Subject: [scim] [Technical Errata Reported] RFC7644 (4690)

From: RFC Errata System <[email-masked]>
Date: Tue, 10 May 2016 15:47:50 -0700 (PDT)

The following errata report has been submitted for RFC7644,
"System for Cross-domain Identity Management: Protocol".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=7644&eid=4690

--------------------------------------
Type: Technical
Reported by: Phil Hunt <[email-masked]>

Section: 3.4.2.2

Original Text
-------------
valFilter = attrExp / logExp / *1"not" "(" valFilter ")"

Corrected Text
--------------
valFilter = attrExp / valLogExp / *1"not" "(" valFilter ")"

valLogExp = attrExp SP ("and" / "or") SP attrExp

Notes
-----
Figure 1 contains the ABNF for SCIM filters. The term "logExp" specifies "FILTER" as an option which unintentionally allows recursion. A valFilter should only allow simple sub-attribute expressions and simple logic.  Nesting of valuePath (e.g. attr[a eq b and attr[c eq d]]) should not be possible.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party (IESG)
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC7644 (draft-ietf-scim-api-19)
--------------------------------------
Title               : System for Cross-domain Identity Management: Protocol
Publication Date    : September 2015
Author(s)           : P. Hunt, Ed., K. Grizzle, M. Ansari, E. Wahlstroem, C. Mortimore
Category            : PROPOSED STANDARD
Source              : System for Cross-domain Identity Management
Area                : Applications and Real-Time
Stream              : IETF
Verifying Party     : IESG

---

From: Phil Hunt <[email-masked]>
Date: Tue, 10 May 2016 18:56:15 -0700

FYI. This is the issue raised by Steve Moyer. 

I agree this too should go to the RFC editor should others agree. 

Phil

> On May 10, 2016, at 15:47, RFC Errata System <[email-masked]> wrote:
>

---

From: Christopher Harm <[email-masked]>
Date: Wed, 11 May 2016 10:28:20 -0400 (EDT)

Phil,
Doesn't the correction text prevent attr[a eq b and c eq d and e eq f].  valLogExp has no way to recurse back up and allow more than a simple logic expression. I presume that attr[a eq b and c eq d and e eq f] should be allowed.  I think that the valLogExp should refer back to the valFilter so that it can recurse back up and include another valLogExp if necessary.

Corrected Text
--------------

valLogExp = valFilter SP ("and" / "or") SP valFilter

-Chris

--
Christopher Harm
Penn State University
221 Technology Support Building
300 Science Park Road
State College, PA 16803
814-863-3366

https://keybase.io/christopherharm

----- Original Message -----
From: "RFC Errata System" <[email-masked]>
To: "phil hunt" <[email-masked]>, "kelly grizzle" <[email-masked]>, "morteza ansari" <[email-masked]>, "erik wahlstrom" <[email-masked]>, [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked]
Cc: [email-masked], "phil hunt" <[email-masked]>, [email-masked]
Sent: Tuesday, May 10, 2016 6:47:50 PM
Subject: [scim] [Technical Errata Reported] RFC7644 (4690)

Section: 3.4.2.2

Original Text
-------------

Corrected Text
--------------

Notes
-----

Instructions:
-------------

_______________________________________________
scim mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/scim

---

From: Phil Hunt <[email-masked]>
Date: Wed, 11 May 2016 08:31:52 -0700

That is what valLogExp does. It allows another valFilter which could be another and or or clause. 

Phil

> On May 11, 2016, at 07:28, Christopher Harm <[email-masked]> wrote:
> 
> Phil,

---

From: Phil Hunt <[email-masked]>
Date: Wed, 11 May 2016 08:32:46 -0700

Chris,

Ignore my last. 

The second line should be as you expressed it!

Phil