 for ; Wed, 12 Feb 2014 15:17:35 -0800 (PST) Received: from acsinet21.oracle.com (acsinet21.oracle.com [141.146.126.237]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s1CNHUVZ001119 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Wed, 12 Feb 2014 23:17:32 GMT Received: from userz7022.oracle.com (userz7022.oracle.com [156.151.31.86]) by acsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1CNHTv7011139 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 12 Feb 2014 23:17:30 GMT Received: from abhmp0015.oracle.com (abhmp0015.oracle.com [141.146.116.21]) by userz7022.oracle.com (8.14.5+Sun/8.14.4) with ESMTP id s1CNHSqp028313; Wed, 12 Feb 2014 23:17:28 GMT Received: from [192.168.1.124] (/24.86.29.34) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 12 Feb 2014 15:17:28 -0800 Content-Type: multipart/alternative; boundary="Apple-Mail=_BED3CB1F-29F0-4229-AEE6-A2CAB2E391BA" Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\)) From: Phil Hunt In-Reply-To: <1392243505.21463.YahooMailNeo@web142804.mail.bf1.yahoo.com> Date: Wed, 12 Feb 2014 15:17:33 -0800 Message-Id: <69B8BD7C-7602-490E-9562-CC701B8BABA2@oracle.com> References: <7F7F895E-455D-450D-876E-B6AB466599D6@mnt.se> <118dcf276c044f26adc85c3051dddd29@BN1PR04MB392.namprd04.prod.outlook.com> <1392236062.76159.YahooMailNeo@web142802.mail.bf1.yahoo.com> <58399EA7-DEB6-4EEC-8A85-21D2B133A626@oracle.com> <1392243505.21463.YahooMailNeo@web142804.mail.bf1.yahoo.com> To: Bill Mills X-Mailer: Apple Mail (2.1510) X-Source-IP: acsinet21.oracle.com [141.146.126.237] Cc: Leif Johansson , "Morteza Ansari \(moransar\)" , "scim@ietf.org WG" , Kelly Grizzle Subject: Re: [scim] Call today? X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Feb 2014 23:17:41 -0000 --Apple-Mail=_BED3CB1F-29F0-4229-AEE6-A2CAB2E391BA Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=iso-8859-1 Yes. I was just thinking that. "required" means that the client MUST = provide it. So a SP could say the password is required. How about the following table of impacts based on mutability of = attributes in a PUT operation: When submitting attributes via the PUT request, attribute "mutability" = will have the following impacts: readWrite, writeOnly - Any values provided replace the existing values. = Omitting the attribute or specific values means the attribute or values = are to be removed. immutable - Any values provided MUST match the existing values. An = omission of the attribute will not remove the existing value(s). readOnly - Any values provided (e.g. meta.resourceType) will be ignored. If an attribute is "required", the client MUST specify the attribute in = a PUT request.=20 Does this work? Phil @independentid www.independentid.com phil.hunt@oracle.com On 2014-02-12, at 2:18 PM, Bill Mills wrote: > Yeah, WriteOnly needs thought, we don't want to end up with PUT = transactions deleting passwords. Passwords perhaps might need a = "required" attribute which means that a PUT that doesn't include it = would fail. >=20 >=20 >=20 > On Wednesday, February 12, 2014 1:19 PM, Phil Hunt = wrote: > Bill, >=20 > Thanks for the proposal. >=20 > Looks like we also didn't consider readOnly and writeOnly attributes = such as passwords. =20 >=20 > Let me think this aft and I'll put a quick proposal together. >=20 > Phil >=20 > @independentid > www.independentid.com > phil.hunt@oracle.com >=20 > On 2014-02-12, at 12:14 PM, Bill Mills wrote: >=20 >> My action item from the call: Propose language around immutability = and PUT. >>=20 >>=20 >> I don't know whether this goes into the definition of immutability or = PUT, probably PUT: >>=20 >> "PUT expects the entire object to be present, if the schema includes = elements with immutable or ReadOnly elements then the object submitted = with a PUT MUST include all existing immutable and ReadOnly data. The = server MUST reject the PUT and return an error if the submitted data for = immutable or ReadOnly elemets do not match exactly." >>=20 >>=20 >> On Wednesday, February 12, 2014 11:06 AM, Morteza Ansari (moransar) = wrote: >> It should be working now. Not sure what happened but will set up a = new >> one for next meeting to ensure this is fixed. >>=20 >>=20 >> Cheers, >> Morteza >>=20 >> On 2/12/14 11:03 AM, "Kelly Grizzle" = wrote: >>=20 >> >The link the meeting is not working for me. It is showing a meeting = on >> >the 19th. >> > >> >Morteza, can you send the correct link? >> > >> > >> >-----Original Message----- >> >From: scim [mailto:scim-bounces@ietf.org] On Behalf Of Morteza = Ansari >> >(moransar) >> >Sent: Tuesday, February 11, 2014 7:15 PM >> >To: Leif Johansson; Phil Hunt >> >Cc: scim@ietf.org WG >> >Subject: Re: [scim] Call today? >> > >> >Correct, the next meeting is Wed. Fed. 12th at 11am Pacific time. >> >Meeting info is here: >> > >> >To invite others to join, copy and paste everything below into your >> >invitation.=20 >> >------------------------------------------------------- >> >Meeting information >> >------------------------------------------------------- >> >Topic: SCIM WG interim >> >Date: Every Wednesday, from Wednesday, August 21, 2013 to no end = date >> >Time: 11:00 am, Pacific Daylight Time (San Francisco, GMT-07:00) = Meeting >> >Number: 340 844 711 Meeting Password: (This meeting does not require = a >> >password.) >> > >> >------------------------------------------------------- >> >To start or join the online meeting >> >------------------------------------------------------- >> >Go to = https://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&RT=3DMiM0 >> > >> >------------------------------------------------------- >> >Audio conference information >> >------------------------------------------------------- >> >To receive a call back, provide your phone number when you join the >> >meeting, or call the number below and enter the access code. >> >US Toll free: 1-855-797-9485 >> >US Toll: +1-415-655-0002 >> >Global call-in numbers: >> = >https://go.webex.com/go/globalcallin.php?serviceType=3DMC&ED=3D153193777&= tollF >> >r >> >ee=3D1 >> >Toll-free dialing restrictions: >> >http://www.webex.com/pdf/tollfree_restrictions.pdf >> > >> >Access code:340 844 711 >> > >> >------------------------------------------------------- >> >For assistance >> >------------------------------------------------------- >> >1. Go to https://go.webex.com/go/mc >> >2. On the left navigation bar, click "Support". >> >To add this meeting to your calendar program (for example Microsoft >> >Outlook), click this link: >> = >https://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&ICS=3DMS&LD=3D= 1&RD=3D2& >> >S >> >T=3D1&SHA2=3DAAAAAXFmPcl25G51pP-VAnTUIPjOJqt0XNEPVKSSFdjwCd-F >> > >> >To check whether you have the appropriate players installed for UCF >> >(Universal Communications Format) rich media files, go to >> >https://go.webex.com/go/systemdiagnosis.php. >> > >> >http://www.webex.com >> > >> >CCM:+14156550002x340844711# >> > >> >IMPORTANT NOTICE: This WebEx service includes a feature that allows = audio >> >and any documents and other materials exchanged or viewed during the >> >session to be recorded. You should inform all meeting attendees = prior to >> >recording if you intend to record the meeting. Please note that any = such >> >recordings may be subject to discovery in the event of litigation. >> > >> > >> >On 2/5/14 10:39 AM, "Leif Johansson" wrote: >> > >> >> >> >> >> >>> 5 feb 2014 kl. 18:01 skrev Phil Hunt : >> >>>=20 >> >>> Details? >> >>>=20 >> >> >> >>its next week right? >> >> >> >>> Phil >> >>> _______________________________________________ >> >>> scim mailing list >> >>> scim@ietf.org >> >>> https://www.ietf.org/mailman/listinfo/scim >> >>_______________________________________________ >> >>scim mailing list >> >>scim@ietf.org >> >>https://www.ietf.org/mailman/listinfo/scim >> > >> >_______________________________________________ >> >scim mailing list >> >scim@ietf.org >> >https://www.ietf.org/mailman/listinfo/scim >>=20 >> _______________________________________________ >> scim mailing list >> scim@ietf.org >> https://www.ietf.org/mailman/listinfo/scim >>=20 >>=20 >> _______________________________________________ >> scim mailing list >> scim@ietf.org >> https://www.ietf.org/mailman/listinfo/scim >=20 >=20 > _______________________________________________ > scim mailing list > scim@ietf.org > https://www.ietf.org/mailman/listinfo/scim >=20 >=20 > _______________________________________________ > scim mailing list > scim@ietf.org > https://www.ietf.org/mailman/listinfo/scim --Apple-Mail=_BED3CB1F-29F0-4229-AEE6-A2CAB2E391BA Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=iso-8859-1 Yes. =  I was just thinking that.  "required" means that the client = MUST provide it. So a SP could say the password is = required.

How about the following table of = impacts based on mutability of attributes in a PUT = operation:

When submitting attributes via the PUT request, attribute = "mutability" will have the following impacts:
  • readWrite,= writeOnly - Any values provided replace the existing values. Omitting = the attribute or specific values means the attribute or values are to be = removed.
  • immutable = - Any values provided MUST match the existing values. An omission of the = attribute will not remove the existing value(s).
  • readOnly - Any values provided (e.g. = meta.resourceType) will be ignored.

If an attribute is "required", the = client MUST specify the attribute in a PUT = request. 

Does this = work?

Phil

@independenti= d
phil.hunt@oracle.com
=

On 2014-02-12, at 2:18 PM, Bill Mills <wmills_92105@yahoo.com> = wrote:

Yeah, WriteOnly needs = thought, we don't want to end up with PUT transactions deleting = passwords.  Passwords perhaps might need a "required" attribute = which means that a PUT that doesn't include it would = fail.


=
= On Wednesday, February 12, 2014 1:19 = PM, Phil Hunt <phil.hunt@oracle.com> = wrote:
Bill,

Thanks for = the proposal.

Looks like we = also didn't consider readOnly and writeOnly attributes such as = passwords.  

Let me think = this aft and I'll put a quick proposal together.


On 2014-02-12, at 12:14 PM, Bill Mills = <wmills_92105@yahoo.com> = wrote:

My action item = from the call:  Propose language around immutability and = PUT.


I don't know whether this goes into the definition of immutability or = PUT, probably PUT:

"PUT expects = the entire object to be present, if the schema includes elements with = immutable or ReadOnly elements then the object submitted with a PUT MUST = include all existing immutable and ReadOnly data.  The server MUST reject the PUT and return an error if the = submitted data for  immutable or ReadOnly elemets do not match exactly."


On Wednesday, February 12, 2014 11:06 AM, = Morteza Ansari (moransar) <moransar@cisco.com> wrote:
It should be working now.  = Not sure what happened but will set up a new
one for = next meeting to ensure this is fixed.


Cheers,
Morteza

On 2/12/14 11:03 AM, = "Kelly Grizzle" <kelly.grizzle@sailpoint.com> wrote:

>The link the = meeting is not working for me.  It is showing a meeting on
>the 19th.
>
>Morteza, can you send the correct link?
>
>
>-----Original Message-----
>From: = scim [mailto:scim-bounces@ietf.org] On = Behalf Of Morteza Ansari
>(moransar)
>Sent: Tuesday, February 11, 2014 7:15 PM
>To: Leif Johansson; Phil Hunt
>Cc:= scim@ietf.org WG
>Subject: Re: [scim] Call today?
>
>Correct, the next meeting is = Wed. Fed. 12th at 11am Pacific time.
>Meeting info = is here:
>
>To invite others = to join, copy and paste everything below into your
>invitation.
>-------------------------------------------------------=
>Meeting information
>-------------------------------------------------------=
>Topic: SCIM WG interim
>Date: = Every Wednesday, from Wednesday, August 21, 2013 to no end date
>Time: 11:00 am, Pacific Daylight Time (San Francisco, = GMT-07:00) Meeting
>Number: 340 844 711 Meeting = Password: (This meeting does not require a
>password.)
>
>-------------------------------------------------------=
>To start or join the online meeting
>-------------------------------------------------------=
>Go to https://go.webex.com/go/j.php?ED=3D153193777&UID=3D48347= 2947&RT=3DMiM0
>
>-------------------------------------------------------=
>Audio conference information
>-------------------------------------------------------=
>To receive a call back, provide your phone number = when you join the
>meeting, or call the number = below and enter the access code.
>US Toll free: = 1-855-797-9485
>US Toll: +1-415-655-0002
>Global call-in numbers:
>https://go.webex.com/go/globalcallin.php?serviceType=3D= MC&ED=3D153193777&tollF
>r
>ee=3D1
>Toll-free dialing = restrictions:
>http://www.web= ex.com/pdf/tollfree_restrictions.pdf
>
>Access code:340 844 711
>
>-------------------------------------------------------=
>For assistance
>-------------------------------------------------------=
>1. Go to https://go.webex.com/go/mc
>2. On the left navigation bar, click "Support".
>To add this = meeting to your calendar program (for example Microsoft
>Outlook), click this link:
>https://go.webex.com/go/j.php?ED=3D= 153193777&UID=3D483472947&ICS=3DMS&LD=3D1&RD=3D2&<= br clear=3D"none">>S
>T=3D1&SHA2=3DAAAAAXFmPcl25G51pP-VAnTUIPjOJqt0XNEPVK= SSFdjwCd-F
>
>To check whether = you have the appropriate players installed for UCF
>(Universal Communications Format) rich media files, = go to
>https://go.webex.com/= go/systemdiagnosis.php.
>
>http://www.webex.com <http://www.webex.com/>
>
>CCM:+14156550002x340844711#
>
>IMPORTANT NOTICE: This WebEx = service includes a feature that allows audio
>and = any documents and other materials exchanged or viewed during the
>session to be recorded. You should inform all meeting = attendees prior to
>recording if you intend to = record the meeting. Please note that any such
>recordings may be subject to discovery in the event of litigation.
>
>
>On 2/5/14 10:39 AM, "Leif = Johansson" <leifj@mnt.se> wrote:
>
>>
>>
>>> 5 feb 2014 kl. = 18:01 skrev Phil Hunt <phil.hunt@oracle.com>:
>>>
>>> Details?
>>>
>>
>>its next week right?
>>
>>> Phil
>>> = _______________________________________________
>>> scim mailing list
>>> scim@ietf.org
>>> https://www.ietf.org/m= ailman/listinfo/scim
>>_______________________________________________
>>scim mailing list
>>scim@ietf.org
>>https://www.ietf.org/m= ailman/listinfo/scim
>
>_______________________________________________
>scim mailing list
>scim@ietf.org
>https://www.ietf.org/m= ailman/listinfo/scim

_______________________________________________
scim mailing list
scim@ietf.org
https://www.ietf.org/m= ailman/listinfo/scim


=
_______________________________________________scim mailing list
scim@ietf.org
https://www.ietf.org/m= ailman/listinfo/scim


_______________________________________________
scim mailing list
scim@ietf.org
https://www.ietf.org/mailman/listinfo/scim


= _______________________________________________
scim = mailing list
scim@ietf.org
https://www.ietf.org/ma= ilman/listinfo/scim

= --Apple-Mail=_BED3CB1F-29F0-4229-AEE6-A2CAB2E391BA-- From wmills@yahoo-inc.com Wed Feb 12 15:37:54 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BF1DF1A0043 for ; Wed, 12 Feb 2014 15:37:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -18.22 X-Spam-Level: X-Spam-Status: No, score=-18.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, GB_I_INVITATION=-2, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_NEUTRAL=0.779, USER_IN_DEF_WHITELIST=-15] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nRCXx832f2P2 for ; Wed, 12 Feb 2014 15:37:51 -0800 (PST) Received: from mrout2-b.corp.bf1.yahoo.com (mrout2-b.corp.bf1.yahoo.com [98.139.253.105]) by ietfa.amsl.com (Postfix) with ESMTP id B2EB51A002F for ; Wed, 12 Feb 2014 15:37:50 -0800 (PST) Received: from BF1-EX10-CAHT09.y.corp.yahoo.com (bf1-ex10-caht09.corp.bf1.yahoo.com [10.74.209.198]) by mrout2-b.corp.bf1.yahoo.com (8.14.4/8.14.4/y.out) with ESMTP id s1CNaw7B048177 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL) for ; Wed, 12 Feb 2014 15:36:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=yahoo-inc.com; s=cobra; t=1392248218; bh=1IUeZLpvR45edUz86n11z0/fcx2UpxZOD4ZBU4H/LZY=; h=References:Date:From:Reply-To:Subject:In-Reply-To; b=iSDovHi6xUPW4aE2vG02k3xcLQJUUGk8ldz0eQon4i/L8H/VOTWVwIcIPfCsPlf0o 0OHTWJPk/WLp7TnP6bPyhF1T+B1ZiRooJ5fiIN/7ENRol4yLcx00sAUoBp+J2A4KkZ 2+0WaqXBqXoKVO5Nxn5BPTjMtbDbNYv9E7qeq9XQ= Received: from omp1038.mail.ne1.yahoo.com (98.138.88.238) by BF1-EX10-CAHT09.y.corp.yahoo.com (10.74.209.170) with Microsoft SMTP Server (TLS) id 14.3.174.1; Wed, 12 Feb 2014 18:36:40 -0500 Received: (qmail 26434 invoked by uid 1000); 12 Feb 2014 23:36:57 -0000 Received: (qmail 14026 invoked by uid 60001); 12 Feb 2014 23:36:56 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo-inc.com; s=ginc1024; t=1392248216; bh=EfS0TCobqKZeXXmh4t90kno5lJjUkWBZMcw9j9J5ZkY=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=WWt2UujTpENiF/2ayVmbrgHR2qpRfRrqM9dieYpavW8Ervqds5BRbyn/XyjkGxK6OgsG9wGwrfbJPhs0UE3x/iLt/j2xViZX/ThiYd5X5Dq45XwfeTgVYuOboCQFEf4wMyCs5v5AxW0z3PR1rYdw7leX18n62iafKuQiefX7C/c= DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ginc1024; d=yahoo-inc.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=S5QPRqPuzxwt5CvYhHzY1Vlcg9yQsi2alQo9Z2IGobQuDUtcFfdt2S+UHM1cgJmoE/e5o94oJJF0cGT9RoCWBYzH65TwnrGZDVEs8gmmTuGA31d+VMyA/qGgGIuFqYIAGQZR9HOgAMUsbkXCmBOR3bvoRnaBbioF79Ct6iILUGo=; X-YMail-OSG: fPeBmvoVM1mBHX8XfItu2wK2qj2kVxQMLl5.kM_7mF80Ab4 Il2Gm7iT7kZkH7uTc.SQn1d0VfTcI55XyYYHYJSsRaPzulPBbm3SIa31dB91 CNtxgcCVe5jzob3190lXIiJrROmsFk_Sk5pa_rLOIWE_eL8FvvlQAGf86zw. DPjG1QrkJTPulSvi.qvj.oC9VgTFzAD1LNooex2VZk55hXtDgHPCxCXOqX7h I9czMhTYHgtscz3m2NZ3djw1NCMVkwo3gp.7MCre4z9X6DZ6OtMJLGciT6Sj vu375dglgyndBXomwen0- Received: from [209.131.50.178] by web125604.mail.ne1.yahoo.com via HTTP; Wed, 12 Feb 2014 15:36:56 PST X-Rocket-MIMEInfo: 002.001, TWFrZXMgc2Vuc2UuwqAgTmVlZCB0byBzcGVjaWZ5IHRoZSBmYWlsdXJlIGZvciBvbWl0dGVkIHJlcXVpcmVkIGF0dHJpYnV0ZXMgYW5kIGF0dGVtcHRzIHRvIGNoYW5nZSBpbW11dGFibGUgdGhpbmdzLgoKCsKgCi1iaWxsCgoKCi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCldpbGxpYW0gSi4gTWlsbHMKIlBhcmFub2lkIiBZYWhvbyEKCgoKCgpPbiBXZWRuZXNkYXksIEZlYnJ1YXJ5IDEyLCAyMDE0IDM6MTcgUE0sIFBoaWwgSHVudCA8cGhpbC5odW50QG9yYWNsZS5jb20.IHdyb3RlOgogClllcy4BMAEBAQE- X-Mailer: YahooMailWebService/0.8.176.634 References: <7F7F895E-455D-450D-876E-B6AB466599D6@mnt.se> <118dcf276c044f26adc85c3051dddd29@BN1PR04MB392.namprd04.prod.outlook.com> <1392236062.76159.YahooMailNeo@web142802.mail.bf1.yahoo.com> <58399EA7-DEB6-4EEC-8A85-21D2B133A626@oracle.com> <1392243505.21463.YahooMailNeo@web142804.mail.bf1.yahoo.com> <69B8BD7C-7602-490E-9562-CC701B8BABA2@oracle.com> Message-ID: <1392248216.74499.YahooMailNeo@web125604.mail.ne1.yahoo.com> Date: Wed, 12 Feb 2014 15:36:56 -0800 From: Bill Mills To: Phil Hunt , Bill Mills In-Reply-To: <69B8BD7C-7602-490E-9562-CC701B8BABA2@oracle.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="-685807438-1040810146-1392248216=:74499" X-Milter-Version: master.31+4-gbc07cd5+ X-CLX-ID: 248218002 Cc: Leif Johansson , Kelly Grizzle , "Morteza Ansari \(moransar\)" , "scim@ietf.org WG" Subject: Re: [scim] Call today? X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: Bill Mills List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Feb 2014 23:37:54 -0000 ---685807438-1040810146-1392248216=:74499 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Makes sense.=A0 Need to specify the failure for omitted required attributes= and attempts to change immutable things.=0A=0A=0A=A0=0A-bill=0A=0A=0A=0A--= ------------------------------=0AWilliam J. Mills=0A"Paranoid" Yahoo!=0A=0A= =0A=0A=0A=0AOn Wednesday, February 12, 2014 3:17 PM, Phil Hunt wrote:=0A =0AYes. =A0I was just thinking that. =A0"required" mea= ns that the client MUST provide it. So a SP could say the password is requi= red.=0A=0AHow about the following table of impacts based on mutability of a= ttributes in a PUT operation:=0A=0AWhen submitting attributes via the PUT r= equest, attribute "mutability" will have the following impacts:=0A=09* read= Write, writeOnly - Any values provided replace the existing values. Omittin= g the attribute or specific values means the attribute or values are to be = removed.=0A=09* immutable - Any values provided MUST match the existing val= ues. An omission of the attribute will not remove the existing value(s).=0A= =09* readOnly - Any values provided (e.g. meta.resourceType) will be ignore= d.=0A=0AIf an attribute is "required", the client MUST specify the attribut= e in a PUT request.=A0=0A=0ADoes this work?=0A=0APhil=0A=0A@independentid= =0Awww.independentid.comphil.hunt@oracle.com=0A=0AOn 2014-02-12, at 2:18 PM= , Bill Mills wrote:=0A=0AYeah, WriteOnly needs tho= ught, we don't want to end up with PUT transactions deleting passwords. =A0= Passwords perhaps might need a "required" attribute which means that a PUT = that doesn't include it would fail.=0A>=0A>=0A>=0A>=0A>=0A>On Wednesday, Fe= bruary 12, 2014 1:19 PM, Phil Hunt wrote:=0A> =0A>Bi= ll,=0A>=0A>=0A>Thanks for the proposal.=0A>=0A>=0A>Looks like we also didn'= t consider readOnly and writeOnly attributes such as passwords. =A0=0A>=0A>= =0A>Let me think this aft and I'll put a quick proposal together.=0A>=0A>= =0A>Phil=0A>=0A>=0A>@independentid=0A>www.independentid.comphil.hunt@oracle= .com=0A>=0A>On 2014-02-12, at 12:14 PM, Bill Mills = wrote:=0A>=0A>My action item from the call: =A0Propose language around imm= utability and PUT.=0A>>=0A>>=0A>>=0A>>=0A>>I don't know whether this goes i= nto the definition of immutability or PUT, probably PUT:=0A>>=0A>>=0A>>"PUT= expects the entire object to be present, if the schema includes elements w= ith immutable or ReadOnly elements then the object submitted with a PUT MUS= T include all existing immutable and ReadOnly data. =A0The server MUST reje= ct the PUT and return an error if the submitted data for =A0immutable or Re= adOnly=A0elemets do=A0not match exactly."=0A>>=0A>>=0A>>=0A>>On Wednesday, = February 12, 2014 11:06 AM, Morteza Ansari (moransar) = wrote:=0A>> =0A>>It should be working now.=A0 Not sure what happened but wi= ll set up a new=0A>>one for next meeting to ensure this is fixed.=0A>>=0A>>= =0A>>Cheers,=0A>>Morteza=0A>>=0A>>=0A>>On 2/12/14 11:03 AM, "Kelly Grizzle"= =0A wrote:=0A>>=0A>>>The link the meeting is = not working for me.=A0 It is showing a meeting on=0A>>>the 19th.=0A>>>=0A>>= >Morteza, can you send the correct link?=0A>>>=0A>>>=0A>>>-----Original Mes= sage-----=0A>>>From: scim [mailto:scim-bounces@ietf.org] On Behalf Of Morte= za Ansari=0A>>>(moransar)=0A>>>Sent: Tuesday, February 11, 2014 7:15 PM=0A>= >>To: Leif Johansson; Phil Hunt=0A>>>Cc: scim@ietf.org WG=0A>>>Subject: Re:= [scim] Call today?=0A>>>=0A>>>Correct, the next meeting is Wed. Fed. 12th = at 11am Pacific time.=0A>>>Meeting info is here:=0A>>>=0A>>>To invite other= s to join, copy and paste everything below into your=0A>>>invitation. =0A>>= >-------------------------------------------------------=0A>>>Meeting infor= mation=0A>>>-------------------------------------------------------=0A>>>To= pic: SCIM WG interim=0A>>>Date: Every Wednesday, from Wednesday, August 21,= 2013 to no end date=0A>>>Time: 11:00 am, Pacific Daylight Time (San Franci= sco, GMT-07:00) Meeting=0A>>>Number: 340 844 711 Meeting Password: (This me= eting does not require a=0A>>>password.)=0A>>>=0A>>>-----------------------= --------------------------------=0A>>>To start or join the online meeting= =0A>>>-------------------------------------------------------=0A>>>Go to ht= tps://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&RT=3DMiM0=0A>>>= =0A>>>-------------------------------------------------------=0A>>>Audio co= nference information=0A>>>-------------------------------------------------= ------=0A>>>To receive a call back, provide your phone number when you join= the=0A>>>meeting, or call the number below and enter the access code.=0A>>= >US Toll free: 1-855-797-9485=0A>>>US Toll: +1-415-655-0002=0A>>>Global cal= l-in numbers:=0A>>>https://go.webex.com/go/globalcallin.php?serviceType=3DM= C&ED=3D153193777&tollF=0A>>>r=0A>>>ee=3D1=0A>>>Toll-free dialing restrictio= ns:=0A>>>http://www.webex.com/pdf/tollfree_restrictions.pdf=0A>>>=0A>>>Acce= ss code:340 844 711=0A>>>=0A>>>--------------------------------------------= -----------=0A>>>For assistance=0A>>>--------------------------------------= -----------------=0A>>>1. Go to https://go.webex.com/go/mc=0A>>>2. On the= =0A left navigation bar, click "Support".=0A>>>To add this meeting to your = calendar program (for example Microsoft=0A>>>Outlook), click this link:=0A>= >>https://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&ICS=3DMS&LD= =3D1&RD=3D2&=0A>>>S=0A>>>T=3D1&SHA2=3DAAAAAXFmPcl25G51pP-VAnTUIPjOJqt0XNEPV= KSSFdjwCd-F=0A>>>=0A>>>To check whether you have the appropriate players in= stalled for UCF=0A>>>(Universal Communications Format) rich media files, go= to=0A>>>https://go.webex.com/go/systemdiagnosis.php.=0A>>>=0A>>>http://www= .webex.com =0A>>>=0A>>>CCM:+14156550002x340844711#= =0A>>>=0A>>>IMPORTANT NOTICE: This WebEx service includes a feature that al= lows audio=0A>>>and any documents and other materials exchanged or viewed d= uring the=0A>>>session to be recorded. You should inform all meeting attend= ees prior to=0A>>>recording if you intend to record the meeting. Please not= e that any such=0A>>>recordings may be subject to discovery=0A in the event= of litigation.=0A>>>=0A>>>=0A>>>On 2/5/14 10:39 AM, "Leif Johansson" wrote:=0A>>>=0A>>>>=0A>>>>=0A>>>>> 5 feb 2014 kl. 18:01 skrev Phi= l Hunt :=0A>>>>> =0A>>>>> Details?=0A>>>>> =0A>>>>=0A= >>>>its next week right?=0A>>>>=0A>>>>> Phil=0A>>>>> ______________________= _________________________=0A>>>>> scim mailing list=0A>>>>> scim@ietf.org= =0A>>>>> https://www.ietf.org/mailman/listinfo/scim=0A>>>>_________________= ______________________________=0A>>>>scim mailing list=0A>>>>scim@ietf.org= =0A>>>>https://www.ietf.org/mailman/listinfo/scim=0A>>>=0A>>>______________= _________________________________=0A>>>scim mailing list=0A>>>scim@ietf.org= =0A>>>https://www.ietf.org/mailman/listinfo/scim=0A>>=0A>>_________________= ______________________________=0A>>scim mailing list=0A>>scim@ietf.org=0A>>= https://www.ietf.org/mailman/listinfo/scim=0A>>=0A>>=0A>>__________________= _____________________________=0A>>scim mailing list=0A>>scim@ietf.org=0A>>h= ttps://www.ietf.org/mailman/listinfo/scim=0A>>=0A>=0A>=0A>_________________= ______________________________=0A>scim mailing list=0A>scim@ietf.org=0A>htt= ps://www.ietf.org/mailman/listinfo/scim=0A>=0A>=0A>________________________= _______________________=0A>scim mailing list=0A>scim@ietf.org=0A>https://ww= w.ietf.org/mailman/listinfo/scim=0A>=0A=0A=0A______________________________= _________________=0Ascim mailing list=0Ascim@ietf.org=0Ahttps://www.ietf.or= g/mailman/listinfo/scim ---685807438-1040810146-1392248216=:74499 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Makes sen= se.  Need to specify the failure for omitted required attributes and a= ttempts to change immutable things.

&nb= sp;
-bill


--------------------------------
William= J. Mills
"Paranoid" Yahoo!



On Wednesday, February 12, 2014 3:17 PM, Phil Hunt <phil.hunt@oracle.com> wrote:
Yes.  I was just thinking = that.  "required" means that the client MUST provide it. So a SP could= say the password is required.

How a= bout the following table of impacts based on mutability of attributes in a = PUT operation:

When submitting attributes via the PUT request, att= ribute "mutability" will have the following impacts:
=
  • readWrite, writeOnly - Any values provided replace the existing valu= es. Omitting the attribute or specific values means the attribute or values= are to be removed.
  • im= mutable - Any values provided MUST match the existing values. An omission o= f the attribute will not remove the existing value(s).
  • readOnly - Any values provided (e.g. meta.resourceType) w= ill be ignored.

If an attribute is "required", the client MUST specify the attribute= in a PUT request. 

=0A=
= Does this work?

Phil

@independentid
phil.hunt@oracle.com
=0A
= =0A
On 2014-02-12, at 2:18 PM, Bill Mills <wmills_92105@yahoo.co= m> wrote:

Yeah, Writ= eOnly needs thought, we don't want to end up with PUT transactions deleting= passwords.  Passwords perhaps might need a "required" attribute which= means that a PUT that doesn't include it would fail.



On Wednesday, Feb= ruary 12, 2014 1:19 PM, Phil Hunt <phil.hunt@oracle.com> wrote:
Bill,

Thanks for the proposal.

Looks like we also didn't consi= der readOnly and writeOnly attributes such as passwords.  
<= br clear=3D"none">
Let me think this aft and I'll put a quick proposal together.

=0A
On 2014-02-12, at 12:14 PM, Bill Mills <wmills_92105@yahoo.com> wrote:
My action item from the call:  Propos= e language around immutability and PUT.

<= /span>

I=0A = don't know whether this goes into the definition of immutability or PUT, pr= obably PUT:

"PUT expects the entire object to be present, if the schema i= ncludes elements with immutable or ReadOnly elements then the object submit= ted with a PUT MUST include all existing immutable and ReadOnly data.=0A &n= bsp;The server MUST reject the PUT and return an error if the submitted dat= a for=0A  immutable or ReadOnly elemets do<= span style=3D"background-color:transparent;font-family:HelveticaNeue, 'Helv= etica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;"> not matc= h exactly."

=0A
= On Wednesday, February 12, 2014 11:06 AM, Morteza Ansari (moransar) <moransar@cisco.com> = wrote:
It should be working now.  Not sure what happened but will = set up a new
one for next meeting to ensure this is fixed= .


Cheers,
Morteza

On 2/12/14 11:03 AM, "Kelly Grizzle"=0A <kelly.grizzle@sailpoint.= com> wrote:

>The link the me= eting is not working for me.  It is showing a meeting on
>the 19th.
>
>Morteza, ca= n you send the correct link?
>
><= br clear=3D"none">>-----Original Message-----
>From= : scim [mailto:sci= m-bounces@ietf.org] On Behalf Of Morteza Ansari
>(= moransar)
>Sent: Tuesday, February 11, 2014 7:15 PM>To: Leif Johansson; Phil Hunt
>Cc:= scim@ietf.org WG
>S= ubject: Re: [scim] Call today?
>
>= ;Correct, the next meeting is Wed. Fed. 12th at 11am Pacific time.
>Meeting info is here:
>
>To invite others to join, copy and paste everything below into your>invitation.
>-------------------= ------------------------------------
>Meeting informat= ion
>-------------------------------------------------= ------
>Topic: SCIM WG interim
>D= ate: Every Wednesday, from Wednesday, August 21, 2013 to no end date
>Time: 11:00 am, Pacific Daylight Time (San Francisco, GMT-0= 7:00) Meeting
>Number: 340 844 711 Meeting Password: (= This meeting does not require a
>password.)
>
>-------------------------------------------------------=
>To start or join the online meeting
>-------------------------------------------------------
>Go to https://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&= RT=3DMiM0
>
>----------------= ---------------------------------------
>Audio confere= nce information
>-------------------------------------= ------------------
>To receive a call back, provide yo= ur phone number when you join the
>meeting, or call th= e number below and enter the access code.
>US Toll fre= e: 1-855-797-9485
>US Toll: +1-415-655-0002
>Global call-in numbers:
>https://go.webex.com/go/globalcallin.php?serviceType=3DM= C&ED=3D153193777&tollF
>r
>ee=3D1
>Toll-free dialing restrictions:
>http://www.webex.com/pd= f/tollfree_restrictions.pdf
>
&g= t;Access code:340 844 711
>
>----= ---------------------------------------------------
>F= or assistance
>---------------------------------------= ----------------
>1. Go to https://go.= webex.com/go/mc
>2. On the=0A left navigation bar,= click "Support".
>To add this meeting to your calenda= r program (for example Microsoft
>Outlook), click this= link:
>https://go.webex.com/go/j.php= ?ED=3D153193777&UID=3D483472947&ICS=3DMS&LD=3D1&RD=3D2&=
>S
>T=3D1&SHA2=3DAAAAAXF= mPcl25G51pP-VAnTUIPjOJqt0XNEPVKSSFdjwCd-F
>
>To check whether you have the appropriate players installed f= or UCF
>(Universal Communications Format) rich media f= iles, go to
>https://go= .webex.com/go/systemdiagnosis.php.
>
>http://www= .webex.com <http://www.webex.com/>
>
>CCM:+14156550002x340844711#
&= gt;
>IMPORTANT NOTICE: This WebEx service includes a f= eature that allows audio
>and any documents and other = materials exchanged or viewed during the
>session to b= e recorded. You should inform all meeting attendees prior to
>recording if you intend to record the meeting. Please note that any= such
>recordings may be subject to discovery=0A in th= e event of litigation.
>
>
>On 2/5/14 10:39 AM, "Leif Johansson" <leifj@mnt.se> wrote:
>
>>
>>
>&g= t;> 5 feb 2014 kl. 18:01 skrev Phil Hunt <phil.hunt@oracle.com>:
>>>
>>> Details?
= >>>
>>
>>its next= week right?
>>
>>> Phil=
>>> ___________________________________________= ____
>>> scim mailing list
>= ;>> scim@ietf.org
>>> https://www.ietf.org/mailman/listinfo/scim
>>_______________________________________________
= >>scim mailing list
>>scim@ietf.org
>>https://www.ietf.org/mailman/listinfo/scim
>
>_________________________________________= ______
>scim mailing list
>scim@ietf.org
>https://www.ietf.org/mailman/listinfo/scim
________________________________________= _______
scim mailing list
scim@ietf.org
https://www.ietf.org/mailman/listinfo/scim


=
____________________________________= ___________
scim mailing list
scim@ietf.org
https://www.ietf.org/mailma= n/listinfo/scim


___________________________________= ____________
scim mailing list
scim@ietf.org
https://www.ietf.org/mailman/listinfo/scim


=
_______________________________________________<= br clear=3D"none">scim mailing list
scim@ietf.org
https://www.ietf.org/mailman/listinfo/scim


___________________________________________= ____
scim mailing list
scim@ietf.= org
https://www.ietf.org/mailman/listinf= o/scim


---685807438-1040810146-1392248216=:74499-- From phil.hunt@oracle.com Wed Feb 12 15:54:55 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A95771A0031 for ; Wed, 12 Feb 2014 15:54:55 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.748 X-Spam-Level: X-Spam-Status: No, score=-6.748 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, GB_I_INVITATION=-2, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NP-atdgbQ2QD for ; Wed, 12 Feb 2014 15:54:52 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) by ietfa.amsl.com (Postfix) with ESMTP id 54CB51A002F for ; Wed, 12 Feb 2014 15:54:52 -0800 (PST) Received: from acsinet22.oracle.com (acsinet22.oracle.com [141.146.126.238]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s1CNslGE001659 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Wed, 12 Feb 2014 23:54:49 GMT Received: from aserz7022.oracle.com (aserz7022.oracle.com [141.146.126.231]) by acsinet22.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1CNslFW001993 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 12 Feb 2014 23:54:47 GMT Received: from abhmp0019.oracle.com (abhmp0019.oracle.com [141.146.116.25]) by aserz7022.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1CNsk0v001978; Wed, 12 Feb 2014 23:54:47 GMT Received: from [192.168.1.124] (/24.86.29.34) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 12 Feb 2014 15:54:46 -0800 Content-Type: multipart/alternative; boundary="Apple-Mail=_006F9535-717A-4793-B528-9A2322E86615" Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\)) From: Phil Hunt In-Reply-To: <1392248216.74499.YahooMailNeo@web125604.mail.ne1.yahoo.com> Date: Wed, 12 Feb 2014 15:54:52 -0800 Message-Id: References: <7F7F895E-455D-450D-876E-B6AB466599D6@mnt.se> <118dcf276c044f26adc85c3051dddd29@BN1PR04MB392.namprd04.prod.outlook.com> <1392236062.76159.YahooMailNeo@web142802.mail.bf1.yahoo.com> <58399EA7-DEB6-4EEC-8A85-21D2B133A626@oracle.com> <1392243505.21463.YahooMailNeo@web142804.mail.bf1.yahoo.com> <69B8BD7C-7602-490E-9562-CC701B8BABA2@oracle.com> <1392248216.74499.YahooMailNeo@web125604.mail.ne1.yahoo.com> To: Bill Mills X-Mailer: Apple Mail (2.1510) X-Source-IP: acsinet22.oracle.com [141.146.126.238] Cc: Leif Johansson , "Morteza Ansari \(moransar\)" , Bill Mills , "scim@ietf.org WG" , Kelly Grizzle Subject: Re: [scim] Call today? X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Feb 2014 23:54:55 -0000 --Apple-Mail=_006F9535-717A-4793-B528-9A2322E86615 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=iso-8859-1 Sorry for all the back and forth going on. I think I have got it with = error codes and a decent amount of flexibility. Here is the proposed = text: 3.3.1. Modifying with PUT PUT performs a full update. Clients MAY retrieve the entire resource in advance, add the desired modifications and use HTTP PUT which will overwrite all previously stored data. Since the PUT request performs a full update, clients MAY send attributes of the retrieved resource and the service provider MUST process according to attribute mutability as follows: readWrite, writeOnly Any values provided SHALL replace the existing attribute values. Omitting the attribute or specific values means the attribute or specific value SHALL be removed; immutable If values are provided, they MUST match existing data or an error is returned. If the service provider has no existing values, a new value(s) MAY be specified; and, readOnly Any values provided (e.g. meta.resourceType) SHALL be ignored. If an attribute is "required", the client MUST specify the attribute in the PUT request. If a value provided for an immutable attribute with an existing value is NOT matched, the server SHALL respond with an HTTP response code of 400 and an apprpriate human readable message indicating an attempt to change an immutable attribute. Unless otherwise specified a successful PUT operation returns a 200 OK response code and the entire resource within the response body, enabling the client to correlate the client's and Provider's views of the updated resource. Example: I admit, the wording could be better. But let's get the draft in = tonight.=20 Phil @independentid www.independentid.com phil.hunt@oracle.com On 2014-02-12, at 3:36 PM, Bill Mills wrote: > Makes sense. Need to specify the failure for omitted required = attributes and attempts to change immutable things. >=20 > =20 > -bill >=20 >=20 > -------------------------------- > William J. Mills > "Paranoid" Yahoo! >=20 >=20 >=20 > On Wednesday, February 12, 2014 3:17 PM, Phil Hunt = wrote: > Yes. I was just thinking that. "required" means that the client MUST = provide it. So a SP could say the password is required. >=20 > How about the following table of impacts based on mutability of = attributes in a PUT operation: >=20 > When submitting attributes via the PUT request, attribute "mutability" = will have the following impacts: > readWrite, writeOnly - Any values provided replace the existing = values. Omitting the attribute or specific values means the attribute or = values are to be removed. > immutable - Any values provided MUST match the existing values. An = omission of the attribute will not remove the existing value(s). > readOnly - Any values provided (e.g. meta.resourceType) will be = ignored. >=20 > If an attribute is "required", the client MUST specify the attribute = in a PUT request.=20 >=20 > Does this work? >=20 > Phil >=20 > @independentid > www.independentid.com > phil.hunt@oracle.com >=20 > On 2014-02-12, at 2:18 PM, Bill Mills wrote: >=20 >> Yeah, WriteOnly needs thought, we don't want to end up with PUT = transactions deleting passwords. Passwords perhaps might need a = "required" attribute which means that a PUT that doesn't include it = would fail. >>=20 >>=20 >>=20 >> On Wednesday, February 12, 2014 1:19 PM, Phil Hunt = wrote: >> Bill, >>=20 >> Thanks for the proposal. >>=20 >> Looks like we also didn't consider readOnly and writeOnly attributes = such as passwords. =20 >>=20 >> Let me think this aft and I'll put a quick proposal together. >>=20 >> Phil >>=20 >> @independentid >> www.independentid.com >> phil.hunt@oracle.com >>=20 >> On 2014-02-12, at 12:14 PM, Bill Mills = wrote: >>=20 >>> My action item from the call: Propose language around immutability = and PUT. >>>=20 >>>=20 >>> I don't know whether this goes into the definition of immutability = or PUT, probably PUT: >>>=20 >>> "PUT expects the entire object to be present, if the schema includes = elements with immutable or ReadOnly elements then the object submitted = with a PUT MUST include all existing immutable and ReadOnly data. The = server MUST reject the PUT and return an error if the submitted data for = immutable or ReadOnly elemets do not match exactly." >>>=20 >>>=20 >>> On Wednesday, February 12, 2014 11:06 AM, Morteza Ansari (moransar) = wrote: >>> It should be working now. Not sure what happened but will set up a = new >>> one for next meeting to ensure this is fixed. >>>=20 >>>=20 >>> Cheers, >>> Morteza >>>=20 >>> On 2/12/14 11:03 AM, "Kelly Grizzle" = wrote: >>>=20 >>> >The link the meeting is not working for me. It is showing a = meeting on >>> >the 19th. >>> > >>> >Morteza, can you send the correct link? >>> > >>> > >>> >-----Original Message----- >>> >From: scim [mailto:scim-bounces@ietf.org] On Behalf Of Morteza = Ansari >>> >(moransar) >>> >Sent: Tuesday, February 11, 2014 7:15 PM >>> >To: Leif Johansson; Phil Hunt >>> >Cc: scim@ietf.org WG >>> >Subject: Re: [scim] Call today? >>> > >>> >Correct, the next meeting is Wed. Fed. 12th at 11am Pacific time. >>> >Meeting info is here: >>> > >>> >To invite others to join, copy and paste everything below into your >>> >invitation.=20 >>> >------------------------------------------------------- >>> >Meeting information >>> >------------------------------------------------------- >>> >Topic: SCIM WG interim >>> >Date: Every Wednesday, from Wednesday, August 21, 2013 to no end = date >>> >Time: 11:00 am, Pacific Daylight Time (San Francisco, GMT-07:00) = Meeting >>> >Number: 340 844 711 Meeting Password: (This meeting does not = require a >>> >password.) >>> > >>> >------------------------------------------------------- >>> >To start or join the online meeting >>> >------------------------------------------------------- >>> >Go to = https://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&RT=3DMiM0 >>> > >>> >------------------------------------------------------- >>> >Audio conference information >>> >------------------------------------------------------- >>> >To receive a call back, provide your phone number when you join the >>> >meeting, or call the number below and enter the access code. >>> >US Toll free: 1-855-797-9485 >>> >US Toll: +1-415-655-0002 >>> >Global call-in numbers: >>> = >https://go.webex.com/go/globalcallin.php?serviceType=3DMC&ED=3D153193777&= tollF >>> >r >>> >ee=3D1 >>> >Toll-free dialing restrictions: >>> >http://www.webex.com/pdf/tollfree_restrictions.pdf >>> > >>> >Access code:340 844 711 >>> > >>> >------------------------------------------------------- >>> >For assistance >>> >------------------------------------------------------- >>> >1. Go to https://go.webex.com/go/mc >>> >2. On the left navigation bar, click "Support". >>> >To add this meeting to your calendar program (for example Microsoft >>> >Outlook), click this link: >>> = >https://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&ICS=3DMS&LD=3D= 1&RD=3D2& >>> >S >>> >T=3D1&SHA2=3DAAAAAXFmPcl25G51pP-VAnTUIPjOJqt0XNEPVKSSFdjwCd-F >>> > >>> >To check whether you have the appropriate players installed for UCF >>> >(Universal Communications Format) rich media files, go to >>> >https://go.webex.com/go/systemdiagnosis.php. >>> > >>> >http://www.webex.com >>> > >>> >CCM:+14156550002x340844711# >>> > >>> >IMPORTANT NOTICE: This WebEx service includes a feature that allows = audio >>> >and any documents and other materials exchanged or viewed during = the >>> >session to be recorded. You should inform all meeting attendees = prior to >>> >recording if you intend to record the meeting. Please note that any = such >>> >recordings may be subject to discovery in the event of litigation. >>> > >>> > >>> >On 2/5/14 10:39 AM, "Leif Johansson" wrote: >>> > >>> >> >>> >> >>> >>> 5 feb 2014 kl. 18:01 skrev Phil Hunt : >>> >>>=20 >>> >>> Details? >>> >>>=20 >>> >> >>> >>its next week right? >>> >> >>> >>> Phil >>> >>> _______________________________________________ >>> >>> scim mailing list >>> >>> scim@ietf.org >>> >>> https://www.ietf.org/mailman/listinfo/scim >>> >>_______________________________________________ >>> >>scim mailing list >>> >>scim@ietf.org >>> >>https://www.ietf.org/mailman/listinfo/scim >>> > >>> >_______________________________________________ >>> >scim mailing list >>> >scim@ietf.org >>> >https://www.ietf.org/mailman/listinfo/scim >>>=20 >>> _______________________________________________ >>> scim mailing list >>> scim@ietf.org >>> https://www.ietf.org/mailman/listinfo/scim >>>=20 >>>=20 >>> _______________________________________________ >>> scim mailing list >>> scim@ietf.org >>> https://www.ietf.org/mailman/listinfo/scim >>=20 >>=20 >> _______________________________________________ >> scim mailing list >> scim@ietf.org >> https://www.ietf.org/mailman/listinfo/scim >>=20 >>=20 >> _______________________________________________ >> scim mailing list >> scim@ietf.org >> https://www.ietf.org/mailman/listinfo/scim >=20 >=20 > _______________________________________________ > scim mailing list > scim@ietf.org > https://www.ietf.org/mailman/listinfo/scim >=20 >=20 > _______________________________________________ > scim mailing list > scim@ietf.org > https://www.ietf.org/mailman/listinfo/scim --Apple-Mail=_006F9535-717A-4793-B528-9A2322E86615 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=iso-8859-1 Sorry = for all the back and forth going on.  I think I have got it with = error codes and a decent amount of flexibility.  Here is the = proposed text:

3.3.1.  Modifying with PUT

   PUT performs a full update.  Clients MAY retrieve the entire resource
   in advance, add the desired modifications and use HTTP PUT which will
   overwrite all previously stored data.  Since the PUT request performs
   a full update, clients MAY send attributes of the retrieved resource
   and the service provider MUST process according to attribute
   mutability as follows:

   readWrite, writeOnly  Any values provided SHALL replace the existing
      attribute values.  Omitting the attribute or specific values means
      the attribute or specific value SHALL be removed;

   immutable  If values are provided, they MUST match existing data or
      an error is returned.  If the service provider has no existing
      values, a new value(s) MAY be specified; and,

   readOnly  Any values provided (e.g.  meta.resourceType) SHALL be
      ignored.

   If an attribute is "required", the client MUST specify the attribute
   in the PUT request.

   If a value provided for an immutable attribute with an existing value
   is NOT matched, the server SHALL respond with an HTTP response code
   of 400 and an apprpriate human readable message indicating an attempt
   to change an immutable attribute.

   Unless otherwise specified a successful PUT operation returns a 200
   OK response code and the entire resource within the response body,
   enabling the client to correlate the client's and Provider's views of
   the updated resource.  Example:

I admit, the wording could be better. But = let's get the draft in tonight. 


On 2014-02-12, at 3:36 PM, Bill Mills <wmills@yahoo-inc.com> = wrote:

Makes sense.  Need to specify the failure for = omitted required attributes and attempts to change immutable = things.

 
-bill

=



On Wednesday, February 12, 2014 3:17 PM, Phil = Hunt <phil.hunt@oracle.com> = wrote:
Yes.  I was just thinking that. =  "required" means that the client MUST provide it. So a SP could = say the password is required.

How = about the following table of impacts based on mutability of attributes = in a PUT operation:

When submitting attributes via the PUT = request, attribute "mutability" will have the following = impacts:
  • readWrite, writeOnly - Any values provided replace the = existing values. Omitting the attribute or specific values means the = attribute or values are to be removed.
  • immutable - Any values provided MUST = match the existing values. An omission of the attribute will not remove the existing value(s).
  • readOnly - Any values provided (e.g. = meta.resourceType) will be ignored.

If an attribute is "required", the = client MUST specify the attribute in a PUT = request. 

Does this = work?

Phil

@independentid
phil.hunt@oracle.com
<= /div>

On 2014-02-12, at 2:18 PM, Bill Mills = <wmills_92105@yahoo.com> = wrote:

Yeah, WriteOnly needs thought, we = don't want to end up with PUT transactions deleting passwords. =  Passwords perhaps might need a "required" attribute which means = that a PUT that doesn't include it would fail.



On Wednesday, February 12, 2014 1:19 PM, Phil = Hunt <phil.hunt@oracle.com> = wrote:
Bill,

Thanks for = the proposal.

Looks like we = also didn't consider readOnly and writeOnly attributes such as = passwords.  

Let me think this aft and I'll put a quick proposal together.


On 2014-02-12, at 12:14 PM, Bill Mills = <wmills_92105@yahoo.com> = wrote:

My action item = from the call:  Propose language around immutability and = PUT.


I don't know whether this goes into the definition of immutability or = PUT, probably PUT:

"PUT expects = the entire object to be present, if the schema includes elements with = immutable or ReadOnly elements then the object submitted with a PUT MUST = include all existing immutable and ReadOnly data.  The server MUST reject the PUT and return an error if the = submitted data for  immutable or = ReadOnly elemets do not match exactly."


On Wednesday, February 12, 2014 11:06 AM, = Morteza Ansari (moransar) <moransar@cisco.com> wrote:
It should be working now.  = Not sure what happened but will set up a new
one for = next meeting to ensure this is fixed.


Cheers,
Morteza

On 2/12/14 11:03 AM, = "Kelly Grizzle" <kelly.grizzle@sailpoint.com> wrote:

>The link the = meeting is not working for me.  It is showing a meeting on
>the 19th.
>
>Morteza, can you send the correct link?
>
>
>-----Original Message-----
>From: = scim [mailto:scim-bounces@ietf.org] On = Behalf Of Morteza Ansari
>(moransar)
>Sent: Tuesday, February 11, 2014 7:15 PM
>To: Leif Johansson; Phil Hunt
>Cc:= scim@ietf.org WG
>Subject: Re: [scim] Call today?
>
>Correct, the next meeting is = Wed. Fed. 12th at 11am Pacific time.
>Meeting info = is here:
>
>To invite others = to join, copy and paste everything below into your
>invitation.
>-------------------------------------------------------=
>Meeting information
>-------------------------------------------------------=
>Topic: SCIM WG interim
>Date: = Every Wednesday, from Wednesday, August 21, 2013 to no end date
>Time: 11:00 am, Pacific Daylight Time (San Francisco, = GMT-07:00) Meeting
>Number: 340 844 711 Meeting = Password: (This meeting does not require a
>password.)
>
>-------------------------------------------------------=
>To start or join the online meeting
>-------------------------------------------------------=
>Go to https://go.webex.com/go/j.php?ED=3D153193777&UID=3D48347= 2947&RT=3DMiM0
>
>-------------------------------------------------------=
>Audio conference information
>-------------------------------------------------------=
>To receive a call back, provide your phone number = when you join the
>meeting, or call the number = below and enter the access code.
>US Toll free: = 1-855-797-9485
>US Toll: +1-415-655-0002
>Global call-in numbers:
>https://go.webex.com/go/globalcallin.php?serviceType=3D= MC&ED=3D153193777&tollF
>r
>ee=3D1
>Toll-free dialing = restrictions:
>http://www.web= ex.com/pdf/tollfree_restrictions.pdf
>
>Access code:340 844 711
>
>-------------------------------------------------------=
>For assistance
>-------------------------------------------------------=
>1. Go to https://go.webex.com/go/mc
>2. On the left navigation bar, click "Support".
>To add this = meeting to your calendar program (for example Microsoft
>Outlook), click this link:
>https://go.webex.com/go/j.php?ED=3D= 153193777&UID=3D483472947&ICS=3DMS&LD=3D1&RD=3D2&<= br clear=3D"none">>S
>T=3D1&SHA2=3DAAAAAXFmPcl25G51pP-VAnTUIPjOJqt0XNEPVK= SSFdjwCd-F
>
>To check whether = you have the appropriate players installed for UCF
>(Universal Communications Format) rich media files, = go to
>https://go.webex.com/= go/systemdiagnosis.php.
>
>http://www.webex.com <http://www.webex.com/>
>
>CCM:+14156550002x340844711#
>
>IMPORTANT NOTICE: This WebEx = service includes a feature that allows audio
>and = any documents and other materials exchanged or viewed during the
>session to be recorded. You should inform all meeting = attendees prior to
>recording if you intend to = record the meeting. Please note that any such
>recordings may be subject to discovery in the event of litigation.
>
>
>On 2/5/14 10:39 AM, "Leif = Johansson" <leifj@mnt.se> wrote:
>
>>
>>
>>> 5 feb 2014 kl. = 18:01 skrev Phil Hunt <phil.hunt@oracle.com>:
>>>
>>> Details?
>>>
>>
>>its next week right?
>>
>>> Phil
>>> = _______________________________________________
>>> scim mailing list
>>> scim@ietf.org
>>> https://www.ietf.org/m= ailman/listinfo/scim
>>_______________________________________________
>>scim mailing list
>>scim@ietf.org
>>https://www.ietf.org/m= ailman/listinfo/scim
>
>_______________________________________________
>scim mailing list
>scim@ietf.org
>https://www.ietf.org/m= ailman/listinfo/scim

_______________________________________________
scim mailing list
scim@ietf.org
https://www.ietf.org/m= ailman/listinfo/scim


=
_______________________________________________scim mailing list
scim@ietf.org
https://www.ietf.org/m= ailman/listinfo/scim


_____________________________________________= __
scim mailing list
scim@ietf.org
https://www.ietf.org/m= ailman/listinfo/scim


=
_______________________________________________
scim mailing list
scim@ietf.org
https://www.ietf.org/m= ailman/listinfo/scim


_______________________________________________
scim mailing list
scim@ietf.org
https://www.ietf.org/mailman/listinfo/scim


=
_______________________________________________
scim = mailing list
scim@ietf.org
https://www.ietf.org/ma= ilman/listinfo/scim

= --Apple-Mail=_006F9535-717A-4793-B528-9A2322E86615-- From wmills@yahoo-inc.com Wed Feb 12 16:03:26 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 48EB81A001F for ; Wed, 12 Feb 2014 16:03:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -18.92 X-Spam-Level: X-Spam-Status: No, score=-18.92 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, GB_I_INVITATION=-2, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_NEUTRAL=0.779, USER_IN_DEF_WHITELIST=-15] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nb8dx9-yEwkp for ; Wed, 12 Feb 2014 16:03:22 -0800 (PST) Received: from mrout2.yahoo.com (mrout2.yahoo.com [216.145.54.172]) by ietfa.amsl.com (Postfix) with ESMTP id 0D8C11A0040 for ; Wed, 12 Feb 2014 16:03:22 -0800 (PST) Received: from BF1-EX10-CAHT10.y.corp.yahoo.com (bf1-ex10-caht10.corp.bf1.yahoo.com [10.74.209.199]) by mrout2.yahoo.com (8.14.4/8.14.4/y.out) with ESMTP id s1D01lSU050152 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL) for ; Wed, 12 Feb 2014 16:01:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=yahoo-inc.com; s=cobra; t=1392249709; bh=VDdxeFCEVU0jjgC6Hxh5t/R89QOaXmdlHjA+GjO/1ZQ=; h=References:Date:From:Reply-To:Subject:In-Reply-To; b=pRWa5+xi/cIS1S5+6cZVEU2WPPPRtI40AqdnxtVPmPdFBnb6EqVuC082k3HUfAPOZ 0edgd0RJwvfKrpesfxCXzEv5R4yU/i3XRbCw4jsoGRenvUeO8o8JqokTZmrz4Waqqo 5VMkUR9vSCu9guK5ERp0AU9dSjls4enI2WCDKERA= Received: from omp1004.mail.ne1.yahoo.com (98.138.87.4) by BF1-EX10-CAHT10.y.corp.yahoo.com (10.74.209.170) with Microsoft SMTP Server (TLS) id 14.3.174.1; Wed, 12 Feb 2014 19:01:29 -0500 Received: (qmail 89187 invoked by uid 1000); 13 Feb 2014 00:01:45 -0000 Received: (qmail 32575 invoked by uid 60001); 13 Feb 2014 00:01:45 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo-inc.com; s=ginc1024; t=1392249705; bh=is9eKDTF9TNXvdLB+XQBaT0jW0UpFvQgV8GEpeKZ/mU=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=GQc8UKbw87k/XfQvlvcm6ZPQ0rhVJSFsiw4PLXqGXshCC+0uQnEXLVATUYvwywJNpKjZO3g1naQDNaomNUg303m7tHQSH4PmxrXgwi2uS3L0n4+WPVHdJvNRm4YPLq0A8sx6EUb04bMxBeJCJxl/NGr+w2acX86MHFvPA4kN2RE= DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ginc1024; d=yahoo-inc.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=XcT1PHRYhhlUJ/4W6NVsvrgdj1Hzv9WgPI4QaVwMxFapcMH1GujORcA91gnuuXyp/yEI1FXS0dKMNp3kM+kjh4A9AzFrMyrah3G+MSbbxXRencvusj56GtyWwfckUja/ABPj/apP0M/lBI2uJOoJ/Mkyk6PtSELYbONTYXvANEA=; X-YMail-OSG: RG_y4oQVM1lFV2mcmVl2ar1AMqI4kbsfC3n5_lxKIvRzy30 3OMB8cZiDqOCGzoWu4mZcQfZITo5XdpICYy9.mYORAqaO1ZAZ6U8MucBnU7N XVx075Kwr6oxUJ6L9ZqCTWlw51XerKTnf5fTLDcHYvV5W4Oa4Bly8Fb1xzj7 mCIRC0iScZ.qChydCJt8vMzklxh.2NKKeMdbV8MIe5uVNDS5wQjv81gvbQZe eBwgnk9d8XC0IKSofJ_TjcSJqj1gg.41tFr0KFPWwkughii7YeEs.o25S._L 1bnv_pW2kHHua92TPdLgdKPqb Received: from [209.131.50.178] by web125602.mail.ne1.yahoo.com via HTTP; Wed, 12 Feb 2014 16:01:45 PST X-Rocket-MIMEInfo: 002.001, U21hbGwgY2hhbmdlOgoKaW1tdXRhYmxlICBJZiB2YWx1ZXMgYXJlIHByb3ZpZGVkIGZvciBlbGVtZW50cyBhbHJlYWR5IHNldCBpbiB0aGUgb2JqZWN0IAp0aGV5IE1VU1QgbWF0Y2ggZXhpc3RpbmcgZGF0YSBvcgogICAgICBhbiBlcnJvciBpcyByZXR1cm5lZC4gIElmIHRoZSBzZXJ2aWNlIHByb3ZpZGVyIGhhcyBubyBleGlzdGluZwogICAgICB2YWx1ZXMsIGEgbmV3IHZhbHVlKHMpIE1BWSBiZSBzcGVjaWZpZWQ7IGFuZCwKwqAKLWJpbGwKCgoKLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KV2kBMAEBAQE- X-Mailer: YahooMailWebService/0.8.176.634 References: <7F7F895E-455D-450D-876E-B6AB466599D6@mnt.se> <118dcf276c044f26adc85c3051dddd29@BN1PR04MB392.namprd04.prod.outlook.com> <1392236062.76159.YahooMailNeo@web142802.mail.bf1.yahoo.com> <58399EA7-DEB6-4EEC-8A85-21D2B133A626@oracle.com> <1392243505.21463.YahooMailNeo@web142804.mail.bf1.yahoo.com> <69B8BD7C-7602-490E-9562-CC701B8BABA2@oracle.com> <1392248216.74499.YahooMailNeo@web125604.mail.ne1.yahoo.com> Message-ID: <1392249705.25887.YahooMailNeo@web125602.mail.ne1.yahoo.com> Date: Wed, 12 Feb 2014 16:01:45 -0800 From: Bill Mills To: Phil Hunt In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="-1088529044-1791890102-1392249705=:25887" X-Milter-Version: master.31+4-gbc07cd5+ X-CLX-ID: 249708006 Cc: Leif Johansson , Kelly Grizzle , "Morteza Ansari \(moransar\)" , "scim@ietf.org WG" , Bill Mills Subject: Re: [scim] Call today? X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: Bill Mills List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Feb 2014 00:03:26 -0000 ---1088529044-1791890102-1392249705=:25887 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Small change:=0A=0Aimmutable If values are provided for elements already s= et in the object =0Athey MUST match existing data or=0A an error is re= turned. If the service provider has no existing=0A values, a new valu= e(s) MAY be specified; and,=0A=A0=0A-bill=0A=0A=0A=0A----------------------= ----------=0AWilliam J. Mills=0A"Paranoid" Yahoo!=0A=0A=0A=0A=0A=0AOn Wedne= sday, February 12, 2014 3:55 PM, Phil Hunt wrote:=0A= =0ASorry for all the back and forth going on. =A0I think I have got it wit= h error codes and a decent amount of flexibility. =A0Here is the proposed t= ext:=0A=0A3.3.1. Modifying with PUT PUT performs a full update. Clients M= AY retrieve the entire resource in advance, add the desired modifications a= nd use HTTP PUT which will overwrite all previously stored data. Since the= PUT request performs a full update, clients MAY send attributes of the ret= rieved resource and the service provider MUST process according to attribut= e mutability as follows: readWrite, writeOnly Any values provided SHALL re= place the existing attribute values. Omitting the attribute or specific va= lues means the attribute or specific value SHALL be removed; immutable If = values are provided, they MUST match existing data or an error is returned.= If the service provider has no existing values, a new value(s) MAY be spe= cified; and, readOnly Any values provided (e.g. meta.resourceType) SHALL = be ignored. If an attribute is "required", the client MUST specify the attr= ibute in the PUT request. If a value provided for an immutable attribute wi= th an existing value is NOT matched, the server SHALL respond with an HTTP re= sponse code of 400 and an apprpriate human readable message indicating an a= ttempt to change an immutable attribute. Unless otherwise specified a succe= ssful PUT operation returns a 200 OK response code and the entire resource = within the response body, enabling the client to correlate the client's and= Provider's views of the updated resource. Example: =0A=0AI admit, the wor= ding could be better. But let's get the draft in tonight.=A0=0A=0APhil=0A= =0A@independentid=0Awww.independentid.comphil.hunt@oracle.com=0A=0AOn 2014-= 02-12, at 3:36 PM, Bill Mills wrote:=0A=0AMakes sens= e.=A0 Need to specify the failure for omitted required attributes and attem= pts to change immutable things.=0A>=0A>=0A>=0A>=A0=0A>-bill=0A>=0A>=0A>=0A>= --------------------------------=0A>William J. Mills=0A>"Paranoid" Yahoo!= =0A>=0A>=0A>=0A>=0A>=0A>=0A>On Wednesday, February 12, 2014 3:17 PM, Phil H= unt wrote:=0A> =0A>Yes. =A0I was just thinking that.= =A0"required" means that the client MUST provide it. So a SP could say the= password is required.=0A>=0A>=0A>How about the following table of impacts = based on mutability of attributes in a PUT operation:=0A>=0A>=0A>When submi= tting attributes via the PUT request, attribute "mutability" will have the = following impacts:=0A>=09* readWrite, writeOnly - Any values provided repla= ce the existing values. Omitting the attribute or specific values means the= attribute or values are to be removed.=0A>=09* immutable - Any values prov= ided MUST match the existing values. An omission of the attribute will not = remove the existing value(s).=0A>=09* readOnly - Any values provided (e.g. = meta.resourceType) will be ignored.=0A>=0A>=0A>If an attribute is "required= ", the client MUST specify the attribute in a PUT request.=A0=0A>=0A>=0A>Do= es this work?=0A>=0A>=0A>Phil=0A>=0A>=0A>@independentid=0A>www.independenti= d.comphil.hunt@oracle.com=0A>=0A>On 2014-02-12, at 2:18 PM, Bill Mills wrote:=0A>=0A>Yeah, WriteOnly needs thought, we don't = want to end up with PUT transactions deleting passwords. =A0Passwords perha= ps might need a "required" attribute which means that a PUT that doesn't in= clude it would fail.=0A>>=0A>>=0A>>=0A>>=0A>>=0A>>On Wednesday, February 12= , 2014 1:19 PM, Phil Hunt wrote:=0A>> =0A>>Bill,=0A>= >=0A>>=0A>>Thanks for the proposal.=0A>>=0A>>=0A>>Looks like we also didn't= consider readOnly and writeOnly attributes such as passwords. =A0=0A>>=0A>= >=0A>>Let me think this aft and I'll put a quick proposal together.=0A>>=0A= >>=0A>>Phil=0A>>=0A>>=0A>>@independentid=0A>>www.independentid.comphil.hunt= @oracle.com=0A>>=0A>>On 2014-02-12, at 12:14 PM, Bill Mills wrote:=0A>>=0A>>My action item from the call: =A0Propose language= around immutability and PUT.=0A>>>=0A>>>=0A>>>=0A>>>=0A>>>I don't know whe= ther this goes into the definition of immutability or PUT, probably PUT:=0A= >>>=0A>>>=0A>>>"PUT expects the entire object to be present, if the schema = includes elements with immutable or ReadOnly elements then the object submi= tted with a PUT MUST include all existing immutable and ReadOnly data. =A0T= he server MUST reject the PUT and return an error if the submitted data for= =A0immutable or ReadOnly=A0elemets do=A0not match exactly."=0A>>>=0A>>>=0A= >>>=0A>>>On Wednesday, February 12, 2014 11:06 AM, Morteza Ansari (moransar= ) wrote:=0A>>> =0A>>>It should be working now.=A0 Not = sure what happened but will set up a new=0A>>>one for next meeting to ensur= e this is fixed.=0A>>>=0A>>>=0A>>>Cheers,=0A>>>Morteza=0A>>>=0A>>>=0A>>>On = 2/12/14 11:03 AM, "Kelly Grizzle"=0A wrote:= =0A>>>=0A>>>>The link the meeting is not working for me.=A0 It is showing a= meeting on=0A>>>>the 19th.=0A>>>>=0A>>>>Morteza, can you send the correct = link?=0A>>>>=0A>>>>=0A>>>>-----Original Message-----=0A>>>>From: scim [mail= to:scim-bounces@ietf.org] On Behalf Of Morteza Ansari=0A>>>>(moransar)=0A>>= >>Sent: Tuesday, February 11, 2014 7:15 PM=0A>>>>To: Leif Johansson; Phil H= unt=0A>>>>Cc: scim@ietf.org WG=0A>>>>Subject: Re: [scim] Call today?=0A>>>>= =0A>>>>Correct, the next meeting is Wed. Fed. 12th at 11am Pacific time.=0A= >>>>Meeting info is here:=0A>>>>=0A>>>>To invite others to join, copy and p= aste everything below into your=0A>>>>invitation. =0A>>>>------------------= -------------------------------------=0A>>>>Meeting information=0A>>>>-----= --------------------------------------------------=0A>>>>Topic: SCIM WG int= erim=0A>>>>Date: Every Wednesday, from Wednesday, August 21, 2013 to no end= date=0A>>>>Time: 11:00 am, Pacific Daylight Time (San Francisco, GMT-07:00= ) Meeting=0A>>>>Number: 340 844 711 Meeting Password: (This meeting does no= t require a=0A>>>>password.)=0A>>>>=0A>>>>---------------------------------= ----------------------=0A>>>>To start or join the online meeting=0A>>>>----= ---------------------------------------------------=0A>>>>Go to https://go.= webex.com/go/j.php?ED=3D153193777&UID=3D483472947&RT=3DMiM0=0A>>>>=0A>>>>--= -----------------------------------------------------=0A>>>>Audio conferenc= e information=0A>>>>-------------------------------------------------------= =0A>>>>To receive a call back, provide your phone number when you join the= =0A>>>>meeting, or call the number below and enter the access code.=0A>>>>U= S Toll free: 1-855-797-9485=0A>>>>US Toll: +1-415-655-0002=0A>>>>Global cal= l-in numbers:=0A>>>>https://go.webex.com/go/globalcallin.php?serviceType=3D= MC&ED=3D153193777&tollF=0A>>>>r=0A>>>>ee=3D1=0A>>>>Toll-free dialing restri= ctions:=0A>>>>http://www.webex.com/pdf/tollfree_restrictions.pdf=0A>>>>=0A>= >>>Access code:340 844 711=0A>>>>=0A>>>>-----------------------------------= --------------------=0A>>>>For assistance=0A>>>>---------------------------= ----------------------------=0A>>>>1. Go to https://go.webex.com/go/mc=0A>>= >>2. On the=0A left navigation bar, click "Support".=0A>>>>To add this meet= ing to your calendar program (for example Microsoft=0A>>>>Outlook), click t= his link:=0A>>>>https://go.webex.com/go/j.php?ED=3D153193777&UID=3D48347294= 7&ICS=3DMS&LD=3D1&RD=3D2&=0A>>>>S=0A>>>>T=3D1&SHA2=3DAAAAAXFmPcl25G51pP-VAn= TUIPjOJqt0XNEPVKSSFdjwCd-F=0A>>>>=0A>>>>To check whether you have the appro= priate players installed for UCF=0A>>>>(Universal Communications Format) ri= ch media files, go to=0A>>>>https://go.webex.com/go/systemdiagnosis.php.=0A= >>>>=0A>>>>http://www.webex.com =0A>>>>=0A>>>>CCM:+1= 4156550002x340844711#=0A>>>>=0A>>>>IMPORTANT NOTICE: This WebEx service inc= ludes a feature that allows audio=0A>>>>and any documents and other materia= ls exchanged or viewed during the=0A>>>>session to be recorded. You should = inform all meeting attendees prior to=0A>>>>recording if you intend to reco= rd the meeting. Please note that any such=0A>>>>recordings may be subject t= o discovery=0A in the event of litigation.=0A>>>>=0A>>>>=0A>>>>On 2/5/14 10= :39 AM, "Leif Johansson" wrote:=0A>>>>=0A>>>>>=0A>>>>>=0A>>>= >>> 5 feb 2014 kl. 18:01 skrev Phil Hunt :=0A>>>>>> = =0A>>>>>> Details?=0A>>>>>> =0A>>>>>=0A>>>>>its next week right?=0A>>>>>=0A= >>>>>> Phil=0A>>>>>> _______________________________________________=0A>>>>= >> scim mailing list=0A>>>>>> scim@ietf.org=0A>>>>>> https://www.ietf.org/m= ailman/listinfo/scim=0A>>>>>_______________________________________________= =0A>>>>>scim mailing list=0A>>>>>scim@ietf.org=0A>>>>>https://www.ietf.org/= mailman/listinfo/scim=0A>>>>=0A>>>>________________________________________= _______=0A>>>>scim mailing list=0A>>>>scim@ietf.org=0A>>>>https://www.ietf.= org/mailman/listinfo/scim=0A>>>=0A>>>______________________________________= _________=0A>>>scim mailing list=0A>>>scim@ietf.org=0A>>>https://www.ietf.o= rg/mailman/listinfo/scim=0A>>>=0A>>>=0A>>>_________________________________= ______________=0A>>>scim mailing list=0A>>>scim@ietf.org=0A>>>https://www.i= etf.org/mailman/listinfo/scim=0A>>>=0A>>=0A>>=0A>>_________________________= ______________________=0A>>scim mailing list=0A>>scim@ietf.org=0A>>https://= www.ietf.org/mailman/listinfo/scim=0A>>=0A>>=0A>>__________________________= _____________________=0A>>scim mailing list=0A>>scim@ietf.org=0A>>https://w= ww.ietf.org/mailman/listinfo/scim=0A>>=0A>=0A>=0A>_________________________= ______________________=0A>scim mailing list=0A>scim@ietf.org=0A>https://www= .ietf.org/mailman/listinfo/scim=0A>=0A>=0A>________________________________= _______________=0A>scim mailing list=0A>scim@ietf.org=0A>https://www.ietf.o= rg/mailman/listinfo/scim=0A>=0A=0A=0A______________________________________= _________=0Ascim mailing list=0Ascim@ietf.org=0Ahttps://www.ietf.org/mailma= n/listinfo/scim ---1088529044-1791890102-1392249705=:25887 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable 
Small change:

immut=
able  If values are provided for elements already set in the object 
   =
   they MUST match existing data or=0A      an error is returned.  If the s=
ervice provider has no existing=0A      values, a new value(s) MAY be speci=
fied; and,
 
-bill


-------------------= -------------
William J. Mills
"Paranoid" Yahoo!



On Wednesday, February 12, 2014 = 3:55 PM, Phil Hunt <phil.hunt@oracle.com> wrote:
=
Sorry for all= the back and forth going on.  I think I have got it with error codes = and a decent amount of flexibility.  Here is the proposed text:

3.3.1.  Modifying with PUT=0A=0A   PUT=
 performs a full update.  Clients MAY retrieve the entire resource=0A   in =
advance, add the desired modifications and use HTTP PUT which will=0A   ove=
rwrite all previously stored data.  Since the PUT request performs=0A   a f=
ull update, clients MAY send attributes of the retrieved resource=0A   and =
the service provider MUST process according to attribute=0A   mutability as=
 follows:=0A=0A   readWrite, writeOnly  Any values provided SHALL replace t=
he existing=0A      attribute values.  Omitting the attribute or specific v=
alues means=0A      the attribute or specific value SHALL be removed;=0A=0A=
   immutable  If values are provided, they MUST match existing data or=0A  =
    an error is returned.  If the service provider has no existing=0A      =
values, a new value(s) MAY be specified; and,=0A=0A   readOnly  Any values =
provided (e.g.  meta.resourceType) SHALL be=0A      ignored.=0A=0A   If an =
attribute is "required", the client MUST specify the attribute=0A   in the =
PUT request.=0A=0A   If a value provided for an immutable attribute with an=
 existing value=0A   is NOT matched, the server SHALL respond with an HTTP =
response code=0A   of 400 and an apprpriate human readable message indicati=
ng an attempt=0A   to change an immutable attribute.=0A=0A   Unless otherwi=
se specified a successful PUT operation returns a 200=0A   OK response code=
 and the entire resource within the response body,=0A   enabling the client=
 to correlate the client's and Provider's views of=0A   the updated resourc=
e.  Example:=0A

I admit, the wordin= g could be better. But let's get the draft in tonight. 

=0A=0A
On 2014-02-12, at 3:36 PM, Bi= ll Mills <wmills@= yahoo-inc.com> wrote:

Makes sense.  Need to specify= the failure for omitted required attributes and attempts to change immutab= le things.

 
-bill


------------= --------------------
William J. Mills
"Paranoid" Yahoo!


=
On Wednesday, February 12, 2014 3:17 PM, Phil Hunt=0A &= lt;phil.hunt@oracle.= com> wrote:
Yes.  I was just thin= king that.  "required" means that the client MUST provide it. So a SP = could say the password is required.

How a= bout the following table of impacts based on mutability of attributes in a = PUT operation:

When submitting attributes via the PUT request, attribute= "mutability" will have the following impacts:
  • = readWrite, writeOnly - Any values provided replace the existing values. Omi= tting the attribute or specific values means the attribute or values are to= be removed.
  • immutable - = Any values provided MUST match the existing values. An omission of the attr= ibute=0A will not remove the existing value(s).
  • readOnly - Any values provided (e.g. meta.resou= rceType) will be ignored.

If an attribute is "required", the client MUST specify the = attribute in a PUT request. 

=0A
Does this work?

Phil

@independentid
phil.hunt@oracle.com
=0A
=0A
On 2014-02-12, at= 2:18 PM, Bill Mills <wmills_92105@yahoo.com> wrote:

Yeah, WriteOnly needs thought, we don't want to end up = with PUT transactions deleting passwords.  Passwords perhaps might nee= d a "required" attribute which means that a PUT that doesn't include it wou= ld fail.



On Wednesday, Feb= ruary 12, 2014 1:19 PM, Phil Hunt <phil.hunt@oracle.com> wrote:
Bill,

Thanks for the proposal.

Looks like we also didn't consi= der readOnly and writeOnly attributes such as passwords.  
<= br clear=3D"none">
Let me=0A think this aft and I'll put a quick = proposal together.

=0A
On 2014-02-12, at 12:14 PM, Bill Mills <wmills_92105@yahoo.com> wrote:
My action item from the call:  Propos= e language around immutability and PUT.

<= /span>

I=0A = don't know whether this goes into the definition of immutability or PUT, pr= obably PUT:

"PUT expects the entire object to be present, if the schema i= ncludes elements with immutable or ReadOnly elements then the object submit= ted with a PUT MUST include all existing immutable and ReadOnly data.=0A &n= bsp;The server MUST reject the PUT and return an error if the submitted dat= a for=0A  immutable or ReadOnly elemets do<= span style=3D"background-color:transparent;font-family:HelveticaNeue, 'Helv= etica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif;"> not matc= h exactly."

=0A
= On Wednesday, February 12, 2014 11:06 AM, Morteza Ansari (moransar) <moransar@cisco.com> = wrote:
It should be working now.  Not sure what happened but will = set up a new
one for next meeting to ensure this is fixed= .


Cheers,
Morteza

On 2/12/14 11:03 AM, "Kelly Grizzle"=0A <kelly.grizzle@sailpoint.= com> wrote:

>The link the me= eting is not working for me.  It is showing a meeting on
>the 19th.
>
>Morteza, ca= n you send the correct link?
>
><= br clear=3D"none">>-----Original Message-----
>From= : scim [mailto:sci= m-bounces@ietf.org] On Behalf Of Morteza Ansari
>(= moransar)
>Sent: Tuesday, February 11, 2014 7:15 PM>To: Leif Johansson; Phil Hunt
>Cc:= scim@ietf.org WG
>S= ubject: Re: [scim] Call today?
>
>= ;Correct, the next meeting is Wed. Fed. 12th at 11am Pacific time.
>Meeting info is here:
>
>To invite others to join, copy and paste everything below into your>invitation.
>-------------------= ------------------------------------
>Meeting informat= ion
>-------------------------------------------------= ------
>Topic: SCIM WG interim
>D= ate: Every Wednesday, from Wednesday, August 21, 2013 to no end date
>Time: 11:00 am, Pacific Daylight Time (San Francisco, GMT-0= 7:00) Meeting
>Number: 340 844 711 Meeting Password: (= This meeting does not require a
>password.)
>
>-------------------------------------------------------=
>To start or join the online meeting
>-------------------------------------------------------
>Go to https://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&= RT=3DMiM0
>
>----------------= ---------------------------------------
>Audio confere= nce information
>-------------------------------------= ------------------
>To receive a call back, provide yo= ur phone number when you join the
>meeting, or call th= e number below and enter the access code.
>US Toll fre= e: 1-855-797-9485
>US Toll: +1-415-655-0002
>Global call-in numbers:
>https://go.webex.com/go/globalcallin.php?serviceType=3DM= C&ED=3D153193777&tollF
>r
>ee=3D1
>Toll-free dialing restrictions:
>http://www.webex.com/pd= f/tollfree_restrictions.pdf
>
&g= t;Access code:340 844 711
>
>----= ---------------------------------------------------
>F= or assistance
>---------------------------------------= ----------------
>1. Go to https://go.= webex.com/go/mc
>2. On the=0A left navigation bar,= click "Support".
>To add this meeting to your calenda= r program (for example Microsoft
>Outlook), click this= link:
>https://go.webex.com/go/j.php= ?ED=3D153193777&UID=3D483472947&ICS=3DMS&LD=3D1&RD=3D2&=
>S
>T=3D1&SHA2=3DAAAAAXF= mPcl25G51pP-VAnTUIPjOJqt0XNEPVKSSFdjwCd-F
>
>To check whether you have the appropriate players installed f= or UCF
>(Universal Communications Format) rich media f= iles, go to
>https://go= .webex.com/go/systemdiagnosis.php.
>
>http://www= .webex.com <http://www.webex.com/>
>
>CCM:+14156550002x340844711#
&= gt;
>IMPORTANT NOTICE: This WebEx service includes a f= eature that allows audio
>and any documents and other = materials exchanged or viewed during the
>session to b= e recorded. You should inform all meeting attendees prior to
>recording if you intend to record the meeting. Please note that any= such
>recordings may be subject to discovery=0A in th= e event of litigation.
>
>
>On 2/5/14 10:39 AM, "Leif Johansson" <leifj@mnt.se> wrote:
>
>>
>>
>&g= t;> 5 feb 2014 kl. 18:01 skrev Phil Hunt <phil.hunt@oracle.com>:
>>>
>>> Details?
= >>>
>>
>>its next= week right?
>>
>>> Phil=
>>> ___________________________________________= ____
>>> scim mailing list
>= ;>> scim@ietf.org
>>> https://www.ietf.org/mailman/listinfo/scim
>>_______________________________________________
= >>scim mailing list
>>scim@ietf.org
>>https://www.ietf.org/mailman/listinfo/scim
>
>_________________________________________= ______
>scim mailing list
>scim@ietf.org
>https://www.ietf.org/mailman/listinfo/scim
________________________________________= _______
scim mailing list
scim@ietf.org
https://www.ietf.org/mailman/listinfo/scim


=
____________________________________= ___________
scim mailing list
scim@ietf.org
https://www.ietf.org/mailma= n/listinfo/scim


___________________________________= ____________
scim mailing list
scim@ietf.org
https://www.ietf.org/mailman/listinfo/scim


=
_______________________________________________<= br clear=3D"none">scim mailing list
scim@ietf.org
https://www.ietf.org/mailman/listin= fo/scim

<= /div>

_______________________________________________<= br clear=3D"none">scim mailing list
scim@ietf.org
https://www.ietf.org/mailman/listinfo/scim


=
_______________________________________________
scim mailing list
scim@ietf.org
= https://www.ietf.org/mailman/listinfo/scim
<= /div>


_______________________________________________
scim mailing list
scim@ietf.orghttps://www.ietf.org/mailman/listinfo/scim


---1088529044-1791890102-1392249705=:25887-- From phil.hunt@oracle.com Wed Feb 12 16:10:26 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0BA901A004C for ; Wed, 12 Feb 2014 16:10:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.748 X-Spam-Level: X-Spam-Status: No, score=-6.748 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, GB_I_INVITATION=-2, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SDFIgiVR5JoF for ; Wed, 12 Feb 2014 16:10:21 -0800 (PST) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) by ietfa.amsl.com (Postfix) with ESMTP id AEFEA1A0047 for ; Wed, 12 Feb 2014 16:10:20 -0800 (PST) Received: from acsinet21.oracle.com (acsinet21.oracle.com [141.146.126.237]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s1D0AI7W007325 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Thu, 13 Feb 2014 00:10:18 GMT Received: from aserz7021.oracle.com (aserz7021.oracle.com [141.146.126.230]) by acsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1D0AH7K023695 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 13 Feb 2014 00:10:17 GMT Received: from abhmp0008.oracle.com (abhmp0008.oracle.com [141.146.116.14]) by aserz7021.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1D0AHm8023687; Thu, 13 Feb 2014 00:10:17 GMT Received: from [192.168.1.124] (/24.86.29.34) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 12 Feb 2014 16:10:16 -0800 Content-Type: multipart/alternative; boundary="Apple-Mail=_AEDFAA68-F479-4C5A-A0BC-E9803614CC3F" Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\)) From: Phil Hunt In-Reply-To: <1392249705.25887.YahooMailNeo@web125602.mail.ne1.yahoo.com> Date: Wed, 12 Feb 2014 16:10:22 -0800 Message-Id: References: <7F7F895E-455D-450D-876E-B6AB466599D6@mnt.se> <118dcf276c044f26adc85c3051dddd29@BN1PR04MB392.namprd04.prod.outlook.com> <1392236062.76159.YahooMailNeo@web142802.mail.bf1.yahoo.com> <58399EA7-DEB6-4EEC-8A85-21D2B133A626@oracle.com> <1392243505.21463.YahooMailNeo@web142804.mail.bf1.yahoo.com> <69B8BD7C-7602-490E-9562-CC701B8BABA2@oracle.com> <1392248216.74499.YahooMailNeo@web125604.mail.ne1.yahoo.com> <1392249705.25887.YahooMailNeo@web125602.mail.ne1.yahoo.com> To: Bill Mills X-Mailer: Apple Mail (2.1510) X-Source-IP: acsinet21.oracle.com [141.146.126.237] Cc: Leif Johansson , Bill Mills , "Morteza Ansari \(moransar\)" , "scim@ietf.org WG" , Kelly Grizzle Subject: Re: [scim] Call today? X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Feb 2014 00:10:26 -0000 --Apple-Mail=_AEDFAA68-F479-4C5A-A0BC-E9803614CC3F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=iso-8859-1 :-) Phil @independentid www.independentid.com phil.hunt@oracle.com On 2014-02-12, at 4:01 PM, Bill Mills wrote: > Small change: >=20 > immutable If values are provided for elements already set in the = object=20 > they MUST match existing data or > an error is returned. If the service provider has no existing > values, a new value(s) MAY be specified; and, > =20 > -bill >=20 >=20 > -------------------------------- > William J. Mills > "Paranoid" Yahoo! >=20 >=20 >=20 > On Wednesday, February 12, 2014 3:55 PM, Phil Hunt = wrote: > Sorry for all the back and forth going on. I think I have got it with = error codes and a decent amount of flexibility. Here is the proposed = text: >=20 > 3.3.1. Modifying with PUT >=20 > PUT performs a full update. Clients MAY retrieve the entire = resource > in advance, add the desired modifications and use HTTP PUT which = will > overwrite all previously stored data. Since the PUT request = performs > a full update, clients MAY send attributes of the retrieved = resource > and the service provider MUST process according to attribute > mutability as follows: >=20 > readWrite, writeOnly Any values provided SHALL replace the = existing > attribute values. Omitting the attribute or specific values = means > the attribute or specific value SHALL be removed; >=20 > immutable If values are provided, they MUST match existing data or > an error is returned. If the service provider has no existing > values, a new value(s) MAY be specified; and, >=20 > readOnly Any values provided (e.g. meta.resourceType) SHALL be > ignored. >=20 > If an attribute is "required", the client MUST specify the = attribute > in the PUT request. >=20 > If a value provided for an immutable attribute with an existing = value > is NOT matched, the server SHALL respond with an HTTP response code > of 400 and an apprpriate human readable message indicating an = attempt > to change an immutable attribute. >=20 > Unless otherwise specified a successful PUT operation returns a 200 > OK response code and the entire resource within the response body, > enabling the client to correlate the client's and Provider's views = of > the updated resource. Example: >=20 > I admit, the wording could be better. But let's get the draft in = tonight.=20 >=20 > Phil >=20 > @independentid > www.independentid.com > phil.hunt@oracle.com >=20 > On 2014-02-12, at 3:36 PM, Bill Mills wrote: >=20 >> Makes sense. Need to specify the failure for omitted required = attributes and attempts to change immutable things. >>=20 >> =20 >> -bill >>=20 >>=20 >> -------------------------------- >> William J. Mills >> "Paranoid" Yahoo! >>=20 >>=20 >>=20 >> On Wednesday, February 12, 2014 3:17 PM, Phil Hunt = wrote: >> Yes. I was just thinking that. "required" means that the client = MUST provide it. So a SP could say the password is required. >>=20 >> How about the following table of impacts based on mutability of = attributes in a PUT operation: >>=20 >> When submitting attributes via the PUT request, attribute = "mutability" will have the following impacts: >> readWrite, writeOnly - Any values provided replace the existing = values. Omitting the attribute or specific values means the attribute or = values are to be removed. >> immutable - Any values provided MUST match the existing values. An = omission of the attribute will not remove the existing value(s). >> readOnly - Any values provided (e.g. meta.resourceType) will be = ignored. >>=20 >> If an attribute is "required", the client MUST specify the attribute = in a PUT request.=20 >>=20 >> Does this work? >>=20 >> Phil >>=20 >> @independentid >> www.independentid.com >> phil.hunt@oracle.com >>=20 >> On 2014-02-12, at 2:18 PM, Bill Mills wrote: >>=20 >>> Yeah, WriteOnly needs thought, we don't want to end up with PUT = transactions deleting passwords. Passwords perhaps might need a = "required" attribute which means that a PUT that doesn't include it = would fail. >>>=20 >>>=20 >>>=20 >>> On Wednesday, February 12, 2014 1:19 PM, Phil Hunt = wrote: >>> Bill, >>>=20 >>> Thanks for the proposal. >>>=20 >>> Looks like we also didn't consider readOnly and writeOnly attributes = such as passwords. =20 >>>=20 >>> Let me think this aft and I'll put a quick proposal together. >>>=20 >>> Phil >>>=20 >>> @independentid >>> www.independentid.com >>> phil.hunt@oracle.com >>>=20 >>> On 2014-02-12, at 12:14 PM, Bill Mills = wrote: >>>=20 >>>> My action item from the call: Propose language around immutability = and PUT. >>>>=20 >>>>=20 >>>> I don't know whether this goes into the definition of immutability = or PUT, probably PUT: >>>>=20 >>>> "PUT expects the entire object to be present, if the schema = includes elements with immutable or ReadOnly elements then the object = submitted with a PUT MUST include all existing immutable and ReadOnly = data. The server MUST reject the PUT and return an error if the = submitted data for immutable or ReadOnly elemets do not match exactly." >>>>=20 >>>>=20 >>>> On Wednesday, February 12, 2014 11:06 AM, Morteza Ansari (moransar) = wrote: >>>> It should be working now. Not sure what happened but will set up a = new >>>> one for next meeting to ensure this is fixed. >>>>=20 >>>>=20 >>>> Cheers, >>>> Morteza >>>>=20 >>>> On 2/12/14 11:03 AM, "Kelly Grizzle" = wrote: >>>>=20 >>>> >The link the meeting is not working for me. It is showing a = meeting on >>>> >the 19th. >>>> > >>>> >Morteza, can you send the correct link? >>>> > >>>> > >>>> >-----Original Message----- >>>> >From: scim [mailto:scim-bounces@ietf.org] On Behalf Of Morteza = Ansari >>>> >(moransar) >>>> >Sent: Tuesday, February 11, 2014 7:15 PM >>>> >To: Leif Johansson; Phil Hunt >>>> >Cc: scim@ietf.org WG >>>> >Subject: Re: [scim] Call today? >>>> > >>>> >Correct, the next meeting is Wed. Fed. 12th at 11am Pacific time. >>>> >Meeting info is here: >>>> > >>>> >To invite others to join, copy and paste everything below into = your >>>> >invitation.=20 >>>> >------------------------------------------------------- >>>> >Meeting information >>>> >------------------------------------------------------- >>>> >Topic: SCIM WG interim >>>> >Date: Every Wednesday, from Wednesday, August 21, 2013 to no end = date >>>> >Time: 11:00 am, Pacific Daylight Time (San Francisco, GMT-07:00) = Meeting >>>> >Number: 340 844 711 Meeting Password: (This meeting does not = require a >>>> >password.) >>>> > >>>> >------------------------------------------------------- >>>> >To start or join the online meeting >>>> >------------------------------------------------------- >>>> >Go to = https://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&RT=3DMiM0 >>>> > >>>> >------------------------------------------------------- >>>> >Audio conference information >>>> >------------------------------------------------------- >>>> >To receive a call back, provide your phone number when you join = the >>>> >meeting, or call the number below and enter the access code. >>>> >US Toll free: 1-855-797-9485 >>>> >US Toll: +1-415-655-0002 >>>> >Global call-in numbers: >>>> = >https://go.webex.com/go/globalcallin.php?serviceType=3DMC&ED=3D153193777&= tollF >>>> >r >>>> >ee=3D1 >>>> >Toll-free dialing restrictions: >>>> >http://www.webex.com/pdf/tollfree_restrictions.pdf >>>> > >>>> >Access code:340 844 711 >>>> > >>>> >------------------------------------------------------- >>>> >For assistance >>>> >------------------------------------------------------- >>>> >1. Go to https://go.webex.com/go/mc >>>> >2. On the left navigation bar, click "Support". >>>> >To add this meeting to your calendar program (for example = Microsoft >>>> >Outlook), click this link: >>>> = >https://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&ICS=3DMS&LD=3D= 1&RD=3D2& >>>> >S >>>> >T=3D1&SHA2=3DAAAAAXFmPcl25G51pP-VAnTUIPjOJqt0XNEPVKSSFdjwCd-F >>>> > >>>> >To check whether you have the appropriate players installed for = UCF >>>> >(Universal Communications Format) rich media files, go to >>>> >https://go.webex.com/go/systemdiagnosis.php. >>>> > >>>> >http://www.webex.com >>>> > >>>> >CCM:+14156550002x340844711# >>>> > >>>> >IMPORTANT NOTICE: This WebEx service includes a feature that = allows audio >>>> >and any documents and other materials exchanged or viewed during = the >>>> >session to be recorded. You should inform all meeting attendees = prior to >>>> >recording if you intend to record the meeting. Please note that = any such >>>> >recordings may be subject to discovery in the event of litigation. >>>> > >>>> > >>>> >On 2/5/14 10:39 AM, "Leif Johansson" wrote: >>>> > >>>> >> >>>> >> >>>> >>> 5 feb 2014 kl. 18:01 skrev Phil Hunt : >>>> >>>=20 >>>> >>> Details? >>>> >>>=20 >>>> >> >>>> >>its next week right? >>>> >> >>>> >>> Phil >>>> >>> _______________________________________________ >>>> >>> scim mailing list >>>> >>> scim@ietf.org >>>> >>> https://www.ietf.org/mailman/listinfo/scim >>>> >>_______________________________________________ >>>> >>scim mailing list >>>> >>scim@ietf.org >>>> >>https://www.ietf.org/mailman/listinfo/scim >>>> > >>>> >_______________________________________________ >>>> >scim mailing list >>>> >scim@ietf.org >>>> >https://www.ietf.org/mailman/listinfo/scim >>>>=20 >>>> _______________________________________________ >>>> scim mailing list >>>> scim@ietf.org >>>> https://www.ietf.org/mailman/listinfo/scim >>>>=20 >>>>=20 >>>> _______________________________________________ >>>> scim mailing list >>>> scim@ietf.org >>>> https://www.ietf.org/mailman/listinfo/scim >>>=20 >>>=20 >>> _______________________________________________ >>> scim mailing list >>> scim@ietf.org >>> https://www.ietf.org/mailman/listinfo/scim >>>=20 >>>=20 >>> _______________________________________________ >>> scim mailing list >>> scim@ietf.org >>> https://www.ietf.org/mailman/listinfo/scim >>=20 >>=20 >> _______________________________________________ >> scim mailing list >> scim@ietf.org >> https://www.ietf.org/mailman/listinfo/scim >>=20 >>=20 >> _______________________________________________ >> scim mailing list >> scim@ietf.org >> https://www.ietf.org/mailman/listinfo/scim >=20 >=20 > _______________________________________________ > scim mailing list > scim@ietf.org > https://www.ietf.org/mailman/listinfo/scim >=20 >=20 > _______________________________________________ > scim mailing list > scim@ietf.org > https://www.ietf.org/mailman/listinfo/scim --Apple-Mail=_AEDFAA68-F479-4C5A-A0BC-E9803614CC3F Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=iso-8859-1
On 2014-02-12, at 4:01 PM, Bill Mills <wmills@yahoo-inc.com> = wrote:

Small =
change:

immutable  If values are provided for elements already =
set in the object 
      they MUST match existing data or
      an error is returned.  If the service provider has no existing
      values, a new value(s) MAY be specified; =
and,
 
-bill





On Wednesday, February 12, 2014 3:55 PM, Phil = Hunt <phil.hunt@oracle.com> = wrote:
Sorry for all the back and forth going on.  I = think I have got it with error codes and a decent amount of flexibility. =  Here is the proposed text:

3.3.1.  Modifying =
with PUT

   PUT performs a full update.  Clients MAY retrieve the entire resource
   in advance, add the desired modifications and use HTTP PUT which will
   overwrite all previously stored data.  Since the PUT request performs
   a full update, clients MAY send attributes of the retrieved resource
   and the service provider MUST process according to attribute
   mutability as follows:

   readWrite, writeOnly  Any values provided SHALL replace the existing
      attribute values.  Omitting the attribute or specific values means
      the attribute or specific value SHALL be removed;

   immutable  If values are provided, they MUST match existing data or
      an error is returned.  If the service provider has no existing
      values, a new value(s) MAY be specified; and,

   readOnly  Any values provided (e.g.  meta.resourceType) SHALL be
      ignored.

   If an attribute is "required", the client MUST specify the attribute
   in the PUT request.

   If a value provided for an immutable attribute with an existing value
   is NOT matched, the server SHALL respond with an HTTP response code
   of 400 and an apprpriate human readable message indicating an attempt
   to change an immutable attribute.

   Unless otherwise specified a successful PUT operation returns a 200
   OK response code and the entire resource within the response body,
   enabling the client to correlate the client's and Provider's views of
   the updated resource.  Example:

I admit, the wording could be = better. But let's get the draft in tonight. 


On 2014-02-12, at 3:36 PM, Bill Mills = <wmills@yahoo-inc.com> = wrote:

Makes = sense.  Need to specify the failure for omitted required attributes = and attempts to change immutable things.

 
-bill


--------------= ------------------
William J. Mills
"Paranoid" Yahoo!



On Wednesday, February 12, 2014 3:17 PM, Phil = Hunt <phil.hunt@oracle.com> = wrote:
Yes. =  I was just thinking that.  "required" means that the client = MUST provide it. So a SP could say the password is required.

How about the following table of impacts based = on mutability of attributes in a PUT operation:

When = submitting attributes via the PUT request, attribute "mutability" will = have the following impacts:
  • readWrite, writeOnly - Any values provided replace the = existing values. Omitting the attribute or specific values means the = attribute or values are to be removed.
  • immutable = - Any values provided MUST match the existing values. An omission of the = attribute will not remove the existing value(s).
  • readOnly - Any values provided (e.g. = meta.resourceType) will be ignored.

If an attribute is "required", the = client MUST specify the attribute in a PUT = request. 

Does this work?

Phil

@independentid
phil.hunt@oracle.com
<= /div>

On 2014-02-12, at 2:18 PM, Bill Mills = <wmills_92105@yahoo.com> = wrote:

Yeah, WriteOnly needs thought, we = don't want to end up with PUT transactions deleting passwords. =  Passwords perhaps might need a "required" attribute which means = that a PUT that doesn't include it would fail.



On Wednesday, February 12, 2014 1:19 PM, Phil = Hunt <phil.hunt@oracle.com> = wrote:
Bill,

Thanks for = the proposal.

Looks like we = also didn't consider readOnly and writeOnly attributes such as = passwords.  

Let me think this aft and I'll put a quick proposal together.


On 2014-02-12, at 12:14 PM, Bill Mills = <wmills_92105@yahoo.com> = wrote:

My action item = from the call:  Propose language around immutability and = PUT.


I don't know whether this goes into the definition of immutability or = PUT, probably PUT:

"PUT expects = the entire object to be present, if the schema includes elements with = immutable or ReadOnly elements then the object submitted with a PUT MUST = include all existing immutable and ReadOnly data.  The server MUST reject the PUT and return an error if the = submitted data for  immutable or = ReadOnly elemets do not match exactly."


On Wednesday, February 12, 2014 11:06 AM, = Morteza Ansari (moransar) <moransar@cisco.com> wrote:
It should be working now.  = Not sure what happened but will set up a new
one for = next meeting to ensure this is fixed.


Cheers,
Morteza

On 2/12/14 11:03 AM, = "Kelly Grizzle" <kelly.grizzle@sailpoint.com> wrote:

>The link the = meeting is not working for me.  It is showing a meeting on
>the 19th.
>
>Morteza, can you send the correct link?
>
>
>-----Original Message-----
>From: = scim [mailto:scim-bounces@ietf.org] On = Behalf Of Morteza Ansari
>(moransar)
>Sent: Tuesday, February 11, 2014 7:15 PM
>To: Leif Johansson; Phil Hunt
>Cc:= scim@ietf.org WG
>Subject: Re: [scim] Call today?
>
>Correct, the next meeting is = Wed. Fed. 12th at 11am Pacific time.
>Meeting info = is here:
>
>To invite others = to join, copy and paste everything below into your
>invitation.
>-------------------------------------------------------=
>Meeting information
>-------------------------------------------------------=
>Topic: SCIM WG interim
>Date: = Every Wednesday, from Wednesday, August 21, 2013 to no end date
>Time: 11:00 am, Pacific Daylight Time (San Francisco, = GMT-07:00) Meeting
>Number: 340 844 711 Meeting = Password: (This meeting does not require a
>password.)
>
>-------------------------------------------------------=
>To start or join the online meeting
>-------------------------------------------------------=
>Go to https://go.webex.com/go/j.php?ED=3D153193777&UID=3D48347= 2947&RT=3DMiM0
>
>-------------------------------------------------------=
>Audio conference information
>-------------------------------------------------------=
>To receive a call back, provide your phone number = when you join the
>meeting, or call the number = below and enter the access code.
>US Toll free: = 1-855-797-9485
>US Toll: +1-415-655-0002
>Global call-in numbers:
>https://go.webex.com/go/globalcallin.php?serviceType=3D= MC&ED=3D153193777&tollF
>r
>ee=3D1
>Toll-free dialing = restrictions:
>http://www.web= ex.com/pdf/tollfree_restrictions.pdf
>
>Access code:340 844 711
>
>-------------------------------------------------------=
>For assistance
>-------------------------------------------------------=
>1. Go to https://go.webex.com/go/mc
>2. On the left navigation bar, click "Support".
>To add this = meeting to your calendar program (for example Microsoft
>Outlook), click this link:
>https://go.webex.com/go/j.php?ED=3D= 153193777&UID=3D483472947&ICS=3DMS&LD=3D1&RD=3D2&<= br clear=3D"none">>S
>T=3D1&SHA2=3DAAAAAXFmPcl25G51pP-VAnTUIPjOJqt0XNEPVK= SSFdjwCd-F
>
>To check whether = you have the appropriate players installed for UCF
>(Universal Communications Format) rich media files, = go to
>https://go.webex.com/= go/systemdiagnosis.php.
>
>http://www.webex.com <http://www.webex.com/>
>
>CCM:+14156550002x340844711#
>
>IMPORTANT NOTICE: This WebEx = service includes a feature that allows audio
>and = any documents and other materials exchanged or viewed during the
>session to be recorded. You should inform all meeting = attendees prior to
>recording if you intend to = record the meeting. Please note that any such
>recordings may be subject to discovery in the event of litigation.
>
>
>On 2/5/14 10:39 AM, "Leif = Johansson" <leifj@mnt.se> wrote:
>
>>
>>
>>> 5 feb 2014 kl. = 18:01 skrev Phil Hunt <phil.hunt@oracle.com>:
>>>
>>> Details?
>>>
>>
>>its next week right?
>>
>>> Phil
>>> = _______________________________________________
>>> scim mailing list
>>> scim@ietf.org
>>> https://www.ietf.org/m= ailman/listinfo/scim
>>_______________________________________________
>>scim mailing list
>>scim@ietf.org
>>https://www.ietf.org/m= ailman/listinfo/scim
>
>_______________________________________________
>scim mailing list
>scim@ietf.org
>https://www.ietf.org/m= ailman/listinfo/scim

_______________________________________________
scim mailing list
scim@ietf.org
https://www.ietf.org/m= ailman/listinfo/scim


=
_______________________________________________scim mailing list
scim@ietf.org
https://www.ietf.org/m= ailman/listinfo/scim


_____________________________________________= __
scim mailing list
scim@ietf.org
https://www.ietf.org/m= ailman/listinfo/scim


=
_______________________________________________
scim mailing list
scim@ietf.org
https://www.ietf.org/m= ailman/listinfo/scim


_____________________________________________= __
scim mailing list
scim@ietf.org
https://www.ietf.org/m= ailman/listinfo/scim


=
_______________________________________________
scim mailing list
scim@ietf.org
https://www.ietf.org/m= ailman/listinfo/scim


_______________________________________________
scim mailing list
scim@ietf.org
https://www.ietf.org/mailman/listinfo/scim


=
_______________________________________________
scim = mailing list
scim@ietf.org
https://www.ietf.org/ma= ilman/listinfo/scim

= --Apple-Mail=_AEDFAA68-F479-4C5A-A0BC-E9803614CC3F-- From moransar@cisco.com Wed Feb 12 16:15:12 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9DA2E1A0047; Wed, 12 Feb 2014 16:15:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -15.048 X-Spam-Level: X-Spam-Status: No, score=-15.048 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oNkA6vzJ7kL1; Wed, 12 Feb 2014 16:15:09 -0800 (PST) Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) by ietfa.amsl.com (Postfix) with ESMTP id A9A121A0032; Wed, 12 Feb 2014 16:15:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=8912; q=dns/txt; s=iport; t=1392250509; x=1393460109; h=from:to:subject:date:message-id:mime-version; bh=CguIrG6IGMBYrYt58knD9TLb3YyWA6DgE0mTKhgVdTY=; b=M3Lor2N4CBdF7PyMMn3v/Ey3OeMq+cZklnRYAY8u0Fp4Z3C/HwZ0Cm0E O3TTxnT2r5vshHqbdJ4lqnz3hQO5phIM1vwQ9HW261Rtn86DtJPpobd22 OODItrETYSWTBuIH0hrnMVEAZROzH2s7I8RDbFoDj6bSTFvAHdXozXYdu o=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AggFAFUO/FKtJV2b/2dsb2JhbAA/GoJKRDhVvH+BGBYBdIQEHm0BgQAnBAEbh3oBDTa/OxeOMA4CAgEKQYRBBJgWkhSDK4Iq X-IronPort-AV: E=Sophos;i="4.95,835,1384300800"; d="scan'208,217";a="300688746" Received: from rcdn-core-4.cisco.com ([173.37.93.155]) by rcdn-iport-9.cisco.com with ESMTP; 13 Feb 2014 00:14:47 +0000 Received: from xhc-rcd-x15.cisco.com (xhc-rcd-x15.cisco.com [173.37.183.89]) by rcdn-core-4.cisco.com (8.14.5/8.14.5) with ESMTP id s1D0Ele2004775 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Thu, 13 Feb 2014 00:14:47 GMT Received: from xmb-rcd-x08.cisco.com ([169.254.8.26]) by xhc-rcd-x15.cisco.com ([173.37.183.89]) with mapi id 14.03.0123.003; Wed, 12 Feb 2014 18:14:47 -0600 From: "Morteza Ansari (moransar)" To: "scim@ietf.org" , "proceedings@ietf.org" Thread-Topic: Meeting notes from SCIM WG confcal 2014-02-12 Thread-Index: AQHPKFCZbtqf2uUocU+V9fOYmtzRjQ== Date: Thu, 13 Feb 2014 00:14:46 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.3.9.131030 x-originating-ip: [171.68.123.35] Content-Type: multipart/alternative; boundary="_000_CF214E75C9957moransarciscocom_" MIME-Version: 1.0 Subject: [scim] Meeting notes from SCIM WG confcal 2014-02-12 X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Feb 2014 00:15:12 -0000 --_000_CF214E75C9957moransarciscocom_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Present: * Erik Wahlstr=F6m (note taker) * Morteza Ansari * Phil Hunt * Berry Leibba * Bill Mills * Kelly Grizzle * Leif Johansson * Bj=F6rn Aannestad Notes: * Phil have gone through all tickets and picked the low hanging fruit that = we talked about in Vancouver and on the list. * Some new tickets have also been added #57, #58, #59 and #60. * Issue #57 talks about updating all /v1 to /v2 to reflect SCIM v2. Some di= scussion around draft or not. * Issue #51, have had some discussion on the list. Draft 03 includes text t= hat IDs are optional on the ResourceType object. * Issue #59, 03 of the spec have spanx tags and also references to the real= RFCs. * Issue #43, some discussion about dropping short-hand notation for complex= attributes or not. Leave it unchanged in 03, needs more discussion on list= . * Phil will send the 03 draft of the spec to email list. It includes a Chan= ge Log section with all fixed issues. * Phil will be added as editor so he can push 03 version of the spec. Move = an old editor, to Contributors list to keep list small. * Kelly had some comments regarding the immutable attribute and how it=92s = handled. Can it be updated in a PUT or not? Should service provider just ig= nore or reject a request with a new value for an immutable attribute? Phil = will add a note regarding immutability in 03 and sends an email to list (ca= n be found here http://www.ietf.org/mail-archive/web/scim/current/msg01507.= html) * Bill should propose language regarding immutability and PUT on the list (= can be found here http://www.ietf.org/mail-archive/web/scim/current/msg0150= 8.html) * Phil and Kelly should compile presentation for London to summarise 03 and= some important issues that we should talk about to define next step. * Section 3.1 in schema spec also includes default values for attributes in= the schema. It exists no text about the default values anywhere so it will= be in 03. * Next call will be on the 26th, 2 weeks from now. --- Meeting recording: Your recording is now available on the WebEx service site. Click the link b= elow to play it: https://go.webex.com/go/lsr.php?RCID=3Dfe4643e74f004738883bc220a3b57c76 SCIM WG bi-weekly call-20140212 1907-1 Wednesday, February 12, 2014 11:07 am San Francisco Time 47 Minutes --_000_CF214E75C9957moransarciscocom_ Content-Type: text/html; charset="Windows-1252" Content-ID: Content-Transfer-Encoding: quoted-printable
Present:
* Erik Wahlstr=F6m= (note taker)
* Morteza Ansari
* Phil Hunt
* Berry Leibba
* Bill Mills
* Kelly Grizzle
* Leif Johansson
* Bj=F6rn Aannesta= d

Notes:
* Phil have gone t= hrough all tickets and picked the low hanging fruit that we talked about in= Vancouver and on the list. 
* Some new tickets= have also been added  #57, #58, #59 and #60.
* Issue #57 t= alks about updating all /v1 to /v2 to reflect SCIM v2. Some discussion arou= nd draft or not.
* Issue #51, have = had some discussion on the list. Draft 03 includes text that IDs are option= al on the ResourceType object. 
* Issue #59, 03 of= the spec have spanx tags and also references to the real RFCs.
* Issue #43, some = discussion about dropping short-hand notation for complex attributes or not= . Leave it unchanged in 03, needs more discussion on list.
* Phil will send t= he 03 draft of the spec to email list. It includes a Change Log section wit= h all fixed issues.
* Phil will be add= ed as editor so he can push 03 version of the spec. Move an old editor, to = Contributors list to keep list small.
* Kelly had some c= omments regarding the immutable attribute and how it=92s handled. Can it be= updated in a PUT or not? Should service provider just ignore or reject a r= equest with a new value for an immutable attribute? Phil will add a note regarding immutability in 03 and sends an = email to list (can be found here http://www.ietf.org/mail-archive/web= /scim/current/msg01507.html)
* Bill should prop= ose language regarding immutability and PUT on the list (can be found here&= nbsp;http://www.ietf.org/mail-archive/web/scim/current/msg01508.html)<= /div>
* Phil and Kelly s= hould compile presentation for London to summarise 03 and some important is= sues that we should talk about to define next step. 
* Section 3.1 in s= chema spec also includes default values for attributes in the schema. It ex= ists no text about the default values anywhere so it will be in 03.
* Next call will b= e on the 26th, 2 weeks from now.

---
Meeting recording:=

Your recording is now available on the WebEx service site. Click the link = below to play it: 

https://go.webex.com/go/lsr.php?RCI= D=3Dfe4643e74f004738883bc220a3b57c76 
SCIM WG bi-weekly call-20140212 1907-1 
Wednesday, February 12, 2014 11:07 am San Francisco Time=  
47 Minutes 
--_000_CF214E75C9957moransarciscocom_-- From randomshelley@gmail.com Wed Feb 12 16:54:47 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2BCAA1A0083 for ; Wed, 12 Feb 2014 16:54:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DSxknaIvPWRA for ; Wed, 12 Feb 2014 16:54:45 -0800 (PST) Received: from mail-yk0-x231.google.com (mail-yk0-x231.google.com [IPv6:2607:f8b0:4002:c07::231]) by ietfa.amsl.com (Postfix) with ESMTP id 113AE1A0069 for ; Wed, 12 Feb 2014 16:54:44 -0800 (PST) Received: by mail-yk0-f177.google.com with SMTP id q200so17359214ykb.8 for ; Wed, 12 Feb 2014 16:54:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=A9+/+OM7uzF0HtZGJpTxoKbGCWj+44iveQF0WRT0B70=; b=n00BNgBKhv1jYlPZzMGyMYvz7oBqc8blnGd0/lYP0fGNtVXmB7+66d2WzZjgcb05se fWYigLC9gMGJ9iv9F49WHhNs81iT7DNywlf4s/gJSZI803S1SOj5bybKg+KogfYKnoUs /FKKflKq3JXzhisYhPu3lhssCdwg3MU62Cd7OiI5R/vhAVOLOHGsThSgPCTauB8UiDX7 8pyS1Df2pOye+4m5NpSSToEHA9I6Ji9xD9fzFv+bpPTU+hfH4FwBxqwL4oN+JjaBiwVk r3YT4kT71Aw6lPLz5CbdaI+cwgS+vUnc/tJ5jZn+ZeLQs/C9VZwo+pyNG3KxJAxAY7GD PVIA== MIME-Version: 1.0 X-Received: by 10.236.207.73 with SMTP id m49mr41895175yho.5.1392252883928; Wed, 12 Feb 2014 16:54:43 -0800 (PST) Received: by 10.170.90.130 with HTTP; Wed, 12 Feb 2014 16:54:43 -0800 (PST) Date: Wed, 12 Feb 2014 18:54:43 -0600 Message-ID: From: Shelley To: "scim@ietf.org" Content-Type: text/plain; charset=ISO-8859-1 Subject: Re: [scim] Prelim changes for draft 03 for tomorrows call X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Feb 2014 00:54:47 -0000 A couple questions regarding the User resource's "groups" attribute schema representation in the draft -- The Schema Representation in the draft indicates that all user "groups" sub-attributes are "readWrite." I'd presume these should all be "readOnly" instead? Also, what is the purpose of the "primary" sub-attribute with the user "groups"? Assuming the user groups are based on the group memberships, I'm not quite sure how a "primary" attribute would even get set. Thanks, Shelley > ---------- Forwarded message ---------- > From: Phil Hunt > To: "scim@ietf.org WG" > Cc: > Date: Tue, 11 Feb 2014 13:26:32 -0800 > Subject: [scim] Prelim changes for draft 03 for tomorrows call > Please find attached the current spreadsheet on ticket plan and diffs for the new 03 drafts for tomorrows WG call. > > Comments appreciated. > > Note: AFAIK, we need to publish this week for IETF London. (submission closes friday) > > Phil > > @independentid > www.independentid.com > phil.hunt@oracle.com > > > > > _______________________________________________ > scim mailing list > scim@ietf.org > https://www.ietf.org/mailman/listinfo/scim > From phil.hunt@oracle.com Wed Feb 12 19:27:30 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A2B991A00B6 for ; Wed, 12 Feb 2014 19:27:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.749 X-Spam-Level: X-Spam-Status: No, score=-4.749 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qenrYz6-0V2U for ; Wed, 12 Feb 2014 19:27:28 -0800 (PST) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) by ietfa.amsl.com (Postfix) with ESMTP id 7445A1A00B5 for ; Wed, 12 Feb 2014 19:27:28 -0800 (PST) Received: from ucsinet21.oracle.com (ucsinet21.oracle.com [156.151.31.93]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s1D3RQrj006336 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Thu, 13 Feb 2014 03:27:26 GMT Received: from aserz7022.oracle.com (aserz7022.oracle.com [141.146.126.231]) by ucsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1D3RPa1023315 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 13 Feb 2014 03:27:25 GMT Received: from abhmp0005.oracle.com (abhmp0005.oracle.com [141.146.116.11]) by aserz7022.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1D3ROXR019780; Thu, 13 Feb 2014 03:27:24 GMT Received: from [192.168.1.124] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 12 Feb 2014 19:27:24 -0800 Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\)) From: Phil Hunt In-Reply-To: Date: Wed, 12 Feb 2014 19:27:33 -0800 Content-Transfer-Encoding: quoted-printable Message-Id: References: To: Shelley X-Mailer: Apple Mail (2.1510) X-Source-IP: ucsinet21.oracle.com [156.151.31.93] Cc: "scim@ietf.org" Subject: Re: [scim] Prelim changes for draft 03 for tomorrows call X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Feb 2014 03:27:30 -0000 Shelly, Thanks. I agree. Phil @independentid www.independentid.com phil.hunt@oracle.com On 2014-02-12, at 4:54 PM, Shelley wrote: > A couple questions regarding the User resource's "groups" attribute > schema representation in the draft -- >=20 > The Schema Representation in the draft indicates that all user > "groups" sub-attributes are "readWrite." I'd presume these should all > be "readOnly" instead? >=20 > Also, what is the purpose of the "primary" sub-attribute with the user > "groups"? Assuming the user groups are based on the group memberships, > I'm not quite sure how a "primary" attribute would even get set. >=20 > Thanks, > Shelley >=20 >=20 >> ---------- Forwarded message ---------- >> From: Phil Hunt >> To: "scim@ietf.org WG" >> Cc: >> Date: Tue, 11 Feb 2014 13:26:32 -0800 >> Subject: [scim] Prelim changes for draft 03 for tomorrows call >> Please find attached the current spreadsheet on ticket plan and diffs = for the new 03 drafts for tomorrows WG call. >>=20 >> Comments appreciated. >>=20 >> Note: AFAIK, we need to publish this week for IETF London. = (submission closes friday) >>=20 >> Phil >>=20 >> @independentid >> www.independentid.com >> phil.hunt@oracle.com >>=20 >>=20 >>=20 >>=20 >> _______________________________________________ >> scim mailing list >> scim@ietf.org >> https://www.ietf.org/mailman/listinfo/scim >>=20 >=20 > _______________________________________________ > scim mailing list > scim@ietf.org > https://www.ietf.org/mailman/listinfo/scim From internet-drafts@ietf.org Wed Feb 12 21:50:48 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 115461A00F5; Wed, 12 Feb 2014 21:50:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Swy8SP6ALLva; Wed, 12 Feb 2014 21:50:43 -0800 (PST) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 045BE1A00E0; Wed, 12 Feb 2014 21:50:43 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 5.0.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20140213055042.2253.76844.idtracker@ietfa.amsl.com> Date: Wed, 12 Feb 2014 21:50:42 -0800 Cc: scim@ietf.org Subject: [scim] I-D Action: draft-ietf-scim-api-03.txt X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Feb 2014 05:50:48 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the System for Cross-domain Identity Management Working Group of the IETF. Title : System for Cross-Domain Identity Management:Protocol Authors : Kelly Grizzle Phil Hunt Morteza Ansari Erik Wahlstroem Chuck Mortimore Filename : draft-ietf-scim-api-03.txt Pages : 57 Date : 2014-02-12 Abstract: The System for Cross-Domain Identity Management (SCIM) specification is designed to make managing user identity in cloud based applications and services easier. The specification suite seeks to build upon experience with existing schemas and deployments, placing specific emphasis on simplicity of development and integration, while applying existing authentication, authorization, and privacy models. It's intent is to reduce the cost and complexity of user management operations by providing a common user schema and extension model, as well as binding documents to provide patterns for exchanging this schema using standard protocols. In essence, make it fast, cheap, and easy to move users in to, out of, and around the cloud. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-scim-api/ There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-scim-api-03 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=draft-ietf-scim-api-03 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From julian.reschke@gmx.de Wed Feb 12 23:42:01 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5DBEA1A0144 for ; Wed, 12 Feb 2014 23:42:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YSxq8DMnm1kT for ; Wed, 12 Feb 2014 23:41:59 -0800 (PST) Received: from mout.gmx.net (mout.gmx.net [212.227.15.18]) by ietfa.amsl.com (Postfix) with ESMTP id 341A81A0140 for ; Wed, 12 Feb 2014 23:41:59 -0800 (PST) Received: from [192.168.1.103] ([93.217.97.16]) by mail.gmx.com (mrgmx003) with ESMTPSA (Nemesis) id 0LqALY-1VaNNt0S0W-00djlj for ; Thu, 13 Feb 2014 08:41:57 +0100 Message-ID: <52FC7746.4020107@gmx.de> Date: Thu, 13 Feb 2014 08:41:58 +0100 From: Julian Reschke User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.3.0 MIME-Version: 1.0 To: scim@ietf.org References: <20140213055042.2253.76844.idtracker@ietfa.amsl.com> In-Reply-To: <20140213055042.2253.76844.idtracker@ietfa.amsl.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Provags-ID: V03:K0:KTBNvruu4aXTgQgrNUo0KOhpPetWC0tHjdpbuWuNt+O15930Sn8 NV/vtHcEgtZvtwJec58+EPg1xKldAWNoRHQR3Z12TCqTZDRQHkdJr1NcCf5uWs4hUtdS5WF KZQwnP30STdeNZd3TwgyA5SmgOQvtyqH3/c+WPsnemnmS93L568bw1LUiBf3A2XiGfGFFco FFHh3mXsau64+0oG7ImNQ== Subject: Re: [scim] I-D Action: draft-ietf-scim-api-03.txt X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Feb 2014 07:42:01 -0000 On 2014-02-13 06:50, internet-drafts@ietf.org wrote: > > A New Internet-Draft is available from the on-line Internet-Drafts directories. > This draft is a work item of the System for Cross-domain Identity Management Working Group of the IETF. > ... For the record: this draft does not seem to address the points I raised lately; nor do I see them captured in the issue tracker (, right?). Best regards, Julian From nobody Thu Feb 13 10:08:55 2014 Return-Path: X-Original-To: scim@ietf.org Delivered-To: scim@ietfa.amsl.com Received: by ietfa.amsl.com (Postfix, from userid 0) id 0559A1A03AB; Thu, 13 Feb 2014 10:08:52 -0800 (PST) X-Original-To: i-d-announce@ietfa.amsl.com Delivered-To: i-d-announce@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3CB5B1A0393; Thu, 13 Feb 2014 09:42:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tumKSvEJH3Fz; Thu, 13 Feb 2014 09:42:15 -0800 (PST) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 6F5E81A0392; Thu, 13 Feb 2014 09:42:06 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 5.0.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20140213174206.8444.52080.idtracker@ietfa.amsl.com> Date: Thu, 13 Feb 2014 09:42:06 -0800 Archived-At: http://mailarchive.ietf.org/arch/msg/i-d-announce/Ri-ccyROv4RqP24rVk7xpn9FlPI Archived-At: http://mailarchive.ietf.org/arch/msg/scim/0Tf81AsqiKTejnU46oGbbKZRx_A Cc: scim@ietf.org Subject: [scim] I-D Action: draft-ietf-scim-core-schema-03.txt X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Feb 2014 18:08:53 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the System for Cross-domain Identity Management Working Group of the IETF. Title : System for Cross-Domain Identity Management: Core Schema Authors : Kelly Grizzle Phil Hunt Erik Wahlstroem Chuck Mortimore Filename : draft-ietf-scim-core-schema-03.txt Pages : 56 Date : 2014-02-12 Abstract: The System for Cross-Domain Identity Management (SCIM) specification is designed to make managing user identity in cloud based applications and services easier. The specification suite builds upon experience with existing schemas and deployments, placing specific emphasis on simplicity of development and integration, while applying existing authentication, authorization, and privacy models. Its intent is to reduce the cost and complexity of user management operations by providing a common user schema and extension model, as well as binding documents to provide patterns for exchanging this schema using standard protocols. In essence, make it fast, cheap, and easy to move identity in to, out of, and around the cloud. This document provides a platform neutral schema and extension model for representing users and groups in JSON format. This schema is intended for exchange and use with cloud service providers. Additional binding documents provide a standard REST API, SAML binding, and use cases. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-scim-core-schema/ There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-scim-core-schema-03 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=draft-ietf-scim-core-schema-03 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Fri Feb 14 03:45:38 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 68AA11A0204 for ; Fri, 14 Feb 2014 03:45:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.148 X-Spam-Level: X-Spam-Status: No, score=-4.148 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, GB_I_INVITATION=-2, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b9ZrEgqNnTIi for ; Fri, 14 Feb 2014 03:45:30 -0800 (PST) Received: from smtp.nexusgroup.com (smtp.nexusgroup.com [83.241.133.120]) by ietfa.amsl.com (Postfix) with ESMTP id 8A1981A0203 for ; Fri, 14 Feb 2014 03:45:29 -0800 (PST) Received: from NG-EX02.ad.nexusgroup.com (10.75.28.43) by NG-EX01.ad.nexusgroup.com (10.75.28.40) with Microsoft SMTP Server (TLS) id 15.0.775.38; Fri, 14 Feb 2014 12:45:11 +0100 Received: from NG-EX02.ad.nexusgroup.com ([fe80::2839:3494:59f1:44d]) by NG-EX02.ad.nexusgroup.com ([fe80::2839:3494:59f1:44d%12]) with mapi id 15.00.0775.031; Fri, 14 Feb 2014 12:45:11 +0100 From: =?Windows-1252?Q?Erik_Wahlstr=F6m?= To: Phil Hunt Thread-Topic: [scim] Call today? Thread-Index: AQHPIpP2K7lK2jk4U0at/bbhPxsY85qm7UmAgAncZYCAASqygIAAAKeAgAATFgCAABIlgIAAEISAgAAQhYCAAAVrAIAABQIAgAAB7YCAAAJoAIACVHcA Date: Fri, 14 Feb 2014 11:45:11 +0000 Message-ID: <7F12377E-9EFC-4A38-B428-0AAF964A4F58@nexusgroup.com> References: <7F7F895E-455D-450D-876E-B6AB466599D6@mnt.se> <118dcf276c044f26adc85c3051dddd29@BN1PR04MB392.namprd04.prod.outlook.com> <1392236062.76159.YahooMailNeo@web142802.mail.bf1.yahoo.com> <58399EA7-DEB6-4EEC-8A85-21D2B133A626@oracle.com> <1392243505.21463.YahooMailNeo@web142804.mail.bf1.yahoo.com> <69B8BD7C-7602-490E-9562-CC701B8BABA2@oracle.com> <1392248216.74499.YahooMailNeo@web125604.mail.ne1.yahoo.com> <1392249705.25887.YahooMailNeo@web125602.mail.ne1.yahoo.com> In-Reply-To: Accept-Language: en-US, sv-SE Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.75.28.115] Content-Type: multipart/alternative; boundary="_000_7F12377E9EFC4A38B4280AAF964A4F58nexusgroupcom_" MIME-Version: 1.0 Archived-At: http://mailarchive.ietf.org/arch/msg/scim/Lv3Q_dnLlJ578DodZ3k7c6KvsvI Cc: "scim@ietf.org WG" , "Morteza Ansari \(moransar\)" , Leif Johansson , Bill Mills , Kelly Grizzle , Bill Mills Subject: Re: [scim] Call today? X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Feb 2014 11:45:36 -0000 --_000_7F12377E9EFC4A38B4280AAF964A4F58nexusgroupcom_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable I=92ve been giving it some thoughts afterwards and I don=92t think this pla= ys nice with passwords. This means that we must always send the password in all PUT requests when j= ust updating a user and passwords should be sent as little as possible over= the wire. We also have scenarios where we don=92t always know the password, but we st= ill know information about a user that we want to update at a service provi= der. For example if a authentication service provisions the username and th= e password, but some other, attribute server provisions other types of info= rmation about a user. This means that backend systems have to send password= s around to be able to always send them. Another example could be a server product that provisions users to a servic= e provider and to an internal AD and also stores info about the users in th= ere own system, but don=92t store the passwords. That means that they don= =92t have knowledge about the clear text password anymore, it=92s only in A= D, and it can=92t update user information at a SCIM service provider. I would prefer to just ignore attributes that=92s not set and use PATCH if = you would like to delete certain attributes. Just as it was before. In the = early days, pre-ietf versions of documents, we also had a password endpoint= that was later removed. / Erik On 13 Feb 2014, at 01:10, Phil Hunt > wrote: :-) Phil @independentid www.independentid.com phil.hunt@oracle.com On 2014-02-12, at 4:01 PM, Bill Mills > wrote: Small change: immutable If values are provided for elements already set in the object they MUST match existing data or an error is returned. If the service provider has no existing values, a new value(s) MAY be specified; and, -bill -------------------------------- William J. Mills "Paranoid" Yahoo! On Wednesday, February 12, 2014 3:55 PM, Phil Hunt > wrote: Sorry for all the back and forth going on. I think I have got it with erro= r codes and a decent amount of flexibility. Here is the proposed text: 3.3.1. Modifying with PUT PUT performs a full update. Clients MAY retrieve the entire resource in advance, add the desired modifications and use HTTP PUT which will overwrite all previously stored data. Since the PUT request performs a full update, clients MAY send attributes of the retrieved resource and the service provider MUST process according to attribute mutability as follows: readWrite, writeOnly Any values provided SHALL replace the existing attribute values. Omitting the attribute or specific values means the attribute or specific value SHALL be removed; immutable If values are provided, they MUST match existing data or an error is returned. If the service provider has no existing values, a new value(s) MAY be specified; and, readOnly Any values provided (e.g. meta.resourceType) SHALL be ignored. If an attribute is "required", the client MUST specify the attribute in the PUT request. If a value provided for an immutable attribute with an existing value is NOT matched, the server SHALL respond with an HTTP response code of 400 and an apprpriate human readable message indicating an attempt to change an immutable attribute. Unless otherwise specified a successful PUT operation returns a 200 OK response code and the entire resource within the response body, enabling the client to correlate the client's and Provider's views of the updated resource. Example: I admit, the wording could be better. But let's get the draft in tonight. Phil @independentid www.independentid.com phil.hunt@oracle.com On 2014-02-12, at 3:36 PM, Bill Mills > wrote: Makes sense. Need to specify the failure for omitted required attributes a= nd attempts to change immutable things. -bill -------------------------------- William J. Mills "Paranoid" Yahoo! On Wednesday, February 12, 2014 3:17 PM, Phil Hunt > wrote: Yes. I was just thinking that. "required" means that the client MUST prov= ide it. So a SP could say the password is required. How about the following table of impacts based on mutability of attributes = in a PUT operation: When submitting attributes via the PUT request, attribute "mutability" will= have the following impacts: * readWrite, writeOnly - Any values provided replace the existing value= s. Omitting the attribute or specific values means the attribute or values = are to be removed. * immutable - Any values provided MUST match the existing values. An om= ission of the attribute will not remove the existing value(s). * readOnly - Any values provided (e.g. meta.resourceType) will be ignor= ed. If an attribute is "required", the client MUST specify the attribute in a P= UT request. Does this work? Phil @independentid www.independentid.com phil.hunt@oracle.com On 2014-02-12, at 2:18 PM, Bill Mills > wrote: Yeah, WriteOnly needs thought, we don't want to end up with PUT transaction= s deleting passwords. Passwords perhaps might need a "required" attribute = which means that a PUT that doesn't include it would fail. On Wednesday, February 12, 2014 1:19 PM, Phil Hunt > wrote: Bill, Thanks for the proposal. Looks like we also didn't consider readOnly and writeOnly attributes such a= s passwords. Let me think this aft and I'll put a quick proposal together. Phil @independentid www.independentid.com phil.hunt@oracle.com On 2014-02-12, at 12:14 PM, Bill Mills > wrote: My action item from the call: Propose language around immutability and PUT= . I don't know whether this goes into the definition of immutability or PUT, = probably PUT: "PUT expects the entire object to be present, if the schema includes elemen= ts with immutable or ReadOnly elements then the object submitted with a PUT= MUST include all existing immutable and ReadOnly data. The server MUST re= ject the PUT and return an error if the submitted data for immutable or Re= adOnly elemets do not match exactly." On Wednesday, February 12, 2014 11:06 AM, Morteza Ansari (moransar) > wrote: It should be working now. Not sure what happened but will set up a new one for next meeting to ensure this is fixed. Cheers, Morteza On 2/12/14 11:03 AM, "Kelly Grizzle" > wrote: >The link the meeting is not working for me. It is showing a meeting on >the 19th. > >Morteza, can you send the correct link? > > >-----Original Message----- >From: scim [mailto:scim-bounces@ietf.org] On= Behalf Of Morteza Ansari >(moransar) >Sent: Tuesday, February 11, 2014 7:15 PM >To: Leif Johansson; Phil Hunt >Cc: scim@ietf.org WG >Subject: Re: [scim] Call today? > >Correct, the next meeting is Wed. Fed. 12th at 11am Pacific time. >Meeting info is here: > >To invite others to join, copy and paste everything below into your >invitation. >------------------------------------------------------- >Meeting information >------------------------------------------------------- >Topic: SCIM WG interim >Date: Every Wednesday, from Wednesday, August 21, 2013 to no end date >Time: 11:00 am, Pacific Daylight Time (San Francisco, GMT-07:00) Meeting >Number: 340 844 711 Meeting Password: (This meeting does not require a >password.) > >------------------------------------------------------- >To start or join the online meeting >------------------------------------------------------- >Go to https://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&RT=3DMi= M0 > >------------------------------------------------------- >Audio conference information >------------------------------------------------------- >To receive a call back, provide your phone number when you join the >meeting, or call the number below and enter the access code. >US Toll free: 1-855-797-9485 >US Toll: +1-415-655-0002 >Global call-in numbers: >https://go.webex.com/go/globalcallin.php?serviceType=3DMC&ED=3D153193777&t= ollF >r >ee=3D1 >Toll-free dialing restrictions: >http://www.webex.com/pdf/tollfree_restrictions.pdf > >Access code:340 844 711 > >------------------------------------------------------- >For assistance >------------------------------------------------------- >1. Go to https://go.webex.com/go/mc >2. On the left navigation bar, click "Support". >To add this meeting to your calendar program (for example Microsoft >Outlook), click this link: >https://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&ICS=3DMS&LD= =3D1&RD=3D2& >S >T=3D1&SHA2=3DAAAAAXFmPcl25G51pP-VAnTUIPjOJqt0XNEPVKSSFdjwCd-F > >To check whether you have the appropriate players installed for UCF >(Universal Communications Format) rich media files, go to >https://go.webex.com/go/systemdiagnosis.php. > >http://www.webex.com > >CCM:+14156550002x340844711# > >IMPORTANT NOTICE: This WebEx service includes a feature that allows audio >and any documents and other materials exchanged or viewed during the >session to be recorded. You should inform all meeting attendees prior to >recording if you intend to record the meeting. Please note that any such >recordings may be subject to discovery in the event of litigation. > > >On 2/5/14 10:39 AM, "Leif Johansson" > w= rote: > >> >> >>> 5 feb 2014 kl. 18:01 skrev Phil Hunt >: >>> >>> Details? >>> >> >>its next week right? >> >>> Phil >>> _______________________________________________ >>> scim mailing list >>> scim@ietf.org >>> https://www.ietf.org/mailman/listinfo/scim >>_______________________________________________ >>scim mailing list >>scim@ietf.org >>https://www.ietf.org/mailman/listinfo/scim > >_______________________________________________ >scim mailing list >scim@ietf.org >https://www.ietf.org/mailman/listinfo/scim _______________________________________________ scim mailing list scim@ietf.org https://www.ietf.org/mailman/listinfo/scim _______________________________________________ scim mailing list scim@ietf.org https://www.ietf.org/mailman/listinfo/scim _______________________________________________ scim mailing list scim@ietf.org https://www.ietf.org/mailman/listinfo/scim _______________________________________________ scim mailing list scim@ietf.org https://www.ietf.org/mailman/listinfo/scim _______________________________________________ scim mailing list scim@ietf.org https://www.ietf.org/mailman/listinfo/scim _______________________________________________ scim mailing list scim@ietf.org https://www.ietf.org/mailman/listinfo/scim _______________________________________________ scim mailing list scim@ietf.org https://www.ietf.org/mailman/listinfo/scim _______________________________________________ scim mailing list scim@ietf.org https://www.ietf.org/mailman/listinfo/scim _______________________________________________ scim mailing list scim@ietf.org https://www.ietf.org/mailman/listinfo/scim --_000_7F12377E9EFC4A38B4280AAF964A4F58nexusgroupcom_ Content-Type: text/html; charset="Windows-1252" Content-ID: Content-Transfer-Encoding: quoted-printable
I=92ve been giving it some thoughts afterwards and I don=92t think thi= s plays nice with passwords.

This means that we must always send the password in all PUT requests w= hen just updating a user and passwords should be sent as little as possible= over the wire.

We also have scenarios where we don=92t always know the password, but = we still know information about a user that we want to update at a service = provider. For example if a authentication service provisions the username a= nd the password, but some other, attribute server provisions other types of information about a user. This means that= backend systems have to send passwords around to be able to always send th= em.

Another example could be a server product that provisions users to a s= ervice provider and to an internal AD and also stores info about the users = in there own system, but don=92t store the passwords. That means that they = don=92t have knowledge about the clear text password anymore, it=92s only in AD, and it can=92t update user infor= mation at a SCIM service provider.

I would prefer to just ignore attributes that=92s not set and use PATC= H if you would like to delete certain attributes. Just as it was before. In= the early days, pre-ietf versions of documents, we also had a password end= point that was later removed.

/ Erik


On 13 Feb 2014, at 01:10, Phil Hunt <phil.hunt@oracle.com> wrote:

:-)


On 2014-02-12, at 4:01 PM, Bill Mills <wmills@yahoo-inc.com> wrote:

Small change:
=

immutable  If values are provided for elements already set in the objec=
t 
      they MUST match existing data or
      an error is returned.  If the service provider has no existing
      values, a new value(s) MAY be specified; and,
 
-bill


--------------------------------
William J. Mills
"Paranoid" Yahoo!



On Wednesday, February 12,= 2014 3:55 PM, Phil Hunt <phil.h= unt@oracle.com> wrote:
Sorry for all the back and forth going on.  = I think I have got it with error codes and a decent amount of flexibility. =  Here is the proposed text: 

3.3.1.  Modifying=
 with PUT

   PUT performs a full update.  Clients MAY retrieve the entire resource
   in advance, add the desired modifications and use HTTP PUT which will
   overwrite all previously stored data.  Since the PUT request performs
   a full update, clients MAY send attributes of the retrieved resource
   and the service provider MUST process according to attribute
   mutability as follows:

   readWrite, writeOnly  Any values provided SHALL replace the existing
      attribute values.  Omitting the attribute or specific values means
      the attribute or specific value SHALL be removed;

   immutable  If values are provided, they MUST match existing data or
      an error is returned.  If the service provider has no existing
      values, a new value(s) MAY be specified; and,

   readOnly  Any values provided (e.g.  meta.resourceType) SHALL be
      ignored.

   If an attribute is "required", the client MUST specify the att=
ribute
   in the PUT request.

   If a value provided for an immutable attribute with an existing value
   is NOT matched, the server SHALL respond with an HTTP response code
   of 400 and an apprpriate human readable message indicating an attempt
   to change an immutable attribute.

   Unless otherwise specified a successful PUT operation returns a 200
   OK response code and the entire resource within the response body,
   enabling the client to correlate the client's and Provider's views of
   the updated resource.  Example:

I admit, the wording could be better. But let's get the draft in tonig= ht. 


On 2014-02-12, at 3:36 PM, Bill Mills <wmills@yahoo-inc.com> wrote:

Makes sense.  Need to specify the failure for omitted required attribu= tes and attempts to change immutable things.

 
-bill


--------------------------------
William J. Mills
"Paranoid" Yahoo!



On Wednesday, February 12,= 2014 3:17 PM, Phil Hunt <phil.hunt@oracle.com> wrote:
Yes.  I was just thinking that.  "= required" means that the client MUST provide it. So a SP could say the= password is required.

How about the following table of impacts based on mutability of attrib= utes in a PUT operation:

When submitting attributes via t= he PUT request, attribute "mutability" will have the following im= pacts:
  • readWrite, writeOnly - Any values= provided replace the existing values. Omitting the attribute or specific v= alues means the attribute or values are to be removed.
  • immutable - Any values provided MUST match= the existing values. An omission of the attribute will not remove the exis= ting value(s).
  • readOnl= y - Any values provided (e.g. meta.resourceType) will be ignored.

If an attribute is "require= d", the client MUST specify the attribute in a PUT request. 

Does this work?

Phil

@independentid
phil.hunt@oracle.com=

On 2014-02-12, at 2:18 PM, Bill Mills <wmills_92105@yahoo.com> wrote:

Yeah, WriteOnly needs thought, we don't want to end up with PUT = transactions deleting passwords.  Passwords perhaps might need a "= ;required" attribute which means that a PUT that doesn't include it wo= uld fail.



On Wednesday, February 12,= 2014 1:19 PM, Phil Hunt <phil.hunt@oracle.com> wrote:
Bill,

Thanks for the proposal.

Looks like we also didn't consider readOnly and writeOnly attributes s= uch as passwords.  

Let me think this aft and I'll put a quick proposal together.


On 2014-02-12, at 12:14 PM, Bill Mills <wmills_92105@yahoo.com> wrote:
My action item from the call: =  Propose language around immutability and PUT.


I don't know w= hether this goes into the definition of immutability or PUT, probably PUT:<= /span>

"<= span style=3D"font-family:HelveticaNeue, 'Helvetica Neue', Helvetica, Arial= , 'Lucida Grande', sans-serif;background-color:transparent;">PUT expects th= e entire object to be present, if the schema includes elements with immutable or ReadOnly elements then the object subm= itted with a PUT MUST include all existing immutable and ReadOnly data. &nb= sp;The server MUST reject the PUT and return an error if the submitted data= for  immutable or ReadOnly el= emets do"


On Wednesday, February 12,= 2014 11:06 AM, Morteza Ansari (moransar) <moransar@cisco.com> wrote:
It should be working now. = Not sure what happened but will set up a new
one for next meeting to ensure this is fixed.


Cheers,
Morteza
On 2/12/14 11:03 AM, "Kelly Grizzle" <kelly.grizzle@sailpoint.com> wrote:

>The link the meeting is not working for me.  It is showing a meeti= ng on
>the 19th.
>
>Morteza, can you send the correct link?
>
>
>-----Original Message-----
>From: scim [mailto:scim-bounces@ietf.org] On Behalf Of Morteza Ansari
>(moransar)
>Sent: Tuesday, February 11, 2014 7:15 PM
>To: Leif Johansson; Phil Hunt
>Cc: scim@ietf.org WG
>Subject: Re: [scim] Call today?
>
>Correct, the next meeting is Wed. Fed. 12th at 11am Pacific time.
>Meeting info is here:
>
>To invite others to join, copy and paste everything below into your
>invitation.
>-------------------------------------------------------
>Meeting information
>-------------------------------------------------------
>Topic: SCIM WG interim
>Date: Every Wednesday, from Wednesday, August 21, 2013 to no end date >Time: 11:00 am, Pacific Daylight Time (San Francisco, GMT-07:00) Meetin= g
>Number: 340 844 711 Meeting Password: (This meeting does not require a<= br clear=3D"none"> >password.)
>
>-------------------------------------------------------
>To start or join the online meeting
>-------------------------------------------------------
>Go to https://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&RT=3DM= iM0
>
>-------------------------------------------------------
>Audio conference information
>-------------------------------------------------------
>To receive a call back, provide your phone number when you join the
>meeting, or call the number below and enter the access code.
>US Toll free: 1-855-797-9485
>US Toll: +1-415-655-0002
>Global call-in numbers:
>https://go.webex.com/go/globalcallin.php?serviceType=3DMC&ED=3D15319= 3777&tollF
>r
>ee=3D1
>Toll-free dialing restrictions:
>http://www.webex.com/pdf/tollfree= _restrictions.pdf
>
>Access code:340 844 711
>
>-------------------------------------------------------
>For assistance
>-------------------------------------------------------
>1. Go to https://go.webex.com/go/mc
>2. On the left navigation bar, click "Support".
>To add this meeting to your calendar program (for example Microsoft
>Outlook), click this link:
>https://go.webex.com/go/j.php?ED=3D153193777&UID= =3D483472947&ICS=3DMS&LD=3D1&RD=3D2&
>S
>T=3D1&SHA2=3DAAAAAXFmPcl25G51pP-VAnTUIPjOJqt0XNEPVKSSFdjwCd-F
>
>To check whether you have the appropriate players installed for UCF
>(Universal Communications Format) rich media files, go to
>https://go.webex.com/go/systemdiagnosis.= php.
>
>http://www.webex.com <http://www.webex.com/>
>
>CCM:+14156550002x340844711#
>
>IMPORTANT NOTICE: This WebEx service includes a feature that allows aud= io
>and any documents and other materials exchanged or viewed during the >session to be recorded. You should inform all meeting attendees prior t= o
>recording if you intend to record the meeting. Please note that any suc= h
>recordings may be subject to discovery in the event of litigation.
>
>
>On 2/5/14 10:39 AM, "Leif Johansson" <leifj@mnt.se> wrote:
>
>>
>>
>>> 5 feb 2014 kl. 18:01 skrev Phil Hunt <phil.hunt@oracle.com>:
>>>
>>> Details?
>>>
>>
>>its next week right?
>>
>>> Phil
>>> _______________________________________________
>>> scim mailing list
>>> scim@ietf.org
>>> https://www.ietf.org/mailman/listinfo/scim
>>_______________________________________________
>>scim mailing list
>>scim@ietf.org
>>https://www.ietf.org/mailman/listinfo= /scim
>
>_______________________________________________
>scim mailing list
>scim@ietf.org
>https://www.ietf.org/mailman/listinfo/sci= m

_______________________________________________
scim mailing list
scim@ietf.org
https://www.ietf.org/mailman/listinfo/scim


_______________________________________________
scim mailing list
scim@ietf.org
https://www.ietf.org/mailman/listinfo/scim

_______________________________________________
scim mailing list
scim@ietf.org
https://www.ietf.org/mailman/listinfo/scim

_______________________________________________
scim mailing list
scim@ietf.org
https://www.ietf.org= /mailman/listinfo/scim


______________________________= _________________
scim mailing list
scim@ietf.org
https://www.ietf.org/mailman/listinfo/scim


_______________________________________________
scim mailing list
scim@ietf.org
https://www.ietf.org= /mailman/listinfo/scim

_______________________________________________
scim mailing list
scim@ietf.org
https://www.ietf.org/mailman/listinfo/scim

--_000_7F12377E9EFC4A38B4280AAF964A4F58nexusgroupcom_-- From nobody Fri Feb 14 04:36:42 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F1B2A1A0249 for ; Fri, 14 Feb 2014 04:36:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.6 X-Spam-Level: X-Spam-Status: No, score=-1.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ACLVl-S96Obp for ; Fri, 14 Feb 2014 04:36:31 -0800 (PST) Received: from mout.gmx.net (mout.gmx.net [212.227.15.19]) by ietfa.amsl.com (Postfix) with ESMTP id 5EE581A015B for ; Fri, 14 Feb 2014 04:36:31 -0800 (PST) Received: from [192.168.1.103] ([217.91.35.233]) by mail.gmx.com (mrgmx102) with ESMTPSA (Nemesis) id 0MZwYd-1VtAkd0LjL-00Lp8f for ; Fri, 14 Feb 2014 13:36:29 +0100 Message-ID: <52FE0DC2.1020508@gmx.de> Date: Fri, 14 Feb 2014 13:36:18 +0100 From: Julian Reschke User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.3.0 MIME-Version: 1.0 To: =?windows-1252?Q?Erik_Wahlstr=F6m?= , Phil Hunt References: <7F7F895E-455D-450D-876E-B6AB466599D6@mnt.se> <118dcf276c044f26adc85c3051dddd29@BN1PR04MB392.namprd04.prod.outlook.com> <1392236062.76159.YahooMailNeo@web142802.mail.bf1.yahoo.com> <58399EA7-DEB6-4EEC-8A85-21D2B133A626@oracle.com> <1392243505.21463.YahooMailNeo@web142804.mail.bf1.yahoo.com> <69B8BD7C-7602-490E-9562-CC701B8BABA2@oracle.com> <1392248216.74499.YahooMailNeo@web125604.mail.ne1.yahoo.com> <1392249705.25887.YahooMailNeo@web125602.mail.ne1.yahoo.com> <7F12377E-9EFC-4A38-B428-0AAF964A4F58@nexusgroup.com> In-Reply-To: <7F12377E-9EFC-4A38-B428-0AAF964A4F58@nexusgroup.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit X-Provags-ID: V03:K0:G4GVnTP7zNTZeSc8dNFkhgf6n3p/itqsibG8EygvN0zwttaQWAs ZzesXkO/Y1lqiWeQyXHQ9/9IGBpK4WrQUgFg5f7VvCMUW9+vuFXO4/oOnSOHTDe5HQYuZ/B P2HDYG/MN1qaPzJAvFzKJVY7M7uIkMBdbSO7qRdl5URDHZyc2mYOHTZaLpgyonfFKxpbQ02 iOKTaHDDs0xV3RH0DOE6g== Archived-At: http://mailarchive.ietf.org/arch/msg/scim/O5N8sPadOpruNoGRdjMoDVuvfmo Cc: Leif Johansson , "Morteza Ansari \(moransar\)" , "scim@ietf.org WG" , Bill Mills , Kelly Grizzle , Bill Mills Subject: [scim] PUT sematics, Re: Call today? X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Feb 2014 12:36:33 -0000 On 2014-02-14 12:45, Erik Wahlström wrote: > ... > I would prefer to just ignore attributes that’s not set and use PATCH if > you would like to delete certain attributes. Just as it was before. In > the early days, pre-ietf versions of documents, we also had a password > endpoint that was later removed. > ... PUT is not for partial updates. So if you don't want full updates, why don't you use PATCH right away? Best regards, Julian From nobody Fri Feb 14 04:57:32 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9A12E1A0222 for ; Fri, 14 Feb 2014 04:57:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.149 X-Spam-Level: X-Spam-Status: No, score=-2.149 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Cb3qH_K9iwop for ; Fri, 14 Feb 2014 04:57:28 -0800 (PST) Received: from smtp.nexusgroup.com (smtp.nexusgroup.com [83.241.133.120]) by ietfa.amsl.com (Postfix) with ESMTP id 24B6B1A00FB for ; Fri, 14 Feb 2014 04:57:27 -0800 (PST) Received: from NG-EX04.ad.nexusgroup.com (10.75.28.9) by NG-EX01.ad.nexusgroup.com (10.75.28.40) with Microsoft SMTP Server (TLS) id 15.0.775.38; Fri, 14 Feb 2014 13:57:06 +0100 Received: from NG-EX02.ad.nexusgroup.com (10.75.28.43) by NG-EX04.ad.nexusgroup.com (10.75.28.9) with Microsoft SMTP Server (TLS) id 15.0.775.38; Fri, 14 Feb 2014 13:57:06 +0100 Received: from NG-EX02.ad.nexusgroup.com ([fe80::2839:3494:59f1:44d]) by NG-EX02.ad.nexusgroup.com ([fe80::2839:3494:59f1:44d%12]) with mapi id 15.00.0775.031; Fri, 14 Feb 2014 13:57:06 +0100 From: =?Windows-1252?Q?Erik_Wahlstr=F6m?= To: Julian Reschke Thread-Topic: PUT sematics, Re: [scim] Call today? Thread-Index: AQHPIpP2K7lK2jk4U0at/bbhPxsY85qm7UmAgAncZYCAASqygIAAAKeAgAATFgCAABIlgIAAEISAgAAQhYCAAAVrAIAABQIAgAAB7YCAAAJoAIACVHcAgAAORwCAAAXRgA== Date: Fri, 14 Feb 2014 12:57:05 +0000 Message-ID: <533BC9A4-9054-4761-B16A-76D98EF1928A@nexusgroup.com> References: <7F7F895E-455D-450D-876E-B6AB466599D6@mnt.se> <118dcf276c044f26adc85c3051dddd29@BN1PR04MB392.namprd04.prod.outlook.com> <1392236062.76159.YahooMailNeo@web142802.mail.bf1.yahoo.com> <58399EA7-DEB6-4EEC-8A85-21D2B133A626@oracle.com> <1392243505.21463.YahooMailNeo@web142804.mail.bf1.yahoo.com> <69B8BD7C-7602-490E-9562-CC701B8BABA2@oracle.com> <1392248216.74499.YahooMailNeo@web125604.mail.ne1.yahoo.com> <1392249705.25887.YahooMailNeo@web125602.mail.ne1.yahoo.com> <7F12377E-9EFC-4A38-B428-0AAF964A4F58@nexusgroup.com> <52FE0DC2.1020508@gmx.de> In-Reply-To: <52FE0DC2.1020508@gmx.de> Accept-Language: en-US, sv-SE Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.75.28.115] Content-Type: text/plain; charset="Windows-1252" Content-ID: <667EA68609E7DD4AB4B7A361C90220D8@nexusgroup.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: http://mailarchive.ietf.org/arch/msg/scim/WETs9crkvwIlPc5qJMDQmENd7fM Cc: Leif Johansson , Bill Mills , "scim@ietf.org WG" , Bill Mills , Kelly Grizzle , "Morteza Ansari \(moransar\)" , Phil Hunt Subject: Re: [scim] PUT sematics, Re: Call today? X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Feb 2014 12:57:30 -0000 A very good point. Thanks :) / Erik On 14 Feb 2014, at 13:36, Julian Reschke wrote: > On 2014-02-14 12:45, Erik Wahlstr=F6m wrote: >> ... >> I would prefer to just ignore attributes that=92s not set and use PATCH = if >> you would like to delete certain attributes. Just as it was before. In >> the early days, pre-ietf versions of documents, we also had a password >> endpoint that was later removed. >> ... >=20 > PUT is not for partial updates. So if you don't want full updates, why do= n't you use PATCH right away? >=20 > Best regards, Julian From nobody Fri Feb 14 06:34:52 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C94791A025C for ; Fri, 14 Feb 2014 06:34:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.277 X-Spam-Level: X-Spam-Status: No, score=-1.277 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YSONl1YZj7fg for ; Fri, 14 Feb 2014 06:34:44 -0800 (PST) Received: from mail-pd0-f198.google.com (mail-pd0-f198.google.com [209.85.192.198]) by ietfa.amsl.com (Postfix) with ESMTP id F26991A0291 for ; Fri, 14 Feb 2014 06:34:33 -0800 (PST) Received: by mail-pd0-f198.google.com with SMTP id v10so25674229pde.9 for ; Fri, 14 Feb 2014 06:34:32 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:date:message-id:subject:from:to :content-type; bh=MmZ938n0EjtnUyRR6ZAiJ/whourr88MBawOUA1uPElA=; b=M2e6UPDu+qZ2iLlgK7bfJCi6ULpY/Ku4w2qaUiVkyvSM6UMcsZ5Jfm0tXR5s7b6QzC PMRb1LzXiGj0H/dm+TJDvY8bOQkmAk9w9z1IyI3wftH13IVQI6cKKxaSJdD2TDDkrvIG WuPzDXbbeABpTof3KgVMcUIZ+WgdxHwWvM/z+oXM9Kk9ePmUhBxpH0vuweodAw96lM5d wF5wLVEZ35tvooEF1K4HvNu9n4IonbDD/Q2dva2SEaMJyVanki+OKED7t86Uv9pwKjFX e4BxpBPyjauCRzS3Iqq0Q8ytWtN0gvEuumA3oQBjvL++iofDIwTSgJrVvNJWH1QwkzQS eXvw== X-Gm-Message-State: ALoCoQlAzl2p7GAIsGg1x/feFQfAiCLXz8zJiEGAh7ilBrPYqNs/UFp5nT8dsKDFjN97oX2DhQOg MIME-Version: 1.0 X-Received: by 10.66.193.202 with SMTP id hq10mr9382750pac.57.1392388472448; Fri, 14 Feb 2014 06:34:32 -0800 (PST) Received: by 10.66.67.41 with HTTP; Fri, 14 Feb 2014 06:34:32 -0800 (PST) Date: Fri, 14 Feb 2014 15:34:32 +0100 Message-ID: From: David Moebius To: "scim@ietf.org" Content-Type: multipart/alternative; boundary=047d7bf1603a4a3f5c04f25eb43b Archived-At: http://mailarchive.ietf.org/arch/msg/scim/IVb92n4n0L4rf-D_5pl0FIsOQso Subject: [scim] querys with pr X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Feb 2014 14:34:51 -0000 --047d7bf1603a4a3f5c04f25eb43b Content-Type: text/plain; charset=ISO-8859-1 Hello, one question about queriing with "pr" and the aspected behavior. Setup: I have 2 Users in my database. 1. a minimal User with just a few fields and no extension at all 2. a user who has extensions and the extension field "gender" is filled with "male" 3. a user who has extensions and the extension field "gender" is filled with "female" Query: I have a query filter=not ( extension.gender pr "male") Result: With this query I get User 3 but not user 1 since user 1 doesn't has the field gender at all. Question: Do you think this (sql) behavior is correct or should user 1 also be returned. By David --047d7bf1603a4a3f5c04f25eb43b Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
Hello,

one question about queriing with= "pr" and the aspected behavior.

Setup:<= /div>
I have 2 Users in my database.

1. a mini= mal User with just a few fields and no extension at all
2. a user who has extensions and the extension field "gender"= ; is filled with "male"
3. a user who has extensions an= d the extension field "gender" is filled with "female"<= br>

Query:
I have a query
filter= =3Dnot ( extension.gender pr "male")

Res= ult:
With this query I get User 3 but not user 1 since user 1 doe= sn't has the field gender at all.

Question:
Do you think this (sql) behavior is= correct or should user 1 also be returned.

By Dav= id

--047d7bf1603a4a3f5c04f25eb43b-- From nobody Fri Feb 14 07:02:46 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8ABB91A026E for ; Fri, 14 Feb 2014 07:02:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.023 X-Spam-Level: * X-Spam-Status: No, score=1.023 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MANGLED_WANT=2.3, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UUI9T30sip-x for ; Fri, 14 Feb 2014 07:02:42 -0800 (PST) Received: from mail-pd0-f199.google.com (mail-pd0-f199.google.com [209.85.192.199]) by ietfa.amsl.com (Postfix) with ESMTP id 94E0B1A0253 for ; Fri, 14 Feb 2014 07:02:42 -0800 (PST) Received: by mail-pd0-f199.google.com with SMTP id fp1so24820336pdb.10 for ; Fri, 14 Feb 2014 07:02:41 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:date:message-id:subject:from:to :content-type; bh=KjcBxN++0AI+sp6ZrUIDzy5K/Ho7viX6oRo5dWpEXGE=; b=juYKbUKRmLnkJARXicx0ynEbXuV9Z8Sz685/Qp0es9WvcBhP8ZkGuuFhis9y1SI7fX 058oyeqN9AJUu8syO73X5/Uq3TBgXi2NOSjTVKhwEP+4hxR0zvR89/GKWYfkzo6wlLGu ui570iUYWxFb8N/ALxyXqSwTYlRsspPtX7amGT2nB+mk0BltQzx3ueFhUMMdWUtxztnK QimuU8PrTxwPHcgC+gra2mvwVDXtqPq1w0fcM0z7neaqJ2V8j19ubgIxqm9SUUgmAZeX tfuv+KN+JH7JhotQ8nkuQ+h/mqGMyuP9POHeQeAfTiKIzY08HbT9ybHa5YXzjtA8tqwT LdyQ== X-Gm-Message-State: ALoCoQm52doXRooISEDUDYQA+BUgtNuiGj6LwRCgQaomETV2So3ZeSxY9Bvim6mrD6a0oydWEEc0 MIME-Version: 1.0 X-Received: by 10.68.14.130 with SMTP id p2mr9705166pbc.17.1392390161003; Fri, 14 Feb 2014 07:02:41 -0800 (PST) Received: by 10.66.67.41 with HTTP; Fri, 14 Feb 2014 07:02:40 -0800 (PST) Date: Fri, 14 Feb 2014 16:02:40 +0100 Message-ID: From: David Moebius To: "scim@ietf.org" Content-Type: multipart/alternative; boundary=bcaec51f8e89ef93a504f25f180b Archived-At: http://mailarchive.ietf.org/arch/msg/scim/W6OdgjCYhPbBTS-5Sxf0p2Qf5h4 Subject: [scim] extension part of the schemas while deleting them? X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Feb 2014 15:02:44 -0000 --bcaec51f8e89ef93a504f25f180b Content-Type: text/plain; charset=ISO-8859-1 Hi, Ich I wan't to send an extension with a json string we need the urn of the extension as part of the schema definition at top of the file. If I want to delete a extension or a extensionfield I need to put the extension in the meta attribute list. Do I still need to set the extension urn in the schema list? Reason for Yes! I'm working with the extension and so I need to set the urn in the schema list Reason for No! I'm not sending a actual extension object and so I don't need to send the extension as part of the schema list. (Actual when doing so. JBos telling us the Json file is not correct) What is your suggestion? David --bcaec51f8e89ef93a504f25f180b Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
Hi,

Ich I wan't to send an extensio= n with a json string we need the urn of the extension as part of the schema= definition at top of the file.

If I want to delet= e a extension or a extensionfield I need to put the extension in the meta a= ttribute list.
Do I still need to set the extension urn in the schema list?

Reason for Yes!
I'm working with the extensio= n and so I need to set the urn in the schema list

Reason for No!
I'm not sending a actual extension object and = so I don't need to send the extension as part of the schema list.
=
(Actual when doing so. JBos telling us the Json file is not correct)

What is your suggestion?

David=
--bcaec51f8e89ef93a504f25f180b-- From nobody Fri Feb 14 08:55:50 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 444461A0309 for ; Fri, 14 Feb 2014 08:55:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.749 X-Spam-Level: X-Spam-Status: No, score=-4.749 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uw5adoaxU-uT for ; Fri, 14 Feb 2014 08:55:41 -0800 (PST) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) by ietfa.amsl.com (Postfix) with ESMTP id 060541A0306 for ; Fri, 14 Feb 2014 08:55:40 -0800 (PST) Received: from acsinet22.oracle.com (acsinet22.oracle.com [141.146.126.238]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s1EGtak2011639 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Fri, 14 Feb 2014 16:55:36 GMT Received: from userz7021.oracle.com (userz7021.oracle.com [156.151.31.85]) by acsinet22.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1EGtVc9019532 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Fri, 14 Feb 2014 16:55:32 GMT Received: from abhmp0019.oracle.com (abhmp0019.oracle.com [141.146.116.25]) by userz7021.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1EGtVs3029825; Fri, 14 Feb 2014 16:55:31 GMT Received: from [192.168.1.124] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 14 Feb 2014 08:55:30 -0800 Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\)) From: Phil Hunt In-Reply-To: <52FE0DC2.1020508@gmx.de> Date: Fri, 14 Feb 2014 08:55:28 -0800 Content-Transfer-Encoding: quoted-printable Message-Id: References: <7F7F895E-455D-450D-876E-B6AB466599D6@mnt.se> <118dcf276c044f26adc85c3051dddd29@BN1PR04MB392.namprd04.prod.outlook.com> <1392236062.76159.YahooMailNeo@web142802.mail.bf1.yahoo.com> <58399EA7-DEB6-4EEC-8A85-21D2B133A626@oracle.com> <1392243505.21463.YahooMailNeo@web142804.mail.bf1.yahoo.com> <69B8BD7C-7602-490E-9562-CC701B8BABA2@oracle.com> <1392248216.74499.YahooMailNeo@web125604.mail.ne1.yahoo.com> <1392249705.25887.YahooMailNeo@web125602.mail.ne1.yahoo.com> <7F12377E-9EFC-4A38-B428-0AAF964A4F58@nexusgroup.com> <52FE0DC2.1020508@gmx.de> To: Julian Reschke X-Mailer: Apple Mail (2.1510) X-Source-IP: acsinet22.oracle.com [141.146.126.238] Archived-At: http://mailarchive.ietf.org/arch/msg/scim/CVvN0QEHMtZz_dJnm5TOWSE5MUA Cc: Leif Johansson , Bill Mills , "scim@ietf.org WG" , Bill Mills , Kelly Grizzle , =?windows-1252?Q?Erik_Wahlstr=F6m?= , "Morteza Ansari \(moransar\)" Subject: Re: [scim] PUT sematics, Re: Call today? X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Feb 2014 16:55:44 -0000 The trick here is to have good definitions on what immutability and = writeOnly means in the context of PUT so that the action remains as much = as possible a record swap. Does the record "id" need to be provided? = Does the password need to be provided? Can the client update record = meta data? There is some cause for discussion to clarify that a missing writeOnly = attribute does not necessarily clear the value in the SP. But that means = that clients can't clear passwords (would they ever want to do this?). = What if the writeOnly attribute was a security question or credit card? = Does it make sense for any future writeOnly attribute, or is this issue = specific to passwords? [ BTW This is just clearly another reason to = kill passwords :-) ] I think the current spec is pretty good now. It can handle two different = policies by the service provider. A. The SP could set the password attribute to mutability=3Dimmutable and = returned=3Dnever to create the effect of not requiring the client to = know the password on a PUT. However, this means that the client could = never update the password once set. B. (the default) If a password is returned=3Dnever and = mutability=3DwriteOnly, then the effect will be that a PUT will clear = the password if not provided. Note: a service provider could simply = set a policy to ignore the value on PUT anyway. Phil @independentid www.independentid.com phil.hunt@oracle.com On 2014-02-14, at 4:36 AM, Julian Reschke wrote: > On 2014-02-14 12:45, Erik Wahlstr=F6m wrote: >> ... >> I would prefer to just ignore attributes that=92s not set and use = PATCH if >> you would like to delete certain attributes. Just as it was before. = In >> the early days, pre-ietf versions of documents, we also had a = password >> endpoint that was later removed. >> ... >=20 > PUT is not for partial updates. So if you don't want full updates, why = don't you use PATCH right away? >=20 > Best regards, Julian From nobody Fri Feb 14 09:07:56 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 935321A031C for ; Fri, 14 Feb 2014 09:07:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.935 X-Spam-Level: X-Spam-Status: No, score=-0.935 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_ADSP_CUSTOM_MED=0.001, DKIM_SIGNED=0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, FREEMAIL_REPLYTO_END_DIGIT=0.25, HTML_MESSAGE=0.001, NML_ADSP_CUSTOM_MED=0.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.548, T_DKIM_INVALID=0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cveSnbKSuxOK for ; Fri, 14 Feb 2014 09:07:46 -0800 (PST) Received: from nm40-vm4.bullet.mail.bf1.yahoo.com (nm40-vm4.bullet.mail.bf1.yahoo.com [72.30.239.212]) by ietfa.amsl.com (Postfix) with ESMTP id BA9821A0361 for ; Fri, 14 Feb 2014 09:07:45 -0800 (PST) Received: from [98.139.215.140] by nm40.bullet.mail.bf1.yahoo.com with NNFMP; 14 Feb 2014 17:07:44 -0000 Received: from [98.139.212.211] by tm11.bullet.mail.bf1.yahoo.com with NNFMP; 14 Feb 2014 17:07:44 -0000 Received: from [127.0.0.1] by omp1020.mail.bf1.yahoo.com with NNFMP; 14 Feb 2014 17:07:44 -0000 X-Yahoo-Newman-Property: ymail-3 X-Yahoo-Newman-Id: 5771.30273.bm@omp1020.mail.bf1.yahoo.com Received: (qmail 42507 invoked by uid 60001); 14 Feb 2014 17:07:43 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1392397663; bh=s8nq/XAa+3GsHp/YqFtOh2VIp+dNv9wiNyukTzXKGhU=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=nVmEqX9JVX5X3Ajk49CpjNBThA/neAG+n2Ll0o2r6FgydD4N81NKp7hxeiUAjgIXtDMwGL1rfQyE18UI+UMUft6l1EvvDhicBsBoiyQibIywzGyExVm41SyanPmN1jxNjcNFRJjw3xTwJMx/pIqNdRjfsXVouw7SPGWQFI/HCHs= DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=Ncw4WRPuopDFNGWenUfVv/ONJaDKV+pR6yygIVjhtR8WkRcpjHTch15S/X8nFnmTZKAj5VhYoju7DD8MH1L0rTlUAKu69bECWraMo/m2T0owv7wOZ+wInqO+7Y6uuWbOizM/b/J/5K3V+/CxwLE28PZejQbtfGrKoUhE0EiHLbM=; X-YMail-OSG: fHJRm0gVM1m3Eaxmvh6T3HAMe9Ea7XlIhWel.T6GTYxx3Jt 9zDO_ntazbR._r5sLQnUBG30k5Y2FsqoJvDMEUbTbVrjh7hzBoL3cvONEN3n tlb3fvFJlTpAQDSH9ARZdaM_IphuGca7K9MMH6TS30in1GGszyS4f_9U8LvO SMp_a8Dd7pmrDw6Pu8xxt1gG.MLxu3W5H5FziyWWxJwQ8gX3UK6dQw53Hfzr 0Z8hI3be9kxJDnWhul3ODsotm9bDA9EDmIFxZbPZoky4XsoTyAdLoTCqZ1Rc 8Jkkf9CfSCfzF.VDyO9sBsH59eHbwpFnJ6cqeyXyj.NLmJEIqHPmcoUSCoq_ xljrhb_WX_fwrowzlaM_oTq6I0jS3tr2ujv5IEkyoUPp0NbXlnDdAFcGoysj HNl2zvtQOToJfSdgM5yutHHgm7Q2Gc2bVbmQfAkHDs61RPvylVgf7CCAinvz tvnRmlq3Bn.u7wp9WODcXccg0MvpH3MpiHULep09DDIybq7uXF4x.qNdTzu3 NCgwNlXphTvlWehWvduF54fAghYyA3ZTbcpIrn95Y3o4yx0t3MAmtPxT87mx 9F_nvVdIafc5gRU5mlPYI0H6kqyP.O2f3u_TOZ28lHb2GQT6nWXE7E0s0PhT aO6zU550XkDlqsoBDCL0FWg6zQug- Received: from [99.31.212.42] by web142803.mail.bf1.yahoo.com via HTTP; Fri, 14 Feb 2014 09:07:43 PST X-Rocket-MIMEInfo: 002.001, SSBzdXNwZWN0IFBVVCBpcyBsaWtlbHkgdG8gYmUgcmFyZWx5IHVzZWQsIG9ubHkgaW4gY2FzZSBvZiBhIGZ1bGwgc3luYyBuZWVkZWQuCgoKCk9uIEZyaWRheSwgRmVicnVhcnkgMTQsIDIwMTQgODo1NSBBTSwgUGhpbCBIdW50IDxwaGlsLmh1bnRAb3JhY2xlLmNvbT4gd3JvdGU6CiAKVGhlIHRyaWNrIGhlcmUgaXMgdG8gaGF2ZSBnb29kIGRlZmluaXRpb25zIG9uIHdoYXQgaW1tdXRhYmlsaXR5IGFuZCB3cml0ZU9ubHkgbWVhbnMgaW4gdGhlIGNvbnRleHQgb2YgUFVUIHNvIHRoYXQgdGhlIGFjdGlvbiByZW0BMAEBAQE- X-Mailer: YahooMailWebService/0.8.177.636 References: <7F7F895E-455D-450D-876E-B6AB466599D6@mnt.se> <118dcf276c044f26adc85c3051dddd29@BN1PR04MB392.namprd04.prod.outlook.com> <1392236062.76159.YahooMailNeo@web142802.mail.bf1.yahoo.com> <58399EA7-DEB6-4EEC-8A85-21D2B133A626@oracle.com> <1392243505.21463.YahooMailNeo@web142804.mail.bf1.yahoo.com> <69B8BD7C-7602-490E-9562-CC701B8BABA2@oracle.com> <1392248216.74499.YahooMailNeo@web125604.mail.ne1.yahoo.com> <1392249705.25887.YahooMailNeo@web125602.mail.ne1.yahoo.com> <7F12377E-9EFC-4A38-B428-0AAF964A4F58@nexusgroup.com> <52FE0DC2.1020508@gmx.de> Message-ID: <1392397663.34391.YahooMailNeo@web142803.mail.bf1.yahoo.com> Date: Fri, 14 Feb 2014 09:07:43 -0800 (PST) From: Bill Mills To: Phil Hunt , Julian Reschke In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="905790552-419223267-1392397663=:34391" Archived-At: http://mailarchive.ietf.org/arch/msg/scim/xNbl1hQ9tzuCrDwLAyFBJ4TArsk Cc: Leif Johansson , "scim@ietf.org WG" , Bill Mills , Kelly Grizzle , =?utf-8?B?RXJpayBXYWhsc3Ryw7Zt?= , "Morteza Ansari \(moransar\)" Subject: Re: [scim] PUT sematics, Re: Call today? X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: Bill Mills List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Feb 2014 17:07:47 -0000 --905790552-419223267-1392397663=:34391 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable I suspect PUT is likely to be rarely used, only in case of a full sync need= ed.=0A=0A=0A=0AOn Friday, February 14, 2014 8:55 AM, Phil Hunt wrote:=0A =0AThe trick here is to have good definitions on what = immutability and writeOnly means in the context of PUT so that the action r= emains as much as possible a record swap.=C2=A0 Does the record "id" need t= o be provided?=C2=A0 Does the password need to be provided?=C2=A0 Can the c= lient update record meta data?=0A=0AThere is some cause for discussion to c= larify that a missing writeOnly attribute does not necessarily clear the va= lue in the SP. But that means that clients can't clear passwords (would the= y ever want to do this?).=C2=A0 What if the writeOnly attribute was a secu= rity question or credit card?=C2=A0 Does it make sense for any future write= Only attribute, or is this issue specific to passwords?=C2=A0 [ BTW This is= just clearly another reason to kill passwords=C2=A0 :-) ]=0A=0AI think the= current spec is pretty good now. It can handle two different policies by t= he service provider.=0A=0AA. The SP could set the password attribute to mut= ability=3Dimmutable and returned=3Dnever to create the effect of not requir= ing the client to know the password on a PUT. However, this means that the = client could never update the password once set.=0A=0AB. (the default) If a= password is returned=3Dnever and mutability=3DwriteOnly, then the effect w= ill be that a PUT will clear the password if not provided.=C2=A0 Note:=C2= =A0 a service provider could simply set a policy to ignore the value on PUT= anyway.=0A=0A=0APhil=0A=0A@independentid=0Awww.independentid.com=0Aphil.hu= nt@oracle.com=0A=0A=0AOn 2014-02-14, at 4:36 AM, Julian Reschke wrote:=0A=0A> On 2014-02-14 12:45, Erik Wahlstr=C3=B6m wrote:= =0A>> ...=0A>> I would prefer to just ignore attributes that=E2=80=99s not = set and use PATCH if=0A>> you would like to delete certain attributes. Just= as it was before. In=0A>> the early days, pre-ietf versions of documents, = we also had a password=0A>> endpoint that was later removed.=0A>> ...=0A> = =0A> PUT is not for partial updates. So if you don't want full updates, why= don't you use PATCH right away?=0A> =0A> Best regards, Julian --905790552-419223267-1392397663=:34391 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
I suspect PUT is likely to be rarely used, only in= case of a full sync needed.


On Friday, February 14, 2014 8:55 AM, Ph= il Hunt <phil.hunt@oracle.com> wrote:
The trick here is to have good definitions on what imm= utability and writeOnly means in the context of PUT so that the action rema= ins as much as possible a record swap.  Does the record "id" need to b= e provided?  Does the password need to be provided?  Can the clien= t update record meta data?

There is so= me cause for discussion to clarify that a missing writeOnly attribute does = not necessarily clear the value in the SP. But that means that clients can'= t clear passwords (would they ever want to do this?).  What if the wr= iteOnly attribute was a security question or credit card?  Does it mak= e sense for any future writeOnly attribute, or is this issue specific to pa= sswords?  [ BTW This is just clearly another reason to kill passwords&= nbsp; :-) ]

I think the current spec i= s pretty good now. It can handle two different policies by the service prov= ider.

A. The SP could set the password= attribute to mutability=3Dimmutable and returned=3Dnever to create the eff= ect of not requiring the client to know the password on a PUT. However, thi= s means that the client could never update the password once set.

B. (the default) If a password is returned=3Dnever and= mutability=3DwriteOnly, then the effect will be that a PUT will clear the = password if not provided.  Note:  a service provider could simply= set a policy to ignore the value on PUT anyway.


Phil

@in= dependentid
www.independentid.com
phil.hunt@oracle.com

On 2014-02-14, at 4:36 AM,= Julian Reschke <julian.reschke@gmx.de> wro= te:

> On 2014-02-14 12:45, Erik Wah= lstr=C3=B6m wrote:
>> ...
>> I would prefer to just ignore attributes th= at=E2=80=99s not set and use PATCH if
>> you would = like to delete certain attributes. Just as it was before. In
>> the early days, pre-ietf versions of documents, we also had a = password
>> endpoint that was later removed.
>> ...
>
> PUT= is not for partial updates. So if you don't want full updates, why don't y= ou use PATCH right away?
>
> Bes= t regards, Julian


--905790552-419223267-1392397663=:34391-- From nobody Fri Feb 14 09:19:45 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B5DD11A028B for ; Fri, 14 Feb 2014 09:19:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.748 X-Spam-Level: X-Spam-Status: No, score=-4.748 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kier4tKBqbdl for ; Fri, 14 Feb 2014 09:19:41 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) by ietfa.amsl.com (Postfix) with ESMTP id F21131A01F2 for ; Fri, 14 Feb 2014 09:19:40 -0800 (PST) Received: from ucsinet22.oracle.com (ucsinet22.oracle.com [156.151.31.94]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s1EHJcOH026808 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Fri, 14 Feb 2014 17:19:39 GMT Received: from aserz7021.oracle.com (aserz7021.oracle.com [141.146.126.230]) by ucsinet22.oracle.com (8.14.5+Sun/8.14.5) with ESMTP id s1EHJbpl019664 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 14 Feb 2014 17:19:38 GMT Received: from abhmp0017.oracle.com (abhmp0017.oracle.com [141.146.116.23]) by aserz7021.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1EHJb9A018650; Fri, 14 Feb 2014 17:19:37 GMT Received: from [192.168.1.124] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 14 Feb 2014 09:19:37 -0800 Content-Type: multipart/alternative; boundary="Apple-Mail=_58A11EB4-256E-4C26-B8FB-B6C50A02CF37" Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\)) From: Phil Hunt In-Reply-To: Date: Fri, 14 Feb 2014 09:19:35 -0800 Message-Id: <4D5BA2C0-4E8E-4DDA-A552-1A88119DDF45@oracle.com> References: To: David Moebius X-Mailer: Apple Mail (2.1510) X-Source-IP: ucsinet22.oracle.com [156.151.31.94] Archived-At: http://mailarchive.ietf.org/arch/msg/scim/S1VekthWUG6PAqDIamFnR_63Zf4 Cc: "scim@ietf.org" Subject: Re: [scim] querys with pr X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Feb 2014 17:19:44 -0000 --Apple-Mail=_58A11EB4-256E-4C26-B8FB-B6C50A02CF37 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=iso-8859-1 David, The filter doesn't look correct. A correct one would be: filter=3Dnot(extension.gender pr) Should return record 1 since record 2 and 3 have a gender present. A filter of: filter=3Dnot(extension.gender pr or extension.gender eq "male") Would return record 1 and 3 if I have my logic correct. Phil @independentid www.independentid.com phil.hunt@oracle.com On 2014-02-14, at 6:34 AM, David Moebius wrote: > Hello, >=20 > one question about queriing with "pr" and the aspected behavior. >=20 > Setup: > I have 2 Users in my database. >=20 > 1. a minimal User with just a few fields and no extension at all > 2. a user who has extensions and the extension field "gender" is = filled with "male" > 3. a user who has extensions and the extension field "gender" is = filled with "female" >=20 > Query: > I have a query > filter=3Dnot ( extension.gender pr "male") >=20 > Result: > With this query I get User 3 but not user 1 since user 1 doesn't has = the field gender at all. >=20 > Question: > Do you think this (sql) behavior is correct or should user 1 also be = returned. >=20 > By David >=20 > _______________________________________________ > scim mailing list > scim@ietf.org > https://www.ietf.org/mailman/listinfo/scim --Apple-Mail=_58A11EB4-256E-4C26-B8FB-B6C50A02CF37 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=iso-8859-1

Would return record = 1 and 3 if I have my logic correct.


On 2014-02-14, at 6:34 AM, David Moebius <d.moebius@tarent.de> = wrote:

Hello,

one question = about queriing with "pr" and the aspected = behavior.

Setup:
I have 2 Users in my = database.

1. a minimal User with just a few = fields and no extension at all
2. a user who has extensions and the extension field "gender" is = filled with "male"
3. a user who has extensions and the = extension field "gender" is filled with "female"

Query:
I have a = query
filter=3Dnot ( extension.gender pr = "male")

Result:
With this query I get = User 3 but not user 1 since user 1 doesn't has the field gender at = all.

Question:
Do you think this (sql) behavior = is correct or should user 1 also be = returned.

By David

_______________________________________________
scim mailing = list
scim@ietf.org
https://www.ietf.org/ma= ilman/listinfo/scim

= --Apple-Mail=_58A11EB4-256E-4C26-B8FB-B6C50A02CF37-- From nobody Fri Feb 14 09:19:55 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EE49A1A02D3 for ; Fri, 14 Feb 2014 09:19:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.246 X-Spam-Level: ** X-Spam-Status: No, score=2.246 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, FREEMAIL_REPLYTO_END_DIGIT=0.25, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.548, TVD_PH_BODY_ACCOUNTS_PRE=2.393] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rVR-VpEcbxsg for ; Fri, 14 Feb 2014 09:19:48 -0800 (PST) Received: from nm13-vm0.bullet.mail.bf1.yahoo.com (nm13-vm0.bullet.mail.bf1.yahoo.com [98.139.213.79]) by ietfa.amsl.com (Postfix) with ESMTP id 716F41A02D1 for ; Fri, 14 Feb 2014 09:19:48 -0800 (PST) Received: from [66.196.81.171] by nm13.bullet.mail.bf1.yahoo.com with NNFMP; 14 Feb 2014 17:19:46 -0000 Received: from [98.139.212.198] by tm17.bullet.mail.bf1.yahoo.com with NNFMP; 14 Feb 2014 17:19:46 -0000 Received: from [127.0.0.1] by omp1007.mail.bf1.yahoo.com with NNFMP; 14 Feb 2014 17:19:46 -0000 X-Yahoo-Newman-Property: ymail-3 X-Yahoo-Newman-Id: 720902.28955.bm@omp1007.mail.bf1.yahoo.com Received: (qmail 48722 invoked by uid 60001); 14 Feb 2014 17:19:46 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1392398386; bh=3whzMyHaKTK3L+L/gA5XdNbfPD8q+W2fv8RUhYlm6h0=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=QVoyBDXvUqEO67976pcV4wXocneL07YEK0JP2Xw9o5Ng1uGehRg3dTFQ30JY/DthDGFW3c+201stFIVPNOr3KBVjC8H/ZPQZ5VKNKiLmh1bP/dN8WnFo89cizJyuK7rqGUnwbaoryCta1r/bWrTtn2ZVrg1qne0HRBwCiA4HGdc= DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=i4sNIXEqVkzOnfMbMxPlAKFENhPN2ukFYD/b6bWDtI4Mpm3I9VM9GI76ganKBZw43e1nYKI592/E0ux3zfHBdannFJFurMn7ehXSAb4E+wLqrsfU49t2UmAecguWzuGMKonRILFtVZC8xqQtMJnvOaep93mAWLRBlmQQSKm48qM=; X-YMail-OSG: XKzdZSsVM1kNrtTNdzLDhh5mQpZCoDXBOnspS.Vr7XnAMOC hw24oSjg_qjZyMVxzo_ters5BoOkZI654nIMvu7e1lI6TvyJ5W2h1WaQL95x RXmriI2ULtyXy19IF0kjt_bQ8coGIYTgLvhstp0364WIiwuy3qLsOciPUfXo p0XMBaHhWxmpFU5HMwhPyBgkM7WIX4re.Liyxq3lQGPo6dD5BHoVE3xg06ys SpXGXhMKwtoA.EVaEQMndZBhQjISWx3GJ1oUPHlqvtSrGh6daenntzHxiXs0 8VIvuWs7eD4xzBeZvA7MpgUgWSAYZmRbQ5Op4PwOzYISljB_gpVeD4d5sQDx l7e4SAHUQYFoZUJHM7r.SE68Cy8ICgfV1504Z9Ts9mprp6BjH8wy05VshcIa P6rNCvAij3jDv65SPtJkDpJXgS6lVj4U90gavvv2ryPDW4F285BzYULmiszo 6nK7vA54JbnF2PoI7crYPemKBCqDlr4demwfKgEwRvDUl_GGoWFOX9xJOHC5 9c263rtttWZLPQuXu7Nr0zXHKPltgIdICx9A5J_nTbC84XJKX5lN82dak2cI TW6UDz6DSRVjqZxt0 Received: from [99.31.212.42] by web142803.mail.bf1.yahoo.com via HTTP; Fri, 14 Feb 2014 09:19:46 PST X-Rocket-MIMEInfo: 002.001, U29tZXRoaW5nIEknbSBub3QgaW4gbG92ZSB3aXRoIGluIFNDSU0gaXMgdGhhdCB5b3UgaGF2ZSB0byBpbmZlciBhY3Rpb25zIGZyb20gZGF0YSBjaGFuZ2VzLiDCoENyZWF0aW9uIGFuZCBkZWxldGlvbiBhcmUgZXhwbGljaXQsIFBVVCBhbmQgUEFUQ0ggZ2V0IGNvbXBsaWNhdGVkLiDCoAoKV2UgaGF2ZSBhIG1vZGVsIHdoZXJlIGFuIGFjY291bnQgbWlnaHQgYmUgc3VzcGVuZGVkIG9yIHJlYWN0aXZhdGVkLCB3aGljaCBpcyBwcmV0dHkgYmFzaWMgYW5kIFBVVC9QQVRDSCB3b3JrcyBmaW5lLCBidXQgd2UgYWwBMAEBAQE- X-Mailer: YahooMailWebService/0.8.177.636 Message-ID: <1392398386.31251.YahooMailNeo@web142803.mail.bf1.yahoo.com> Date: Fri, 14 Feb 2014 09:19:46 -0800 (PST) From: Bill Mills To: "scim@ietf.org" MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="905790552-1761134524-1392398386=:31251" Archived-At: http://mailarchive.ietf.org/arch/msg/scim/5CHepQUAuT0qcJz51Pp6IEi0TGI Subject: [scim] inferring intent vs. explicit declaration.... X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: Bill Mills List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Feb 2014 17:19:50 -0000 --905790552-1761134524-1392398386=:31251 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable Something I'm not in love with in SCIM is that you have to infer actions fr= om data changes. =A0Creation and deletion are explicit, PUT and PATCH get c= omplicated. =A0=0A=0AWe have a model where an account might be suspended or= reactivated, which is pretty basic and PUT/PATCH works fine, but we also m= ight activate or deactivate a nmailbox or other features on the account and= that means I have to have a possibly complex parser looking for state chan= ges in the PUT data to trigger events. =A0There's also the use case where o= ne side needs to signal the other side of an event, like a possible TOS vio= lation or abuse event, a way to implement that would be adding events to a = list and the PATCH operation is checked to see what data is going by. =A0= =0A=0AI'd like something simpler than doing a diff on the entire user state= to get to the action needed. =A0Has this come up before?=0A=0A-bill --905790552-1761134524-1392398386=:31251 Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable
Something I'm not in love with in SCIM is that you have = to infer actions from data changes.  Creation and deletion are explici= t, PUT and PATCH get complicated.  

We have a model where an account might be = suspended or reactivated, which is pretty basic and PUT/PATCH works fine, b= ut we also might activate or deactivate a nmailbox or other features on the= account and that means I have to have a possibly complex parser looking fo= r state changes in the PUT data to trigger events.  There's also the u= se case where one side needs to signal the other side of an event, like a possible TOS violation or abuse event, a way to implement that would be = adding events to a list and the PATCH operation is checked to see what data= is going by.  
I'd like something s= impler than doing a diff on the entire user state to get to the action need= ed.  Has this come up before?

-bil= l
--905790552-1761134524-1392398386=:31251-- From nobody Fri Feb 14 09:22:09 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B09121A02F7 for ; Fri, 14 Feb 2014 09:22:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.448 X-Spam-Level: X-Spam-Status: No, score=-2.448 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MANGLED_WANT=2.3, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id APPMQ6qmbzi5 for ; Fri, 14 Feb 2014 09:22:05 -0800 (PST) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) by ietfa.amsl.com (Postfix) with ESMTP id 3BC8C1A028B for ; Fri, 14 Feb 2014 09:22:04 -0800 (PST) Received: from acsinet21.oracle.com (acsinet21.oracle.com [141.146.126.237]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s1EHM12Z010774 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Fri, 14 Feb 2014 17:22:02 GMT Received: from userz7021.oracle.com (userz7021.oracle.com [156.151.31.85]) by acsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1EHM02S023982 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Fri, 14 Feb 2014 17:22:01 GMT Received: from abhmp0015.oracle.com (abhmp0015.oracle.com [141.146.116.21]) by userz7021.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1EHM0Sg000959; Fri, 14 Feb 2014 17:22:00 GMT Received: from [192.168.1.124] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 14 Feb 2014 09:22:00 -0800 Content-Type: multipart/alternative; boundary="Apple-Mail=_DE6F87EB-8FB3-4B7C-B747-52A05C952F6E" Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\)) From: Phil Hunt In-Reply-To: Date: Fri, 14 Feb 2014 09:21:43 -0800 Message-Id: <87BB3D03-7A4F-4F1D-8047-6382A2F147DB@oracle.com> References: To: David Moebius X-Mailer: Apple Mail (2.1510) X-Source-IP: acsinet21.oracle.com [141.146.126.237] Archived-At: http://mailarchive.ietf.org/arch/msg/scim/Rma06uP3AioHFaEGV-caOa-pR-E Cc: "scim@ietf.org" Subject: Re: [scim] extension part of the schemas while deleting them? X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Feb 2014 17:22:07 -0000 --Apple-Mail=_DE6F87EB-8FB3-4B7C-B747-52A05C952F6E Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=iso-8859-1 As long as extensionfield is sufficiently unique, you should not have to = provide it. Though a client that wants to ensure conflicts can't occur in the future = might want to always use the fully qualified notation. Phil @independentid www.independentid.com phil.hunt@oracle.com On 2014-02-14, at 7:02 AM, David Moebius wrote: > Hi, >=20 > Ich I wan't to send an extension with a json string we need the urn of = the extension as part of the schema definition at top of the file. >=20 > If I want to delete a extension or a extensionfield I need to put the = extension in the meta attribute list. > Do I still need to set the extension urn in the schema list? >=20 > Reason for Yes! > I'm working with the extension and so I need to set the urn in the = schema list >=20 > Reason for No! > I'm not sending a actual extension object and so I don't need to send = the extension as part of the schema list. > (Actual when doing so. JBos telling us the Json file is not correct) >=20 > What is your suggestion? >=20 > David > _______________________________________________ > scim mailing list > scim@ietf.org > https://www.ietf.org/mailman/listinfo/scim --Apple-Mail=_DE6F87EB-8FB3-4B7C-B747-52A05C952F6E Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=iso-8859-1 As = long as extensionfield is sufficiently unique, you should not have to = provide it.

Though a client that wants to ensure = conflicts can't occur in the future might want to always use the fully = qualified notation.

=
On 2014-02-14, at 7:02 AM, David Moebius <d.moebius@tarent.de> = wrote:

Hi,

Ich I wan't to = send an extension with a json string we need the urn of the extension as = part of the schema definition at top of the = file.

If I want to delete a extension or a = extensionfield I need to put the extension in the meta attribute = list.
Do I still need to set the extension urn in the schema = list?

Reason for Yes!
I'm working = with the extension and so I need to set the urn in the schema = list

Reason for No!
I'm not sending a actual extension object and = so I don't need to send the extension as part of the schema = list.
(Actual when doing so. JBos telling us the Json file is = not correct)

What is your = suggestion?

David
_______________________________________________
scim mailing = list
scim@ietf.org
https://www.ietf.org/ma= ilman/listinfo/scim

= --Apple-Mail=_DE6F87EB-8FB3-4B7C-B747-52A05C952F6E-- From nobody Fri Feb 14 09:29:26 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 145021A01E4 for ; Fri, 14 Feb 2014 09:29:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.355 X-Spam-Level: X-Spam-Status: No, score=-2.355 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001, TVD_PH_BODY_ACCOUNTS_PRE=2.393] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pMlwP622fs1F for ; Fri, 14 Feb 2014 09:29:21 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) by ietfa.amsl.com (Postfix) with ESMTP id 427F71A0322 for ; Fri, 14 Feb 2014 09:29:18 -0800 (PST) Received: from acsinet22.oracle.com (acsinet22.oracle.com [141.146.126.238]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s1EHTFsl005379 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Fri, 14 Feb 2014 17:29:16 GMT Received: from aserz7022.oracle.com (aserz7022.oracle.com [141.146.126.231]) by acsinet22.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1EHTFDO011430 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 14 Feb 2014 17:29:15 GMT Received: from abhmp0008.oracle.com (abhmp0008.oracle.com [141.146.116.14]) by aserz7022.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1EHTFMW011423; Fri, 14 Feb 2014 17:29:15 GMT Received: from [192.168.1.124] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 14 Feb 2014 09:29:15 -0800 Content-Type: multipart/alternative; boundary="Apple-Mail=_9926B27F-96F3-40DD-B5D8-385734EFE5B9" Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\)) From: Phil Hunt In-Reply-To: <1392398386.31251.YahooMailNeo@web142803.mail.bf1.yahoo.com> Date: Fri, 14 Feb 2014 09:29:13 -0800 Message-Id: <26C4D44F-8BE4-40F1-88D4-E7B92551A246@oracle.com> References: <1392398386.31251.YahooMailNeo@web142803.mail.bf1.yahoo.com> To: Bill Mills X-Mailer: Apple Mail (2.1510) X-Source-IP: acsinet22.oracle.com [141.146.126.238] Archived-At: http://mailarchive.ietf.org/arch/msg/scim/dSyw-p5XNC2MtDl3zxJpGxHRUi0 Cc: "scim@ietf.org" Subject: Re: [scim] inferring intent vs. explicit declaration.... X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Feb 2014 17:29:24 -0000 --Apple-Mail=_9926B27F-96F3-40DD-B5D8-385734EFE5B9 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=iso-8859-1 +1.=20 I'd be curious to hear more about how people plan to use PUT.=20 Phil @independentid www.independentid.com phil.hunt@oracle.com On 2014-02-14, at 9:19 AM, Bill Mills wrote: > Something I'm not in love with in SCIM is that you have to infer = actions from data changes. Creation and deletion are explicit, PUT and = PATCH get complicated. =20 >=20 > We have a model where an account might be suspended or reactivated, = which is pretty basic and PUT/PATCH works fine, but we also might = activate or deactivate a nmailbox or other features on the account and = that means I have to have a possibly complex parser looking for state = changes in the PUT data to trigger events. There's also the use case = where one side needs to signal the other side of an event, like a = possible TOS violation or abuse event, a way to implement that would be = adding events to a list and the PATCH operation is checked to see what = data is going by. =20 >=20 > I'd like something simpler than doing a diff on the entire user state = to get to the action needed. Has this come up before? >=20 > -bill > _______________________________________________ > scim mailing list > scim@ietf.org > https://www.ietf.org/mailman/listinfo/scim --Apple-Mail=_9926B27F-96F3-40DD-B5D8-385734EFE5B9 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=iso-8859-1
On 2014-02-14, at 9:19 AM, Bill Mills <wmills_92105@yahoo.com> = wrote:

Something I'm not in love = with in SCIM is that you have to infer actions from data changes. =  Creation and deletion are explicit, PUT and PATCH get complicated. =  

We have = a model where an account might be suspended or reactivated, which is = pretty basic and PUT/PATCH works fine, but we also might activate or = deactivate a nmailbox or other features on the account and that means I = have to have a possibly complex parser looking for state changes in the = PUT data to trigger events.  There's also the use case where one = side needs to signal the other side of an event, like a possible TOS violation or abuse event, a way to implement that would = be adding events to a list and the PATCH operation is checked to see = what data is going by.  
I'd like something = simpler than doing a diff on the entire user state to get to the action = needed.  Has this come up before?

scim@ietf.org
https://www.ietf.org/ma= ilman/listinfo/scim

= --Apple-Mail=_9926B27F-96F3-40DD-B5D8-385734EFE5B9-- From nobody Fri Feb 14 17:32:47 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 528211A0012 for ; Fri, 14 Feb 2014 17:32:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.749 X-Spam-Level: X-Spam-Status: No, score=-4.749 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o9l45j82mUbg for ; Fri, 14 Feb 2014 17:32:42 -0800 (PST) Received: from lhrrgout.huawei.com (lhrrgout.huawei.com [194.213.3.17]) by ietfa.amsl.com (Postfix) with ESMTP id 65F911A0015 for ; Fri, 14 Feb 2014 17:32:42 -0800 (PST) Received: from 172.18.7.190 (EHLO lhreml204-edg.china.huawei.com) ([172.18.7.190]) by lhrrg01-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id BDP41014; Sat, 15 Feb 2014 01:32:40 +0000 (GMT) Received: from LHREML405-HUB.china.huawei.com (10.201.5.242) by lhreml204-edg.china.huawei.com (172.18.7.223) with Microsoft SMTP Server (TLS) id 14.3.158.1; Sat, 15 Feb 2014 01:32:35 +0000 Received: from SZXEMA407-HUB.china.huawei.com (10.82.72.39) by lhreml405-hub.china.huawei.com (10.201.5.242) with Microsoft SMTP Server (TLS) id 14.3.158.1; Sat, 15 Feb 2014 01:32:39 +0000 Received: from SZXEMA510-MBX.china.huawei.com ([169.254.3.206]) by SZXEMA407-HUB.china.huawei.com ([10.82.72.39]) with mapi id 14.03.0158.001; Sat, 15 Feb 2014 09:32:34 +0800 From: Bert Greevenbosch To: "scim@ietf.org" Thread-Topic: New Version Notification for draft-greevenbosch-scim-vcard-mapping-03.txt Thread-Index: AQHPKF7/VhgliPz6IU2IykxYHxzWDZq1iiBg Date: Sat, 15 Feb 2014 01:32:33 +0000 Message-ID: <46A1DF3F04371240B504290A071B4DB63E3FEA0C@SZXEMA510-MBX.china.huawei.com> Accept-Language: en-GB, zh-CN, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.66.162.63] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: http://mailarchive.ietf.org/arch/msg/scim/gyeKcMZu-n9Fa0JKUnxe7dNS3S8 Subject: [scim] FW: New Version Notification for draft-greevenbosch-scim-vcard-mapping-03.txt X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 15 Feb 2014 01:32:45 -0000 SGVsbG8gYWxsLA0KDQpJIGhhdmUgdXBsb2FkZWQgYSBuZXcgdmVyc2lvbiBvZiB0aGUgdkNhcmQg PC0+IFNDSU0gbWFwcGluZyBkcmFmdC4NCg0KaHR0cDovL3d3dy5pZXRmLm9yZy9pbnRlcm5ldC1k cmFmdHMvZHJhZnQtZ3JlZXZlbmJvc2NoLXNjaW0tdmNhcmQtbWFwcGluZy0wMy50eHQNCg0KVGhl IGRyYWZ0IGJyaW5ncyB0aGUgbWFwcGluZyB1cCB0byBkYXRlIHdpdGggdGhlIGxhdGVzdCBTQ0lN IHNjaGVtYS4NCg0KSSBsb29rIGZvcndhcmQgdG8geW91ciBjb21tZW50cyENCg0KQmVzdCByZWdh cmRzLA0KQmVydA0KDQoNCi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBpbnRlcm5l dC1kcmFmdHNAaWV0Zi5vcmcgW21haWx0bzppbnRlcm5ldC1kcmFmdHNAaWV0Zi5vcmddIA0KU2Vu dDogMTMgRmVicnVhcnkgMjAxNCAwOTo1OA0KVG86IEJlcnQgR3JlZXZlbmJvc2NoOyBCZXJ0IEdy ZWV2ZW5ib3NjaA0KU3ViamVjdDogTmV3IFZlcnNpb24gTm90aWZpY2F0aW9uIGZvciBkcmFmdC1n cmVldmVuYm9zY2gtc2NpbS12Y2FyZC1tYXBwaW5nLTAzLnR4dA0KDQoNCkEgbmV3IHZlcnNpb24g b2YgSS1ELCBkcmFmdC1ncmVldmVuYm9zY2gtc2NpbS12Y2FyZC1tYXBwaW5nLTAzLnR4dA0KaGFz IGJlZW4gc3VjY2Vzc2Z1bGx5IHN1Ym1pdHRlZCBieSBCZXJ0IEdyZWV2ZW5ib3NjaCBhbmQgcG9z dGVkIHRvIHRoZQ0KSUVURiByZXBvc2l0b3J5Lg0KDQpOYW1lOgkJZHJhZnQtZ3JlZXZlbmJvc2No LXNjaW0tdmNhcmQtbWFwcGluZw0KUmV2aXNpb246CTAzDQpUaXRsZToJCVNDSU0gYW5kIHZDYXJk IG1hcHBpbmcNCkRvY3VtZW50IGRhdGU6CTIwMTQtMDItMTINCkdyb3VwOgkJSW5kaXZpZHVhbCBT dWJtaXNzaW9uDQpQYWdlczoJCTI3DQpVUkw6ICAgICAgICAgICAgaHR0cDovL3d3dy5pZXRmLm9y Zy9pbnRlcm5ldC1kcmFmdHMvZHJhZnQtZ3JlZXZlbmJvc2NoLXNjaW0tdmNhcmQtbWFwcGluZy0w My50eHQNClN0YXR1czogICAgICAgICBodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9k cmFmdC1ncmVldmVuYm9zY2gtc2NpbS12Y2FyZC1tYXBwaW5nLw0KSHRtbGl6ZWQ6ICAgICAgIGh0 dHA6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWdyZWV2ZW5ib3NjaC1zY2ltLXZjYXJkLW1h cHBpbmctMDMNCkRpZmY6ICAgICAgICAgICBodHRwOi8vd3d3LmlldGYub3JnL3JmY2RpZmY/dXJs Mj1kcmFmdC1ncmVldmVuYm9zY2gtc2NpbS12Y2FyZC1tYXBwaW5nLTAzDQoNCkFic3RyYWN0Og0K ICAgVGhpcyBkb2N1bWVudCBkZWZpbmVzIGEgbWFwcGluZyBiZXR3ZWVuIFNDSU0gYW5kIHZDYXJk Lg0KDQpOb3RlDQoNCiAgIERpc2N1c3Npb24gYW5kIHN1Z2dlc3Rpb25zIGZvciBpbXByb3ZlbWVu dCBhcmUgcmVxdWVzdGVkLCBhbmQgc2hvdWxkDQogICBiZSBzZW50IHRvIHNjaW1AaWV0Zi5vcmcu DQoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICANCg0KDQpQbGVhc2Ugbm90ZSB0aGF0IGl0IG1h eSB0YWtlIGEgY291cGxlIG9mIG1pbnV0ZXMgZnJvbSB0aGUgdGltZSBvZiBzdWJtaXNzaW9uDQp1 bnRpbCB0aGUgaHRtbGl6ZWQgdmVyc2lvbiBhbmQgZGlmZiBhcmUgYXZhaWxhYmxlIGF0IHRvb2xz LmlldGYub3JnLg0KDQpUaGUgSUVURiBTZWNyZXRhcmlhdA0KDQo= From nobody Sun Feb 16 12:38:06 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 071D01A03FA for ; Sun, 16 Feb 2014 12:38:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.749 X-Spam-Level: X-Spam-Status: No, score=-1.749 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lyhJkJOeUvha for ; Sun, 16 Feb 2014 12:38:03 -0800 (PST) Received: from mail-wg0-x22e.google.com (mail-wg0-x22e.google.com [IPv6:2a00:1450:400c:c00::22e]) by ietfa.amsl.com (Postfix) with ESMTP id 21B1F1A0289 for ; Sun, 16 Feb 2014 12:38:02 -0800 (PST) Received: by mail-wg0-f46.google.com with SMTP id x13so1679729wgg.13 for ; Sun, 16 Feb 2014 12:38:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=yhv3jins9b8x9ZCTgD27UjNqPp4JBPJDBJhLct1NH/M=; b=l9gpReDSV690NTd3pcuFRgBUFYQTtu1bW/SeB59KzDjp/mXD5aMS6o3ubKqqjR23G8 xlyE79EiXjcQCufSfv1nollNK6V6Uf2HM+RSSPIPLpa8Mbcqw57ufBFLDrq6eJoTamsu XSkzg9iCdc5WDrBQGcUNaZdFAEi3glpetvjYLrP+wIV3eEA/DQRFvC9Bg78OTS/cwtkF 0RdlR6YzyO5le8mDJ9ESSPK303morI5dtZHn0k94HnC6TAjPvdwXibm2eTVaBGDJg/A0 FKVsgMGhA5q4BZ5I73cg5dWNJvqTROYJNqRwffiDn3MfZWfXSEqIYOhaV/FWkZQ9fqXJ GaKQ== MIME-Version: 1.0 X-Received: by 10.180.73.141 with SMTP id l13mr9996714wiv.60.1392583080402; Sun, 16 Feb 2014 12:38:00 -0800 (PST) Received: by 10.227.235.10 with HTTP; Sun, 16 Feb 2014 12:38:00 -0800 (PST) Date: Sun, 16 Feb 2014 15:38:00 -0500 Message-ID: From: "B.Khasnabish@ieee.org" To: scim@ietf.org Content-Type: multipart/alternative; boundary=f46d043c814cd3e3c304f28c0381 Archived-At: http://mailarchive.ietf.org/arch/msg/scim/-ziU5FZ2AqLhbe1eypIHbavBQHI Subject: [scim] SCIM Use Cases draft (draft-ietf-scim-use-cases-00) WGLC X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 16 Feb 2014 20:38:05 -0000 --f46d043c814cd3e3c304f28c0381 Content-Type: text/plain; charset=ISO-8859-1 Request WGLC re. the SCIM Use Cases draft ( http://www.ietf.org/id/draft-ietf-scim-use-cases-00.txt ). Many thanks in advance. Best. Authors of the draft __o _ `\ <, _ .......... ( * ) / ( * ) ...................... --f46d043c814cd3e3c304f28c0381 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
Request WGLC re. the SCIM Use Cases draft
( http://www.ietf.org/id/draft-ietf-scim-use-cases-00.txt ).
Many thanks in advance.
 
Best.
 
Authors of the draft 
&nb= sp;
           &n= bsp;       __o
     &n= bsp;       _ `\ <, _
.......... ( &bull= ; ) / ( • ) ......................
--f46d043c814cd3e3c304f28c0381-- From nobody Sun Feb 16 13:57:42 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 131661A0411 for ; Sun, 16 Feb 2014 13:57:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UvCanYLuk7jj for ; Sun, 16 Feb 2014 13:57:37 -0800 (PST) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1lp0149.outbound.protection.outlook.com [207.46.163.149]) by ietfa.amsl.com (Postfix) with ESMTP id 673F71A02C4 for ; Sun, 16 Feb 2014 13:57:37 -0800 (PST) Received: from BLUPR03MB309.namprd03.prod.outlook.com (10.141.48.22) by BLUPR03MB591.namprd03.prod.outlook.com (10.255.124.37) with Microsoft SMTP Server (TLS) id 15.0.878.16; Sun, 16 Feb 2014 21:57:33 +0000 Received: from BLUPR03MB309.namprd03.prod.outlook.com ([10.141.48.22]) by BLUPR03MB309.namprd03.prod.outlook.com ([10.141.48.22]) with mapi id 15.00.0883.010; Sun, 16 Feb 2014 21:57:33 +0000 From: Anthony Nadalin To: "B.Khasnabish@ieee.org" , "scim@ietf.org" Thread-Topic: [scim] SCIM Use Cases draft (draft-ietf-scim-use-cases-00) WGLC Thread-Index: AQHPK1cA740XHY2aj0eQ7HFpUe7kvpq4bXoA Date: Sun, 16 Feb 2014 21:57:31 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [50.46.126.7] x-forefront-prvs: 01244308DF x-forefront-antispam-report: SFV:NSPM; SFS:(10009001)(979002)(377454003)(199002)(189002)(51874003)(66654002)(65816001)(66066001)(80022001)(76482001)(94946001)(85306002)(87266001)(86362001)(95416001)(95666001)(63696002)(53806001)(47446002)(54356001)(74366001)(19609705001)(87936001)(81542001)(86612001)(2656002)(15975445006)(94316002)(81342001)(93136001)(76576001)(16236675002)(4396001)(49866001)(59766001)(74876001)(69226001)(47736001)(93516002)(15202345003)(56776001)(50986001)(80976001)(83322001)(19580405001)(19580395003)(54316002)(81816001)(56816005)(90146001)(85852003)(74502001)(92566001)(76786001)(83072002)(77982001)(74662001)(74316001)(47976001)(51856001)(76796001)(79102001)(46102001)(31966008)(19300405004)(81686001)(74706001)(33646001)(42262001)(24736002)(491001)(969003)(989001)(999001)(1009001)(1019001); DIR:OUT; SFP:1101; SCL:1; SRVR:BLUPR03MB591; H:BLUPR03MB309.namprd03.prod.outlook.com; CLIP:50.46.126.7; FPR:789E7533.3F00CCE9.B3703DCB.F04ADD5C.200B4; MLV:ovr; PTR:InfoNoRecords; A:1; MX:1; LANG:en; Content-Type: multipart/alternative; boundary="_000_b722759757404c3cb5342cac75b7731aBLUPR03MB309namprd03pro_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com Archived-At: http://mailarchive.ietf.org/arch/msg/scim/Jbtsu7HQZtBEfBRSORO3NzeJCEM Subject: Re: [scim] SCIM Use Cases draft (draft-ietf-scim-use-cases-00) WGLC X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 16 Feb 2014 21:57:40 -0000 --_000_b722759757404c3cb5342cac75b7731aBLUPR03MB309namprd03pro_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable +1 From: scim [mailto:scim-bounces@ietf.org] On Behalf Of B.Khasnabish@ieee.or= g Sent: Sunday, February 16, 2014 12:38 PM To: scim@ietf.org Subject: [scim] SCIM Use Cases draft (draft-ietf-scim-use-cases-00) WGLC Request WGLC re. the SCIM Use Cases draft ( http://www.ietf.org/id/draft-ietf-scim-use-cases-00.txt ). Many thanks in advance. Best. Authors of the draft __o _ `\ <, _ .......... ( * ) / ( * ) ...................... --_000_b722759757404c3cb5342cac75b7731aBLUPR03MB309namprd03pro_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

+1<= /p>

 

From: scim [= mailto:scim-bounces@ietf.org] On Behalf Of B.Khasnabish@ieee.org
Sent: Sunday, February 16, 2014 12:38 PM
To: scim@ietf.org
Subject: [scim] SCIM Use Cases draft (draft-ietf-scim-use-cases-00) = WGLC

 

Request WGLC re. the SCIM Use Cases draft
( http://www.ietf.org/id/draft-ietf-scim-use-ca= ses-00.txt ).

Many thanks in advance.

 

Best.

 

Authors of the draft 
 
            &nb= sp;      __o
             _ `\ &l= t;, _
.......... ( • ) / ( • ) ......................

--_000_b722759757404c3cb5342cac75b7731aBLUPR03MB309namprd03pro_-- From nobody Sun Feb 16 14:08:45 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4FFBA1A02AA for ; Sun, 16 Feb 2014 14:08:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1XvPth3nDJ3G for ; Sun, 16 Feb 2014 14:08:40 -0800 (PST) Received: from mail-la0-f46.google.com (mail-la0-f46.google.com [209.85.215.46]) by ietfa.amsl.com (Postfix) with ESMTP id 13A121A02C4 for ; Sun, 16 Feb 2014 14:08:39 -0800 (PST) Received: by mail-la0-f46.google.com with SMTP id b8so10705489lan.33 for ; Sun, 16 Feb 2014 14:08:37 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:message-id:date:from:user-agent:mime-version:to :subject:references:in-reply-to:content-type; bh=/zecvCJi/P+kKXPJMJ4dPPS1fJS8CL8XfkoF9+7+2Fg=; b=Guadn8yEIVEZA7uKu81pkGEdPy86J7LYTvCuy1nToNGTyuDvUEwuRq0OWqivDK4lyu X1/iiRTqjFwOfLwsmdiq2+xUNLJP93xb+N6S1gHgcDU6GnDDBzV7fnAajmL1ouX4/a7F eDiFU8Io9BCuaHqOOAGZB8R5H7BdpZFySufU+J8i3Z+n6X4d8SifxN2ZGAUkOfgWMTF6 /RXkjPmZ4vMnvbVc9V6xBMQHsrVDdKEpsj6VkjPisfbKKg9NIYvY0GE1QjbzhPBoTnnl K142hu4jCN2Zd8aKq6lMGKakprFptMJcwli48N580O2Ll7O/5DZ0KTBFiwUdQqDWKiDd frTg== X-Gm-Message-State: ALoCoQm9mFQ0v+Rd6g4KOj9tZEHzIEaqKzUJYiT2uk3WIoRod9QBhg8OZKL7Zz5BsCrVM/brJIxP X-Received: by 10.112.129.168 with SMTP id nx8mr14266710lbb.37.1392588517007; Sun, 16 Feb 2014 14:08:37 -0800 (PST) Received: from [10.0.0.115] (tb62-102-145-131.cust.teknikbyran.com. [62.102.145.131]) by mx.google.com with ESMTPSA id k1sm16005229lbc.5.2014.02.16.14.08.35 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Sun, 16 Feb 2014 14:08:36 -0800 (PST) Message-ID: <530136FF.3000204@mnt.se> Date: Sun, 16 Feb 2014 23:09:03 +0100 From: Leif Johansson User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0 MIME-Version: 1.0 To: scim@ietf.org References: In-Reply-To: X-Enigmail-Version: 1.6 Content-Type: multipart/alternative; boundary="------------080809040606030903050709" Archived-At: http://mailarchive.ietf.org/arch/msg/scim/b3LgRaNHd_mH2lmuJiEhRFhHuFw Subject: Re: [scim] SCIM Use Cases draft (draft-ietf-scim-use-cases-00) WGLC X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 16 Feb 2014 22:08:43 -0000 This is a multi-part message in MIME format. --------------080809040606030903050709 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit On 2014-02-16 22:57, Anthony Nadalin wrote: > > +1 > > > > *From:*scim [mailto:scim-bounces@ietf.org] *On Behalf Of > *B.Khasnabish@ieee.org > *Sent:* Sunday, February 16, 2014 12:38 PM > *To:* scim@ietf.org > *Subject:* [scim] SCIM Use Cases draft (draft-ietf-scim-use-cases-00) WGLC > > > > Request WGLC re. the SCIM Use Cases draft > ( http://www.ietf.org/id/draft-ietf-scim-use-cases-00.txt ). > > Many thanks in advance. > > > > Best. > > > > Authors of the draft > > Very good - I actually took an AI at the last meeting to start the WGLC. > __o > _ `\ <, _ > .......... ( . ) / ( . ) ...................... > > > > _______________________________________________ > scim mailing list > scim@ietf.org > https://www.ietf.org/mailman/listinfo/scim --------------080809040606030903050709 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit
On 2014-02-16 22:57, Anthony Nadalin wrote:

+1

 

From: scim [mailto:scim-bounces@ietf.org] On Behalf Of B.Khasnabish@ieee.org
Sent: Sunday, February 16, 2014 12:38 PM
To: scim@ietf.org
Subject: [scim] SCIM Use Cases draft (draft-ietf-scim-use-cases-00) WGLC

 

Request WGLC re. the SCIM Use Cases draft
( http://www.ietf.org/id/draft-ietf-scim-use-cases-00.txt ).

Many thanks in advance.

 

Best.

 

Authors of the draft 
 


Very good  - I actually took an AI at the last meeting to start the WGLC.

                   __o
             _ `\ <, _
.......... ( • ) / ( • ) ......................



_______________________________________________
scim mailing list
scim@ietf.org
https://www.ietf.org/mailman/listinfo/scim

--------------080809040606030903050709-- From nobody Sun Feb 16 14:10:06 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4472E1A0291 for ; Sun, 16 Feb 2014 14:10:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2LAThdKQ5MmL for ; Sun, 16 Feb 2014 14:10:02 -0800 (PST) Received: from mail-la0-f52.google.com (mail-la0-f52.google.com [209.85.215.52]) by ietfa.amsl.com (Postfix) with ESMTP id 8ACCD1A0139 for ; Sun, 16 Feb 2014 14:10:02 -0800 (PST) Received: by mail-la0-f52.google.com with SMTP id c6so10580115lan.39 for ; Sun, 16 Feb 2014 14:09:59 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:message-id:date:from:user-agent:mime-version:to :subject:content-type:content-transfer-encoding; bh=2aq8/R/gGfn0zmasYyuh/Drlj363s6nkGJJAlKCnfRQ=; b=TofPo6uyQYTe8+AgOnq0/JbkY6weJhbu1uSJrjCiPBE7Kuq9z7yioK7zLvtCzzM7wF Rtd17lATZi9minXjfxfzfS77XPQFeQ7yntr9gL9lYewFsBWbfIpHdVkxd39Jg8oz5XxN gPIxylFueuKDzOulynyCQETzOieCvfF65qYUgwxFkzGvSnlKYO2yUckIgHLgkV3KrasT JWaeCtQAOYQu/CfqcUhFLsDIdDrYVVAi/eZxFnQmFUKsfvHSU+ta0DkZHw5FQoEdEv3U VYXrRJvYI72sOCnQQGMfYP7ByjxRhN6o0lQSY6hbNGtRKsx5fLuCAY0Zk1ofVWHZ2kTz kgOA== X-Gm-Message-State: ALoCoQm6jI+lADljvL3nOoTny91A9Bx7xoJ2JlWTxwZNu6S9DIifVPsNK39HdfG+vgOMDrvenR+X X-Received: by 10.152.6.199 with SMTP id d7mr15220273laa.22.1392588599386; Sun, 16 Feb 2014 14:09:59 -0800 (PST) Received: from [10.0.0.115] (tb62-102-145-131.cust.teknikbyran.com. [62.102.145.131]) by mx.google.com with ESMTPSA id bl8sm16026977lbb.3.2014.02.16.14.09.58 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Sun, 16 Feb 2014 14:09:58 -0800 (PST) Message-ID: <53013752.5080203@mnt.se> Date: Sun, 16 Feb 2014 23:10:26 +0100 From: Leif Johansson User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0 MIME-Version: 1.0 To: "scim@ietf.org" X-Enigmail-Version: 1.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Archived-At: http://mailarchive.ietf.org/arch/msg/scim/_rfOBQ8hkTcELb-egXUGSIP9H2k Subject: [scim] WGLC of draft-ietf-scim-use-cases-00.txt X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 16 Feb 2014 22:10:04 -0000 This starts a 2 week WG Last Call on draft-ietf-scim-use-cases-00.txt. Please provide any comments before 3/3 2014 Cheers Leif From nobody Tue Feb 18 11:39:51 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 40CEA1A0538 for ; Tue, 18 Feb 2014 11:39:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.654 X-Spam-Level: X-Spam-Status: No, score=0.654 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, FREEMAIL_REPLYTO_END_DIGIT=0.25, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.548] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0ndvO5VaIho3 for ; Tue, 18 Feb 2014 11:39:48 -0800 (PST) Received: from nm28.bullet.mail.bf1.yahoo.com (nm28.bullet.mail.bf1.yahoo.com [98.139.212.187]) by ietfa.amsl.com (Postfix) with ESMTP id 3A2411A051D for ; Tue, 18 Feb 2014 11:39:48 -0800 (PST) Received: from [66.196.81.174] by nm28.bullet.mail.bf1.yahoo.com with NNFMP; 18 Feb 2014 19:39:45 -0000 Received: from [98.139.212.226] by tm20.bullet.mail.bf1.yahoo.com with NNFMP; 18 Feb 2014 19:39:45 -0000 Received: from [127.0.0.1] by omp1035.mail.bf1.yahoo.com with NNFMP; 18 Feb 2014 19:39:45 -0000 X-Yahoo-Newman-Property: ymail-3 X-Yahoo-Newman-Id: 158460.98431.bm@omp1035.mail.bf1.yahoo.com Received: (qmail 65598 invoked by uid 60001); 18 Feb 2014 19:39:45 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1392752385; bh=EsPD+c2JL32t1YU0T/k8nrO/nKF/HSVksVIH7UZiMdY=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=n2d56DnDvA4zSzNhNFpaJ/9N/4mTXAF8S7fgs/64Mfz42qyYG78lcDQwlN7ecap5+JOOxDrYH/gCWb0kpATpmHaOkzKzFmGUPFDjFfcmMmA/5f74uMWSDg7oaFxcVu5w2nAF4a00Wku+awSWJ6t1S4SyHfPaeTKQeuRFjf3g6Mw= DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=gszvpBuYI4UTdD1wAu3rA12DseEqnb7ajcogs3Us88m1oMQpP46Eqw/+t/g3fez4UFMbD57YLKBvPj7QcewQrEfIyiRPb/hBVLOy9X911O9qoDnFvse2AcNyPbIQ45wWRFvelfq0MvRI+BLEXgAdTa/Ozzbkh3Tc+uvD0oR/9tc=; X-YMail-OSG: r5ZIgVwVM1myn1HkI9r56IKSoHEyjNN4ryiBEC2bh.RLkJ9 1OpOE2xdR8xV7IITQCz2XXzdgghy4mSfiVFDwFXsa88y1qkqLDwcKMbHNFln vl_Y1pDvMZicofq8uQzHjYJ8rGjPlZXEmorYYQoTaWrkHfz6GK7FitfgYHhN FTq0zRzIE6eGLQmt4DCYGxcJ1MeHuTNrNF8c8CsgPFBavd.akr1Z4WG8yJ8q PgxZnjo1X16zHedso4E82m8KQGBoQAjj1dW4Laxa54T6VITRwBp7DJ08tF53 HJHuRm0kdhxT5wfcSwVvkkkMyFW.ZojJZ9Z8_UYY76YO0QLUT9bjRezt8vRl xj7W_MCqNhM6OouhJhHhtsAmA0GQXPUI4hjJXJecGy8.seUsdaaCzCRHde4_ ICDfzvjnYwIqiwalE7woVjMzXIxXX4q02aBoTeDUvbQN8dQc95IlhkM0sBk3 Rl4vZmBofek35mcp6MIaUuOYBgPRElfvkx5OS.F6IbXEakGOI08j8rhBnITS Si1Vg7su6WtCnGLX.CsOCMR3YRxLoG5DPwk6t4hZPBTxypRBCUuvRk3_801i a.DCfWwKbWeddn0nvRGHwFztd Received: from [66.228.162.36] by web142805.mail.bf1.yahoo.com via HTTP; Tue, 18 Feb 2014 11:39:44 PST X-Rocket-MIMEInfo: 002.001, SSBkb24ndCB0aGluayB0aGUgdXNlIG9mICJNQVkiIGluIHRoZSBtdXRhYmlsaXR5IHNlY3Rpb24gaXMgY29ycmVjdCBleGNlcHRzIGZvciB3aGVyZSByZWFkL3dyaXRlIGVsZW1lbnRzIE1BWSBiZSBtb2RpZmllZCBhdCBhbnkgdGltZS4gwqBJbiBtb3N0IG90aGVyIHNpdHVhdGlvbnMgdGhlcmUgTUFZIHNob3VkbCBiZSByZXBsYWNlZCB3aXRoIFNIQUxMIG9yIE1VU1QuCgotYmlsbAEwAQEBAQ-- X-Mailer: YahooMailWebService/0.8.177.636 Message-ID: <1392752384.65356.YahooMailNeo@web142805.mail.bf1.yahoo.com> Date: Tue, 18 Feb 2014 11:39:44 -0800 (PST) From: Bill Mills To: "scim@ietf.org" MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="1583497461-875177967-1392752384=:65356" Archived-At: http://mailarchive.ietf.org/arch/msg/scim/YTb3UKJpVq7lh0y5qo5grrHZA98 Subject: [scim] The "mutability" schema section and "MAY" X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: Bill Mills List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Feb 2014 19:39:50 -0000 --1583497461-875177967-1392752384=:65356 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable I don't think the use of "MAY" in the mutability section is correct excepts= for where read/write elements MAY be modified at any time. =A0In most othe= r situations there MAY shoudl be replaced with SHALL or MUST.=0A=0A-bill --1583497461-875177967-1392752384=:65356 Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable
I don't think the use of "MAY" in the mutability section= is correct excepts for where read/write elements MAY be modified at any ti= me.  In most other situations there MAY shoudl be replaced with SHALL = or MUST.

-bill
--1583497461-875177967-1392752384=:65356-- From nobody Tue Feb 18 13:02:49 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 651211A0405 for ; Tue, 18 Feb 2014 13:02:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.747 X-Spam-Level: X-Spam-Status: No, score=-4.747 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q4BawoplTvQ9 for ; Tue, 18 Feb 2014 13:02:45 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) by ietfa.amsl.com (Postfix) with ESMTP id ADEC51A0525 for ; Tue, 18 Feb 2014 13:02:45 -0800 (PST) Received: from acsinet22.oracle.com (acsinet22.oracle.com [141.146.126.238]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s1IL2foJ023682 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Tue, 18 Feb 2014 21:02:42 GMT Received: from aserz7021.oracle.com (aserz7021.oracle.com [141.146.126.230]) by acsinet22.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1IL2f9b020815 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 18 Feb 2014 21:02:41 GMT Received: from abhmp0009.oracle.com (abhmp0009.oracle.com [141.146.116.15]) by aserz7021.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1IL2eHr010878; Tue, 18 Feb 2014 21:02:40 GMT Received: from dhcp-whq-twvpn-3-vpnpool-10-159-235-23.vpn.oracle.com (/10.159.235.23) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 18 Feb 2014 13:02:40 -0800 Content-Type: multipart/alternative; boundary="Apple-Mail=_F5939BF8-281E-4AD3-9227-0FB2B9C90C96" Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\)) From: Phil Hunt In-Reply-To: <1392752384.65356.YahooMailNeo@web142805.mail.bf1.yahoo.com> Date: Tue, 18 Feb 2014 13:02:40 -0800 Message-Id: References: <1392752384.65356.YahooMailNeo@web142805.mail.bf1.yahoo.com> To: Bill Mills X-Mailer: Apple Mail (2.1510) X-Source-IP: acsinet22.oracle.com [141.146.126.238] Archived-At: http://mailarchive.ietf.org/arch/msg/scim/XVwjs2tpC1EmIWgKF2oeySoL_-Q Cc: "scim@ietf.org" Subject: Re: [scim] The "mutability" schema section and "MAY" X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Feb 2014 21:02:47 -0000 --Apple-Mail=_F5939BF8-281E-4AD3-9227-0FB2B9C90C96 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=iso-8859-1 I think you MUST be correct. :-) Draft 03: > mutability A single keyword indicating what types of > modifications an attribute MAY accept as follows: Should be: > mutability A single keyword indicating what types of > modifications an attribute SHALL accept are as follows: Phil @independentid www.independentid.com phil.hunt@oracle.com On 2014-02-18, at 11:39 AM, Bill Mills wrote: > I don't think the use of "MAY" in the mutability section is correct = excepts for where read/write elements MAY be modified at any time. In = most other situations there MAY shoudl be replaced with SHALL or MUST. >=20 > -bill > _______________________________________________ > scim mailing list > scim@ietf.org > https://www.ietf.org/mailman/listinfo/scim --Apple-Mail=_F5939BF8-281E-4AD3-9227-0FB2B9C90C96 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=iso-8859-1 I = think you MUST be correct. :-)

Draft = 03:
mutability  A single keyword indicating =
what types of
            modifications an attribute MAY accept as =
follows:

Should = be:
mutability  A single keyword indicating =
what types of
            modifications an attribute SHALL accept are as =
follows:


On 2014-02-18, at 11:39 AM, Bill Mills <wmills_92105@yahoo.com> = wrote:

I don't think the use of = "MAY" in the mutability section is correct excepts for where read/write = elements MAY be modified at any time.  In most other situations = there MAY shoudl be replaced with SHALL or = MUST.

scim@ietf.org
https://www.ietf.org/ma= ilman/listinfo/scim

= --Apple-Mail=_F5939BF8-281E-4AD3-9227-0FB2B9C90C96-- From nobody Tue Feb 18 13:26:21 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B16D1A0220 for ; Tue, 18 Feb 2014 13:26:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.748 X-Spam-Level: X-Spam-Status: No, score=-4.748 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gbeJMxIH-bbD for ; Tue, 18 Feb 2014 13:26:18 -0800 (PST) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) by ietfa.amsl.com (Postfix) with ESMTP id 6EFCF1A0081 for ; Tue, 18 Feb 2014 13:26:18 -0800 (PST) Received: from acsinet21.oracle.com (acsinet21.oracle.com [141.146.126.237]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s1ILQCq6002256 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Tue, 18 Feb 2014 21:26:12 GMT Received: from aserz7022.oracle.com (aserz7022.oracle.com [141.146.126.231]) by acsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1ILQBfl011291 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 18 Feb 2014 21:26:12 GMT Received: from abhmp0003.oracle.com (abhmp0003.oracle.com [141.146.116.9]) by aserz7022.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1ILQB3J021408; Tue, 18 Feb 2014 21:26:11 GMT Received: from dhcp-whq-twvpn-3-vpnpool-10-159-235-23.vpn.oracle.com (/10.159.235.23) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 18 Feb 2014 13:26:11 -0800 Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\)) From: Phil Hunt In-Reply-To: <52DFA17F.8070305@gmx.de> Date: Tue, 18 Feb 2014 13:26:07 -0800 Content-Transfer-Encoding: quoted-printable Message-Id: <59379804-1702-460F-9253-B738CFE63CAF@oracle.com> References: <52DFA17F.8070305@gmx.de> To: Julian Reschke X-Mailer: Apple Mail (2.1510) X-Source-IP: acsinet21.oracle.com [141.146.126.237] Archived-At: http://mailarchive.ietf.org/arch/msg/scim/N1PEqBFA_FWAPcVwJ7lqHgN1u5k Cc: "scim@ietf.org WG" Subject: Re: [scim] http://tools.ietf.org/html/draft-ietf-scim-api-02#section-3.12: "X-HTTP-Method-Override" X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Feb 2014 21:26:20 -0000 This is a common REST practice. We probably need to have a reference for = this item. As to whether it is needed, it would be interesting to know if anyone in = the group is worried about firewalls limiting use of PATCH and DELETE, = etc. Phil @independentid www.independentid.com phil.hunt@oracle.com On 2014-01-22, at 2:46 AM, Julian Reschke wrote: > Hi there. >=20 > I think it's problematic for a standards-track document to allow use = of a header field that is not in the HTTP header field registry. >=20 > If you really believe that is is needed (which I doubt) than you = really ought to work on a separate spec that defines and registers it in = the header field registry. >=20 > Best regards, Julian > _______________________________________________ > scim mailing list > scim@ietf.org > https://www.ietf.org/mailman/listinfo/scim From nobody Tue Feb 18 13:36:52 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CC8A01A0296 for ; Tue, 18 Feb 2014 13:36:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IsAGNjajwWuA for ; Tue, 18 Feb 2014 13:36:49 -0800 (PST) Received: from mout.gmx.net (mout.gmx.net [212.227.17.22]) by ietfa.amsl.com (Postfix) with ESMTP id BC88C1A0283 for ; Tue, 18 Feb 2014 13:36:48 -0800 (PST) Received: from [192.168.1.103] ([84.187.55.60]) by mail.gmx.com (mrgmx101) with ESMTPSA (Nemesis) id 0LmfKJ-1Wo6tr0tqF-00aCMR for ; Tue, 18 Feb 2014 22:36:44 +0100 Message-ID: <5303D269.5030100@gmx.de> Date: Tue, 18 Feb 2014 22:36:41 +0100 From: Julian Reschke User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.3.0 MIME-Version: 1.0 To: Phil Hunt References: <52DFA17F.8070305@gmx.de> <59379804-1702-460F-9253-B738CFE63CAF@oracle.com> In-Reply-To: <59379804-1702-460F-9253-B738CFE63CAF@oracle.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Provags-ID: V03:K0:3Zymt5w62fiHBNRR+3C+5JM0wRIPqIiD6HrwSWsZ9aT5juYtEb8 JYfZpE1c0Ze7aYZyyAE+c+3IDzmFLKqIaIDHqEWzGMnyF3taEwnrtemFIIfI/gybMr+7kCe irnRlbnLiqvboDp8jIs1s2F/4R0XjXe7heKEyL1sqKhQ8w57/gtU2ZUNL9LDZyBXpOOI89P 67HkJxzHnv4Vy71OpDUiA== Archived-At: http://mailarchive.ietf.org/arch/msg/scim/Kb9VJuYWLdQ6GYLNSTx5Y8zYWDw Cc: "scim@ietf.org WG" Subject: Re: [scim] http://tools.ietf.org/html/draft-ietf-scim-api-02#section-3.12: "X-HTTP-Method-Override" X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Feb 2014 21:36:51 -0000 On 2014-02-18 22:26, Phil Hunt wrote: > This is a common REST practice. We probably need to have a reference for this item. Define "common REST practice". > As to whether it is needed, it would be interesting to know if anyone in the group is worried about firewalls limiting use of PATCH and DELETE, etc. a) I assume most write operations go over https anyway, so this is not a concern. b) *If* a firewall blocks certain HTTP methods then we should respect that. It's a feature of the protocol that inspecting the method name allows making policy decisions. If you believe a firewall does it out of incompetence, get the firewall fixed. Best regards, Julian From nobody Tue Feb 18 13:49:29 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3E6A61A03FD for ; Tue, 18 Feb 2014 13:49:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.748 X-Spam-Level: X-Spam-Status: No, score=-4.748 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ACXtIHwNfWoN for ; Tue, 18 Feb 2014 13:49:27 -0800 (PST) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) by ietfa.amsl.com (Postfix) with ESMTP id ED0A71A02B9 for ; Tue, 18 Feb 2014 13:49:26 -0800 (PST) Received: from ucsinet22.oracle.com (ucsinet22.oracle.com [156.151.31.94]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s1ILnLHD028723 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Tue, 18 Feb 2014 21:49:22 GMT Received: from userz7021.oracle.com (userz7021.oracle.com [156.151.31.85]) by ucsinet22.oracle.com (8.14.5+Sun/8.14.5) with ESMTP id s1ILnKtT006749 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Tue, 18 Feb 2014 21:49:21 GMT Received: from abhmp0020.oracle.com (abhmp0020.oracle.com [141.146.116.26]) by userz7021.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1ILnKBV010004; Tue, 18 Feb 2014 21:49:20 GMT Received: from dhcp-whq-twvpn-3-vpnpool-10-159-235-23.vpn.oracle.com (/10.159.235.23) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 18 Feb 2014 13:49:20 -0800 Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\)) From: Phil Hunt In-Reply-To: <5303D269.5030100@gmx.de> Date: Tue, 18 Feb 2014 13:49:20 -0800 Content-Transfer-Encoding: quoted-printable Message-Id: References: <52DFA17F.8070305@gmx.de> <59379804-1702-460F-9253-B738CFE63CAF@oracle.com> <5303D269.5030100@gmx.de> To: Julian Reschke X-Mailer: Apple Mail (2.1510) X-Source-IP: ucsinet22.oracle.com [156.151.31.94] Archived-At: http://mailarchive.ietf.org/arch/msg/scim/EJhuQ9BG9gpo2LaOAwc6YQQp6C4 Cc: "scim@ietf.org WG" Subject: Re: [scim] http://tools.ietf.org/html/draft-ietf-scim-api-02#section-3.12: "X-HTTP-Method-Override" X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Feb 2014 21:49:29 -0000 Phil @independentid www.independentid.com phil.hunt@oracle.com On 2014-02-18, at 1:36 PM, Julian Reschke wrote: > On 2014-02-18 22:26, Phil Hunt wrote: >> This is a common REST practice. We probably need to have a reference = for this item. >=20 > Define "common REST practice". I've seen this in books and on the web. I don't have any particular = references right now=85that's my point, we need one. >=20 >> As to whether it is needed, it would be interesting to know if anyone = in the group is worried about firewalls limiting use of PATCH and = DELETE, etc. >=20 > a) I assume most write operations go over https anyway, so this is not = a concern. This isn't an HTTPS vs HTTP issue AFAIK (though SCIM communication = should always be on HTTPS). It is a firewall policy issue. This could = happen in some mobile gateways as well. Though I am not sure how it = would impact a client using SCIM. I just know these limitations are out = there in the real world. >=20 > b) *If* a firewall blocks certain HTTP methods then we should respect = that. It's a feature of the protocol that inspecting the method name = allows making policy decisions. If you believe a firewall does it out of = incompetence, get the firewall fixed. >=20 > Best regards, Julian I wouldn't say the firewalls (or proxies) are broken. Just overly and = unnecessarily conservatively configured. Never-the-less, my point is to ask the WG does anyone need HTTP method = override? >=20 >=20 >=20 > _______________________________________________ > scim mailing list > scim@ietf.org > https://www.ietf.org/mailman/listinfo/scim From nobody Tue Feb 18 13:59:32 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A3B8E1A0470 for ; Tue, 18 Feb 2014 13:59:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6Ue6yhtp71jV for ; Tue, 18 Feb 2014 13:59:27 -0800 (PST) Received: from mout-xforward.gmx.net (mout-xforward.gmx.net [82.165.159.42]) by ietfa.amsl.com (Postfix) with ESMTP id B2A9B1A0539 for ; Tue, 18 Feb 2014 13:59:26 -0800 (PST) Received: from [192.168.1.103] ([84.187.55.60]) by mail.gmx.com (mrgmx103) with ESMTPSA (Nemesis) id 0MLelb-1WF3Lm3z0d-000xe6 for ; Tue, 18 Feb 2014 22:59:22 +0100 Message-ID: <5303D7B6.5070506@gmx.de> Date: Tue, 18 Feb 2014 22:59:18 +0100 From: Julian Reschke User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.3.0 MIME-Version: 1.0 To: Phil Hunt References: <52DFA17F.8070305@gmx.de> <59379804-1702-460F-9253-B738CFE63CAF@oracle.com> <5303D269.5030100@gmx.de> In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit X-Provags-ID: V03:K0:YhMhnlG5EK6T9LEctbM+FB1nc3paV0YdE3T+RrNoCz6YsScMKUF 7R9IamNGIaggwdvk3wirC/AFcAHZvB3fSRqX/qDVx/C95L8Ww1ftxkWlptiyFdGLx3PXfZG Og/GJ5FCJ1Xet6Cu9+qrpjahD2ofyvIKABnt9l/BDVJ/xoPhORtOD6Cz5d0TWCwnpleVPvi ahmQ0GhAjB6ljRvJhX7fg== Archived-At: http://mailarchive.ietf.org/arch/msg/scim/xuYk6gY1rFiT7Uz0dvLhVAwDLC8 Cc: "scim@ietf.org WG" Subject: Re: [scim] http://tools.ietf.org/html/draft-ietf-scim-api-02#section-3.12: "X-HTTP-Method-Override" X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Feb 2014 21:59:28 -0000 On 2014-02-18 22:49, Phil Hunt wrote: > > Phil > > @independentid > www.independentid.com > phil.hunt@oracle.com > > On 2014-02-18, at 1:36 PM, Julian Reschke wrote: > >> On 2014-02-18 22:26, Phil Hunt wrote: >>> This is a common REST practice. We probably need to have a reference for this item. >> >> Define "common REST practice". > > I've seen this in books and on the web. I don't have any particular references right now…that's my point, we need one. >> >>> As to whether it is needed, it would be interesting to know if anyone in the group is worried about firewalls limiting use of PATCH and DELETE, etc. >> >> a) I assume most write operations go over https anyway, so this is not a concern. > > This isn't an HTTPS vs HTTP issue AFAIK (though SCIM communication should always be on HTTPS). It is a firewall policy issue. This could happen in some mobile gateways as well. Though I am not sure how it would impact a client using SCIM. I just know these limitations are out there in the real world. If it's HTTPS then the firewall can only intercept by breaking up TLS. In which case you probably have bigger problems :-) So please collect evidence before doing something that is outside our (IETF) specs. > ... Best regards, Julian From nobody Tue Feb 18 14:43:44 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD7151A041A for ; Tue, 18 Feb 2014 14:43:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.748 X-Spam-Level: X-Spam-Status: No, score=-4.748 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S8_UuuCIobXJ for ; Tue, 18 Feb 2014 14:43:41 -0800 (PST) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) by ietfa.amsl.com (Postfix) with ESMTP id A204C1A0296 for ; Tue, 18 Feb 2014 14:43:41 -0800 (PST) Received: from ucsinet22.oracle.com (ucsinet22.oracle.com [156.151.31.94]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s1IMhYFP022339 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Tue, 18 Feb 2014 22:43:35 GMT Received: from userz7021.oracle.com (userz7021.oracle.com [156.151.31.85]) by ucsinet22.oracle.com (8.14.5+Sun/8.14.5) with ESMTP id s1IMhXoJ009115 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Tue, 18 Feb 2014 22:43:34 GMT Received: from abhmp0016.oracle.com (abhmp0016.oracle.com [141.146.116.22]) by userz7021.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1IMhXhO007035; Tue, 18 Feb 2014 22:43:33 GMT Received: from dhcp-whq-twvpn-3-vpnpool-10-159-235-23.vpn.oracle.com (/10.159.235.23) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 18 Feb 2014 14:43:33 -0800 Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\)) From: Phil Hunt In-Reply-To: <5303D7B6.5070506@gmx.de> Date: Tue, 18 Feb 2014 14:43:33 -0800 Content-Transfer-Encoding: quoted-printable Message-Id: References: <52DFA17F.8070305@gmx.de> <59379804-1702-460F-9253-B738CFE63CAF@oracle.com> <5303D269.5030100@gmx.de> <5303D7B6.5070506@gmx.de> To: Julian Reschke X-Mailer: Apple Mail (2.1510) X-Source-IP: ucsinet22.oracle.com [156.151.31.94] Archived-At: http://mailarchive.ietf.org/arch/msg/scim/KTYA0QsPQ6Pyk5XUWHLZtYCfLWE Cc: "scim@ietf.org WG" Subject: Re: [scim] http://tools.ietf.org/html/draft-ietf-scim-api-02#section-3.12: "X-HTTP-Method-Override" X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Feb 2014 22:43:44 -0000 What about Proxies? Gateways? Limited client libraries? It is incredibly common practice. I did a search for HTTP Method = Override and got 1000s of hits. But I couldn't find citable reference. = It is something that Google, Microsoft, and many many others (including = Jersey) have been supporting for some time. It seems to be accepted = common practice that has not been formally standardized. I agree with you, but I just want to confirm, since it was in the spec = from SCIM 1, why Sec 3.12 (API) might be still needed. Does anyone = know? Phil @independentid www.independentid.com phil.hunt@oracle.com On 2014-02-18, at 1:59 PM, Julian Reschke wrote: > On 2014-02-18 22:49, Phil Hunt wrote: >>=20 >> Phil >>=20 >> @independentid >> www.independentid.com >> phil.hunt@oracle.com >>=20 >> On 2014-02-18, at 1:36 PM, Julian Reschke = wrote: >>=20 >>> On 2014-02-18 22:26, Phil Hunt wrote: >>>> This is a common REST practice. We probably need to have a = reference for this item. >>>=20 >>> Define "common REST practice". >>=20 >> I've seen this in books and on the web. I don't have any particular = references right now=85that's my point, we need one. >>>=20 >>>> As to whether it is needed, it would be interesting to know if = anyone in the group is worried about firewalls limiting use of PATCH and = DELETE, etc. >>>=20 >>> a) I assume most write operations go over https anyway, so this is = not a concern. >>=20 >> This isn't an HTTPS vs HTTP issue AFAIK (though SCIM communication = should always be on HTTPS). It is a firewall policy issue. This could = happen in some mobile gateways as well. Though I am not sure how it = would impact a client using SCIM. I just know these limitations are out = there in the real world. >=20 > If it's HTTPS then the firewall can only intercept by breaking up TLS. = In which case you probably have bigger problems :-) >=20 > So please collect evidence before doing something that is outside our = (IETF) specs. >=20 >> ... >=20 > Best regards, Julian >=20 > _______________________________________________ > scim mailing list > scim@ietf.org > https://www.ietf.org/mailman/listinfo/scim From nobody Tue Feb 18 14:57:40 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BC5E31A0406 for ; Tue, 18 Feb 2014 14:57:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N5dNM9QQZr1F for ; Tue, 18 Feb 2014 14:57:37 -0800 (PST) Received: from mout.gmx.net (mout.gmx.net [212.227.17.20]) by ietfa.amsl.com (Postfix) with ESMTP id ADAC41A026A for ; Tue, 18 Feb 2014 14:57:36 -0800 (PST) Received: from [192.168.1.103] ([84.187.55.60]) by mail.gmx.com (mrgmx103) with ESMTPSA (Nemesis) id 0Lrw2c-1XI0YM0HyY-013bMj for ; Tue, 18 Feb 2014 23:57:32 +0100 Message-ID: <5303E558.1000002@gmx.de> Date: Tue, 18 Feb 2014 23:57:28 +0100 From: Julian Reschke User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.3.0 MIME-Version: 1.0 To: Phil Hunt References: <52DFA17F.8070305@gmx.de> <59379804-1702-460F-9253-B738CFE63CAF@oracle.com> <5303D269.5030100@gmx.de> <5303D7B6.5070506@gmx.de> In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-Provags-ID: V03:K0:G+XIM8r1yBIA8yl8Cua/dvNoSFtIsFtRXYFbS8sbpAdC9fW18KW OIZi+zD3NhEkm2/bn4ydUL/57D/jSZANOkX8jqe0H4QFfkxvWF9dwyn9xCCZH4mnokU87rq 9pT1p5yj9y7glLmr0AAS9xrcVNhsAKHSpVGoZ7reFkiJNLyf7zOcB/9vKPrwgM9xaMveLCa Rf6zgq5zR4aePbPE4shkg== Archived-At: http://mailarchive.ietf.org/arch/msg/scim/U3inbCVzU-WRe8FoU40J3KKMSgk Cc: "scim@ietf.org WG" Subject: Re: [scim] http://tools.ietf.org/html/draft-ietf-scim-api-02#section-3.12: "X-HTTP-Method-Override" X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Feb 2014 22:57:38 -0000 On 2014-02-18 23:43, Phil Hunt wrote: > What about Proxies? Gateways? Limited client libraries? Maybe. Do you have something concrete? For instance, svn has been using DLETE, PUT and WebDAV methods for almost a decade now, without any overrides (as far as I can tell). > It is incredibly common practice. I did a search for HTTP Method Override and got 1000s of hits. But I couldn't find citable reference. It is something that Google, Microsoft, and many many others (including Jersey) have been supporting for some time. It seems to be accepted common practice that has not been formally standardized. > > I agree with you, but I just want to confirm, since it was in the spec from SCIM 1, why Sec 3.12 (API) might be still needed. Does anyone know? Yes. Please think about it and check. Either it's needed (in which case it needs a proper spec), or it's not. Best regards, Julian From nobody Tue Feb 18 16:07:31 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D7FE61A020D for ; Tue, 18 Feb 2014 16:07:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.748 X-Spam-Level: X-Spam-Status: No, score=-4.748 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2FkJHuIodKra for ; Tue, 18 Feb 2014 16:07:27 -0800 (PST) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) by ietfa.amsl.com (Postfix) with ESMTP id F02341A010A for ; Tue, 18 Feb 2014 16:07:26 -0800 (PST) Received: from acsinet21.oracle.com (acsinet21.oracle.com [141.146.126.237]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s1J07LfP002457 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Wed, 19 Feb 2014 00:07:21 GMT Received: from userz7021.oracle.com (userz7021.oracle.com [156.151.31.85]) by acsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1J07KD3024590 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Wed, 19 Feb 2014 00:07:20 GMT Received: from abhmp0007.oracle.com (abhmp0007.oracle.com [141.146.116.13]) by userz7021.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1J07J4B018021; Wed, 19 Feb 2014 00:07:19 GMT Received: from dhcp-whq-twvpn-3-vpnpool-10-159-235-38.vpn.oracle.com (/10.159.235.38) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 18 Feb 2014 16:07:19 -0800 Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\)) From: Phil Hunt In-Reply-To: <5303E558.1000002@gmx.de> Date: Tue, 18 Feb 2014 16:07:19 -0800 Content-Transfer-Encoding: quoted-printable Message-Id: <8269C6F4-9A25-4E49-8D4E-9A7914F1651A@oracle.com> References: <52DFA17F.8070305@gmx.de> <59379804-1702-460F-9253-B738CFE63CAF@oracle.com> <5303D269.5030100@gmx.de> <5303D7B6.5070506@gmx.de> <5303E558.1000002@gmx.de> To: Julian Reschke X-Mailer: Apple Mail (2.1510) X-Source-IP: acsinet21.oracle.com [141.146.126.237] Archived-At: http://mailarchive.ietf.org/arch/msg/scim/_0xCEMdsw6hqAeYbKKL5XhugTB8 Cc: "scim@ietf.org WG" Subject: Re: [scim] http://tools.ietf.org/html/draft-ietf-scim-api-02#section-3.12: "X-HTTP-Method-Override" X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Feb 2014 00:07:29 -0000 I have added a ticket: http://trac.tools.ietf.org/wg/scim/trac/ticket/65 Comments appreciated (either here on this thread), or directly on the = ticket. Especially from anyone who thinks we need to keep it. Phil @independentid www.independentid.com phil.hunt@oracle.com On 2014-02-18, at 2:57 PM, Julian Reschke wrote: > On 2014-02-18 23:43, Phil Hunt wrote: >> What about Proxies? Gateways? Limited client libraries? >=20 > Maybe. Do you have something concrete? For instance, svn has been = using DLETE, PUT and WebDAV methods for almost a decade now, without any = overrides (as far as I can tell). >=20 >> It is incredibly common practice. I did a search for HTTP Method = Override and got 1000s of hits. But I couldn't find citable reference. = It is something that Google, Microsoft, and many many others (including = Jersey) have been supporting for some time. It seems to be accepted = common practice that has not been formally standardized. >>=20 >> I agree with you, but I just want to confirm, since it was in the = spec from SCIM 1, why Sec 3.12 (API) might be still needed. Does anyone = know? >=20 > Yes. Please think about it and check. >=20 > Either it's needed (in which case it needs a proper spec), or it's = not. >=20 > Best regards, Julian >=20 > _______________________________________________ > scim mailing list > scim@ietf.org > https://www.ietf.org/mailman/listinfo/scim From nobody Wed Feb 19 11:48:10 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 38C901A0167 for ; Wed, 19 Feb 2014 11:48:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.048 X-Spam-Level: X-Spam-Status: No, score=-10.048 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nv8poeNvi_JK for ; Wed, 19 Feb 2014 11:48:06 -0800 (PST) Received: from alln-iport-2.cisco.com (alln-iport-2.cisco.com [173.37.142.89]) by ietfa.amsl.com (Postfix) with ESMTP id 839CA1A0135 for ; Wed, 19 Feb 2014 11:48:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=11495; q=dns/txt; s=iport; t=1392839283; x=1394048883; h=from:to:subject:date:message-id:mime-version; bh=e/uzsxO0CICrL5OZ1fIz2OVvPyBk7Vy+nV4wEjl4n5I=; b=bd9Ichfnj1n1Vvnz9OuqQOTJ9zAdHyTb4uUGFOwGIxCE7AvWUniAPgGb 8QmYySukCNK+F8VSAv/OBCXFi9XcyU6UL7gumvcmUuJdomWPJzXbddLuL kvw4rbUGY6oXqjoLAa6nKR1MAfaD9Pkm1jj1d1M++t6kGuRJ84hbZaMdB M=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AksFABUJBVOtJXHA/2dsb2JhbAA/FwOCQkQ4V8AEgRwWdIIqAkgNEyMBDw0YAQMMPCQDAQOIGA02nQSTQBGdFReMaIEoEDMBDBUHB4IXggkEmDCSJIJbUoFxOXo X-IronPort-AV: E=Sophos; i="4.97,507,1389744000"; d="scan'208,217"; a="21674395" Received: from rcdn-core2-5.cisco.com ([173.37.113.192]) by alln-iport-2.cisco.com with ESMTP; 19 Feb 2014 19:48:02 +0000 Received: from xhc-rcd-x06.cisco.com (xhc-rcd-x06.cisco.com [173.37.183.80]) by rcdn-core2-5.cisco.com (8.14.5/8.14.5) with ESMTP id s1JJm2GY004668 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL) for ; Wed, 19 Feb 2014 19:48:02 GMT Received: from xmb-rcd-x08.cisco.com ([169.254.8.225]) by xhc-rcd-x06.cisco.com ([173.37.183.80]) with mapi id 14.03.0123.003; Wed, 19 Feb 2014 13:48:02 -0600 From: "Morteza Ansari (moransar)" To: "scim@ietf.org" Thread-Topic: Next SCIM WG call agenda - Feb. 26th @11AM Pacific Thread-Index: AQHPLat/hNNCjmgUOESoQlQxmSVYGg== Date: Wed, 19 Feb 2014 19:48:02 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.3.9.131030 x-originating-ip: [10.21.73.240] Content-Type: multipart/alternative; boundary="_000_CF2A4A71CC9E2moransarciscocom_" MIME-Version: 1.0 Archived-At: http://mailarchive.ietf.org/arch/msg/scim/naS_QaMKNQXzwUoLIActd-FAxMM Subject: [scim] Next SCIM WG call agenda - Feb. 26th @11AM Pacific X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Feb 2014 19:48:09 -0000 --_000_CF2A4A71CC9E2moransarciscocom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi folks, Just a reminder that the next SCIM WG call is scheduled for Feb. 26th at 11= AM Pacific time. The agenda for that meeting is to continue going through = the backlog of the issues and prep for the London meeting. Cheers, Morteza Topic: SCIM WG bi-weekly call Date: Wednesday, February 26, 2014 Time: 11:00 am, Pacific Standard Time (San Francisco, GMT-08:00) Meeting Number: 340 844 711 Meeting Password: (This meeting does not require a password.) ------------------------------------------------------- To start the online meeting ------------------------------------------------------- 1. Go to https://go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&RT=3D= MiM0 2. If you are not logged in, log in to your account. ------------------------------------------------------- Audio conference information ------------------------------------------------------- To receive a call back, provide your phone number when you join the meeting= , or call the number below and enter the access code. US Toll Free: +1-855-749-4751 US Toll: +1-415-655-0000 Global call-in numbers: https://go.webex.com/go/globalcallin.php?serviceTyp= e=3DMC&ED=3D153193777&tollFree=3D1 Toll-free dialing restrictions: http://www.webex.com/pdf/tollfree_restricti= ons.pdf Access code:340 844 711 To check whether you have the appropriate players installed for UCF (Univer= sal Communications Format) rich media files, go to https://go.webex.com/go/= systemdiagnosis.php http://www.webex.com CCM:+14156550000x340844711# IMPORTANT NOTICE: This WebEx service includes a feature that allows audio a= nd any documents and other materials exchanged or viewed during the session= to be recorded. You should inform all meeting attendees prior to recording= if you intend to record the meeting. Please note that any such recordings = may be subject to discovery in the event of litigation. --_000_CF2A4A71CC9E2moransarciscocom_ Content-Type: text/html; charset="us-ascii" Content-ID: <14E7FE208860B246BA7F1370440194A3@emea.cisco.com> Content-Transfer-Encoding: quoted-printable
Hi folks,

Just a reminder that the next SCIM WG= call is scheduled for Feb. 26th at 11AM Pacific time.  The agenda for= that meeting is to continue going through the backlog of the issues and pr= ep for the London meeting.


Cheers,
Morteza

Topic: SCIM WG bi-weekly call 
Date: Wednesday, February 26, 2014 
Time: 11:00 am, Pacific Standard Time (San Francisco, GM= T-08:00) 
Meeting Number: 340 844 711 
Meeting Password: (This meeting does not require a passw= ord.) 

-------------------------------------------------------&= nbsp;
To start the online meeting 
-------------------------------------------------------&= nbsp;
1. Go to https:= //go.webex.com/go/j.php?ED=3D153193777&UID=3D483472947&RT=3DMiM0 
2. If you are not logged in, log in to your account.&nbs= p;

-------------------------------------------------------&= nbsp;
Audio conference information 
-------------------------------------------------------&= nbsp;
To receive a call back, provide your phone number when y= ou join the meeting, or call the number below and enter the access code.&nb= sp;
US Toll Free: +1-855-749-4751 
US Toll: +1-415-655-0000 
Global call-in numbers: https://go.webex.com/go/globalcallin.php?serviceTyp= e=3DMC&ED=3D153193777&tollFree=3D1 
Toll-free dialing restrictions: http://www.= webex.com/pdf/tollfree_restrictions.pdf =

Access code:340 844 711 
To check whether you have the appropriate players instal= led for UCF (Universal Communications Format) rich media files, go to = https://go.webex.com/go/systemdiagnosis.php 

http://www.webex.com 

CCM:+14156550000x340844711# 

IMPORTANT NOTICE: This WebEx service includes a feature = that allows audio and any documents and other materials exchanged or viewed= during the session to be recorded. You should inform all meeting attendees prior to recording if you intend t= o record the meeting. Please note that any such recordings may be subject t= o discovery in the event of litigation. 
--_000_CF2A4A71CC9E2moransarciscocom_-- From nobody Fri Feb 21 08:26:00 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE7BB1A01F1 for ; Fri, 21 Feb 2014 08:25:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.749 X-Spam-Level: X-Spam-Status: No, score=-4.749 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fWCNRQKWXMsl for ; Fri, 21 Feb 2014 08:25:57 -0800 (PST) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) by ietfa.amsl.com (Postfix) with ESMTP id 3A3F51A0170 for ; Fri, 21 Feb 2014 08:25:57 -0800 (PST) Received: from ucsinet21.oracle.com (ucsinet21.oracle.com [156.151.31.93]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s1LGPoSM016755 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Fri, 21 Feb 2014 16:25:51 GMT Received: from userz7021.oracle.com (userz7021.oracle.com [156.151.31.85]) by ucsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1LGPmar027422 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Fri, 21 Feb 2014 16:25:48 GMT Received: from abhmp0010.oracle.com (abhmp0010.oracle.com [141.146.116.16]) by userz7021.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1LGPlQN027408; Fri, 21 Feb 2014 16:25:47 GMT Received: from [192.168.1.125] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 21 Feb 2014 08:25:44 -0800 References: <062.82c921f3e0b279321f22cb7706d0e301@tools.ietf.org> <077.d26ca46b875c721b14df9f69a488e269@tools.ietf.org> Mime-Version: 1.0 (1.0) In-Reply-To: <077.d26ca46b875c721b14df9f69a488e269@tools.ietf.org> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Message-Id: <7289E20A-A9F7-4E22-AC81-8AE132996015@oracle.com> X-Mailer: iPhone Mail (11B554a) From: Phil Hunt Date: Fri, 21 Feb 2014 08:25:39 -0800 To: scim issue tracker X-Source-IP: ucsinet21.oracle.com [156.151.31.93] Archived-At: http://mailarchive.ietf.org/arch/msg/scim/rtrshxxXURKzZSMmkD5qzJ1FhXs Cc: "leifj@mnt.se" , "Chris.Phillips@canarie.ca" , "t.rossner@osiam.org" , "scim@ietf.org" Subject: Re: [scim] #11: Define a very simple language for entitlements X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Feb 2014 16:25:59 -0000 +1 Phil > On Feb 21, 2014, at 7:49, scim issue tracker wr= ote: >=20 > required' ) From nobody Fri Feb 21 11:40:40 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7F7701A024C for ; Fri, 21 Feb 2014 11:40:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.149 X-Spam-Level: X-Spam-Status: No, score=-2.149 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n_wQ0qUjH-Qb for ; Fri, 21 Feb 2014 11:40:36 -0800 (PST) Received: from smtp.nexusgroup.com (smtp.nexusgroup.com [83.241.133.120]) by ietfa.amsl.com (Postfix) with ESMTP id 972F71A0506 for ; Fri, 21 Feb 2014 11:39:46 -0800 (PST) Received: from NG-EX01.ad.nexusgroup.com (10.75.28.40) by NG-EX01.ad.nexusgroup.com (10.75.28.40) with Microsoft SMTP Server (TLS) id 15.0.775.38; Fri, 21 Feb 2014 20:39:32 +0100 Received: from NG-EX01.ad.nexusgroup.com ([fe80::1d3d:b319:f020:2bab]) by NG-EX01.ad.nexusgroup.com ([fe80::1d3d:b319:f020:2bab%12]) with mapi id 15.00.0775.031; Fri, 21 Feb 2014 20:38:56 +0100 From: =?Windows-1252?Q?Erik_Wahlstr=F6m?= To: Phil Hunt Thread-Topic: [scim] #11: Define a very simple language for entitlements Thread-Index: AQHPLyGdnfAzAdGb0EOTh3X6xO4oJJrACiGA Date: Fri, 21 Feb 2014 19:38:55 +0000 Message-ID: References: <062.82c921f3e0b279321f22cb7706d0e301@tools.ietf.org> <077.d26ca46b875c721b14df9f69a488e269@tools.ietf.org> <7289E20A-A9F7-4E22-AC81-8AE132996015@oracle.com> In-Reply-To: <7289E20A-A9F7-4E22-AC81-8AE132996015@oracle.com> Accept-Language: en-US, sv-SE Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.75.28.103] Content-Type: text/plain; charset="Windows-1252" Content-ID: <04485324EF5BB640AEDBC182F493A2E7@nexusgroup.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: http://mailarchive.ietf.org/arch/msg/scim/g_9Kl82H2RJGDMdV9HYmba_2rdw Cc: "leifj@mnt.se" , "Chris.Phillips@canarie.ca" , "t.rossner@osiam.org" , scim issue tracker , "scim@ietf.org" Subject: Re: [scim] #11: Define a very simple language for entitlements X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Feb 2014 19:40:39 -0000 +1 for won=92t fix. / Erik On 21 Feb 2014, at 17:25, Phil Hunt wrote: > +1 >=20 > Phil >=20 >> On Feb 21, 2014, at 7:49, scim issue tracker = wrote: >>=20 >> required' ) >=20 > _______________________________________________ > scim mailing list > scim@ietf.org > https://www.ietf.org/mailman/listinfo/scim From nobody Mon Feb 24 10:39:45 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 251091A019C for ; Mon, 24 Feb 2014 10:39:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.848 X-Spam-Level: X-Spam-Status: No, score=-2.848 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.547, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7-e2uEJHlIYg for ; Mon, 24 Feb 2014 10:39:41 -0800 (PST) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) by ietfa.amsl.com (Postfix) with ESMTP id 4E1E21A0189 for ; Mon, 24 Feb 2014 10:39:41 -0800 (PST) Received: from acsinet21.oracle.com (acsinet21.oracle.com [141.146.126.237]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s1OIdewJ011423 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Mon, 24 Feb 2014 18:39:40 GMT Received: from userz7022.oracle.com (userz7022.oracle.com [156.151.31.86]) by acsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s1OIddRl015728 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 24 Feb 2014 18:39:39 GMT Received: from abhmp0001.oracle.com (abhmp0001.oracle.com [141.146.116.7]) by userz7022.oracle.com (8.14.5+Sun/8.14.4) with ESMTP id s1OIdcIC006315 for ; Mon, 24 Feb 2014 18:39:38 GMT Received: from [192.168.1.124] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 24 Feb 2014 10:39:38 -0800 From: Phil Hunt Content-Type: multipart/alternative; boundary="Apple-Mail=_3F7B2948-4E0A-45FD-801E-047A02365764" Message-Id: Date: Mon, 24 Feb 2014 10:39:36 -0800 To: "scim@ietf.org WG" Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\)) X-Mailer: Apple Mail (2.1510) X-Source-IP: acsinet21.oracle.com [141.146.126.237] Archived-At: http://mailarchive.ietf.org/arch/msg/scim/J1Fj-nmx2nsl3lz-4XGXi-EbZBI Subject: [scim] New PATCH proposal based on RFC6902 (Ticket 18) X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 Feb 2014 18:39:44 -0000 --Apple-Mail=_3F7B2948-4E0A-45FD-801E-047A02365764 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii FYI, I have updated Ticket 18 with a new proposal for PATCH that is = based on RFC6902. We would basically use 6902 as is, except that 6902's "path" attribute = would use SCIM notation (E.g. :address[type eq "work" and value = ew "example.com"] ) rather than 6902's xpath "/" notation. This solves = an issue with multi-value selection since it would be hard to envision a = "/" notation that would work with our complex attributes. It also = leverages the new filter mechanism we have for selecting a particular = record of a complex multi-valued attribute. =20 Please take a look. http://trac.tools.ietf.org/wg/scim/trac/ticket/18 This is just one possible alternative way. Comments or other proposals = appreciated! Phil @independentid www.independentid.com phil.hunt@oracle.com --Apple-Mail=_3F7B2948-4E0A-45FD-801E-047A02365764 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii FYI, = I have updated Ticket 18 with a new proposal for PATCH that is based on = RFC6902.

We would basically use 6902 as is, except = that 6902's "path" attribute would use SCIM notation (E.g. =  <schema>:address[type eq "work" and value ew "example.com"] ) rather than 6902's = xpath "/" notation. This solves an issue with multi-value selection = since it would be hard to envision a "/" notation that would work with = our complex attributes.  It also leverages the new filter mechanism = we have for selecting a particular record of a complex multi-valued = attribute.  


This is = just one possible alternative way. Comments or other proposals = appreciated!

= --Apple-Mail=_3F7B2948-4E0A-45FD-801E-047A02365764-- From nobody Tue Feb 25 12:22:12 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C5BF91A02C5 for ; Tue, 25 Feb 2014 12:22:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s3ELjQaCDT_h for ; Tue, 25 Feb 2014 12:22:00 -0800 (PST) Received: from mail-wi0-f179.google.com (mail-wi0-f179.google.com [209.85.212.179]) by ietfa.amsl.com (Postfix) with ESMTP id 7F7371A06E8 for ; Tue, 25 Feb 2014 12:21:48 -0800 (PST) Received: by mail-wi0-f179.google.com with SMTP id bs8so1281798wib.6 for ; Tue, 25 Feb 2014 12:21:47 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:content-type:content-transfer-encoding :mime-version:subject:message-id:date:to; bh=F8h+f2TOUSUS97424Z85b8i26Pv0mZnR8QxHtWqiTKg=; b=BnmO5cRbY59kmmj75zhiCwwPifbfij8OLOmqURJf9LkY+u2JENfkXbFpexPCvhy5y5 ABwekHlVidtCN3062WgDzUZSt1PP3LyK44Mcs2AeS0GrBC4zBsooNiukvfXwmAr3LMr2 IrcG4SbBGOse5rWjJUWpWmM3wYqnJDtzlKboTtMWZKq1h57B4fRc4wXoDhzAgKbEfQgQ elvEWj5CAwjcwE6v1jEYciMR3gJS5gdAk4ZeM5LbjYJC/kdej8+C8K+LlQbkpg7RM9HC 16MOXiiEjyA5V/rSiSKnikRM9bQ/rfl7vIl4EyBFkoLo1m0bpSVIlbfGIsNQ99ZJo+p8 1dEw== X-Gm-Message-State: ALoCoQlVi5j7i+5MLJtscCj8dpv57ABWSc8NmeW3JE9Nubrf3w9KI75jV2T4Bv+Y0x/apwsC8WXk X-Received: by 10.180.19.69 with SMTP id c5mr4742180wie.7.1393359707031; Tue, 25 Feb 2014 12:21:47 -0800 (PST) Received: from [192.168.0.100] ([109.144.250.167]) by mx.google.com with ESMTPSA id f1sm37812379wik.1.2014.02.25.12.21.45 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 25 Feb 2014 12:21:45 -0800 (PST) From: Leif Johansson Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (1.0) Message-Id: <859012D4-7EE6-4CF8-ADB5-67FCB6D5C300@mnt.se> Date: Tue, 25 Feb 2014 20:21:43 +0000 To: "scim@ietf.org" X-Mailer: iPhone Mail (11B651) Archived-At: http://mailarchive.ietf.org/arch/msg/scim/VU-eCunrhjqDGeaAE4JCjcyMWio Subject: [scim] agenda change X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 25 Feb 2014 20:22:09 -0000 Folks, We've been moved to Thursday 18:40 and there will be meetecho for the session From nobody Thu Feb 27 23:07:32 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 461E91A06F1 for ; Thu, 27 Feb 2014 23:07:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.748 X-Spam-Level: X-Spam-Status: No, score=-4.748 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.547, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id heGbECyelHye for ; Thu, 27 Feb 2014 23:07:25 -0800 (PST) Received: from lhrrgout.huawei.com (lhrrgout.huawei.com [194.213.3.17]) by ietfa.amsl.com (Postfix) with ESMTP id 1AF761A072A for ; Thu, 27 Feb 2014 23:07:23 -0800 (PST) Received: from 172.18.7.190 (EHLO lhreml204-edg.china.huawei.com) ([172.18.7.190]) by lhrrg01-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id BEB38239; Fri, 28 Feb 2014 07:07:21 +0000 (GMT) Received: from LHREML405-HUB.china.huawei.com (10.201.5.242) by lhreml204-edg.china.huawei.com (172.18.7.223) with Microsoft SMTP Server (TLS) id 14.3.158.1; Fri, 28 Feb 2014 07:07:01 +0000 Received: from SZXEMA409-HUB.china.huawei.com (10.82.72.41) by lhreml405-hub.china.huawei.com (10.201.5.242) with Microsoft SMTP Server (TLS) id 14.3.158.1; Fri, 28 Feb 2014 07:07:15 +0000 Received: from SZXEMA510-MBX.china.huawei.com ([169.254.3.94]) by SZXEMA409-HUB.china.huawei.com ([10.82.72.41]) with mapi id 14.03.0158.001; Fri, 28 Feb 2014 15:07:10 +0800 From: Bert Greevenbosch To: "scim@ietf.org" Thread-Topic: Comments on SCIM use cases draft Thread-Index: Ac80U7F22qnyVrgbSjS4DDnIQc0t+Q== Date: Fri, 28 Feb 2014 07:07:09 +0000 Message-ID: <46A1DF3F04371240B504290A071B4DB63E44C4D1@SZXEMA510-MBX.china.huawei.com> Accept-Language: en-GB, zh-CN, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.66.162.63] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: http://mailarchive.ietf.org/arch/msg/scim/WkU4pLGIWoxzph8Twa63wHOU1Zw Subject: [scim] Comments on SCIM use cases draft X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Feb 2014 07:07:27 -0000 Hi all, I have reviewed the SCIM use cases draft: http://tools.ietf.org/html/draft-ietf-scim-use-cases-00 I have some comments listed below. I think they are not too difficult to ha= ndle. :-) Best regards, Bert --- [BG1] Section 2.2.1, 3d line: change "identity" to "identify". [BG2] Section 2.2.1, the abbreviation "C.R.U.D." is expanded, whereas "SSO"= is not. I suggest to expand SSO too. [BG3] Section 2.2.1, I am not clear on the various triggers. Each item has = the name of a trigger, but in the description there is another name of a tr= igger. For example, in the first item there is "Create SCIM Identity Resour= ce - Service On-boarding Trigger", and in the description "create SCIM reso= urce trigger". Are these the same? Then use a single name. Also, for readab= ility I suggest to put the name between quotes, e.g. "create SCIM resource"= trigger. [BG4] Section 2.2.1, first item last sentence, add ", and" between "impleme= ntation" and "not to the use cases". [BG5] Section 2.2.2, second item: replace "entitle" by "entity". [BG6] Section 2.2.2, third item: replace "end-end" by "end". [BG7] Section 2.2.3, "real work use cases" -> "real world use cases". [BG8] Section 2.3.3: "This use case highlights how different CSPs may imple= ment different operational semantics behind the same SCIM operation. Note t= hat CSP-1 suspends the account representation for its service whereas CPS-2= implements a true delete operation." Interesting idea. Is it truly desired to have different CSPs treat the same= request differently? Obviously there will always be some difference betwee= n implementations, but this difference seems quite big. On the other hand, maybe this is also not truly the same SCIM operation, si= nce CSP-1 receives the trigger from the ECS, whereas CSP-2 receives a termi= nation request from CSP-1. [BG9] Section 2.2.4, last sentence: "However, rather than pre-provisioning accounts from ECS-1 to CSP-1, CSP-1 = waits for a service access request from the Cloud Service User (CSU-1) unde= r the control domain of ECS-1, before issuing an account Pull request to CS= P-1." Something seems wrong in this sentence, as it seems to say that CSP-1 issue= s a Pull request to itself. Maybe the account Pull request is sent to "ECS-= 1", not to "CSP-1"? [BG10] In various use cases, there are requirements for logs. However, ther= e is no text in the use cases itself. Maybe it would be better to elaborate= a bit on the logs in the use cases? This should also involve the mentioned= auditing. [BG11] Section 3.4, the sentence "The local YourCoI offices are responsible= for establishing personal information and (i.e., setting the user identiti= es and attributes)." needs wordsmithing. [BG12] Section 3.4, "Identity management of the personal data must be secur= e" is a bit vague. I guess it means protected against unauthorised access a= nd remaining confidentiality? Then maybe the following wording would be bet= ter: "Identity management of the personal data must be protected against un= authorised access and remain confidential to only authorised parties." [BG13] Section 3.5: should there be a requirement for expiration of the cac= hed copy, i.e. a maximum period for which the relying party may cache the i= nformation? [BG14] The "security considerations" section is rather short, only mentioni= ng authorisation and authentication. It would be good to add some text abou= t confidentiality and privacy protection. From nobody Fri Feb 28 10:37:47 2014 Return-Path: X-Original-To: scim@ietfa.amsl.com Delivered-To: scim@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4FFC81A0197 for ; Fri, 28 Feb 2014 10:37:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.382 X-Spam-Level: * X-Spam-Status: No, score=1.382 tagged_above=-999 required=5 tests=[BAYES_50=0.8, HELO_EQ_SE=0.35, RP_MATCHES_RCVD=-0.547, SPF_NEUTRAL=0.779] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DBgWKdxYwZ58 for ; Fri, 28 Feb 2014 10:37:42 -0800 (PST) Received: from e-mailfilter01.sunet.se (e-mailfilter01.sunet.se [IPv6:2001:6b0:8:2::201]) by ietfa.amsl.com (Postfix) with ESMTP id 747131A0144 for ; Fri, 28 Feb 2014 10:37:42 -0800 (PST) Received: from smtp1.sunet.se (smtp1.sunet.se [IPv6:2001:6b0:8:2::214]) by e-mailfilter01.sunet.se (8.14.4/8.14.4/Debian-4) with ESMTP id s1SIbdDm011834 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Fri, 28 Feb 2014 19:37:39 +0100 Received: from kerio.sunet.se (kerio.sunet.se [192.36.171.210]) by smtp1.sunet.se (8.14.4/8.14.4) with ESMTP id s1SIbacg022000 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 28 Feb 2014 19:37:39 +0100 (CET) X-Footer: c3VuZXQuc2U= Received: from [10.100.50.167] ([158.230.100.10]) (authenticated user leifj@sunet.se) by kerio.sunet.se (Kerio Connect 8.2.2) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128 bits)) for scim@ietf.org; Fri, 28 Feb 2014 19:37:35 +0100 Message-ID: <5310D76F.5070803@sunet.se> Date: Fri, 28 Feb 2014 19:37:35 +0100 From: Leif Johansson User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.3.0 MIME-Version: 1.0 To: "scim@ietf.org" X-Enigmail-Version: 1.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Bayes-Prob: 0.0001 (Score 0, tokens from: outbound, sunet-se:default, base:default, @@RPTN) X-CanIt-Geo: ip=192.36.171.210; country=SE; latitude=62.0000; longitude=15.0000; http://maps.google.com/maps?q=62.0000,15.0000&z=6 X-CanItPRO-Stream: outbound-sunet-se:outbound (inherits from outbound-sunet-se:default, sunet-se:default, base:default) X-Canit-Stats-ID: 09LvSBDch - 9ff1a8d0e4ab - 20140228 X-CanIt-Archive-Cluster: PfMRe/vJWMiXwM2YIH5BVExnUnw X-Scanned-By: CanIt (www . roaringpenguin . com) Archived-At: http://mailarchive.ietf.org/arch/msg/scim/WPmcayM1TLrxBaUO-ip_d0Xd5CI Subject: [scim] agenda X-BeenThere: scim@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Simple Cloud Identity Management BOF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Feb 2014 18:37:44 -0000 The draft agenda is online now. Pretty basic: keep wacking away at the issues.