Subject: [scim] Clarification on expected response to single resource request with query parameters

From: "Vella, Shon" <[email-masked]>
Date: Wed, 2 Nov 2016 15:28:43 -0600

I just starting an implementation of the SCIM 2.0 specification and I found
something that seems a little ambiguous in the RFC 7644.

In section 3.4.1 if I GET /Users/{id I will get back on object of schema
urn:ietf:params:scim:schemas:core:2.0:User. What it does not say, but can
be inferred by section 3.12 is that if the resource doesn't exist, it
should return status code 404 with associated
urn:ietf:params:scim:api:messages:2.0:Error
message.

But in section 3.4.2 it says "Queries MAY be made against a single
resource...", "Responses MUST be identified using the following URI:
"urn:ietf:params:scim:api:messages:2.0:ListResponse"", and "A query that
does not return any matches SHALL return success (HTTP  status code 200)
with "totalResults" set to a value of 0." That would seem to be in conflict
with section 3.4.1. Is the intent that the rules of 3.4.2 only apply to
queries against a single resource (/Users/{id}) if one or more of the
optional query parameters is specified?

Shon Vella
Identity Automation

---

From: Phil Hunt <[email-masked]>
Date: Wed, 2 Nov 2016 14:49:59 -0700

Vella,

If you query the /Users endpoint typically you get a ListResponse (ListResponse just allows for multiple objects to be returned).  When querying for a specific resource, the list response is not needed and just the user resource is returned.

If you query a specific resource that does not exist you just get a 404.  You typically only get an error response for a Status 400 class error.

Phil

@independentid
www.independentid.com <http://www.independentid.com/>[email-masked] <mailto:[email-masked]>

> On Nov 2, 2016, at 2:28 PM, Vella, Shon <[email-masked]> wrote:
> 
> I just starting an implementation of the SCIM 2.0 specification and I found something that seems a little ambiguous in the RFC 7644.
> 
> In section 3.4.1 if I GET /Users/{id I will get back on object of schema urn:ietf:params:scim:schemas:core:2.0:User. What it does not say, but can be inferred by section 3.12 is that if the resource doesn't exist, it should return status code 404 with associated urn:ietf:params:scim:api:messages:2.0:Error message.
> 
> But in section 3.4.2 it says "Queries MAY be made against a single resource...", "Responses MUST be identified using the following URI: "urn:ietf:params:scim:api:messages:2.0:ListResponse"", and "A query that does not return any matches SHALL return success (HTTP  status code 200) with "totalResults" set to a value of 0." That would seem to be in conflict with section 3.4.1. Is the intent that the rules of 3.4.2 only apply to queries against a single resource (/Users/{id}) if one or more of the optional query parameters is specified?
> 
> Shon Vella
> Identity Automation
> 
> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim

---

From: "Vella, Shon" <[email-masked]>
Date: Wed, 2 Nov 2016 16:39:32 -0600

But if I query, for example, GET /Users/abc123?filter=whatever and user
abc123 exists but doesn't match the filter?

Or even better GET /Users/abc123?startIndex=2&itemsPerPage=1

Shon Vella
Identity Automation

On Wed, Nov 2, 2016 at 4:34 PM, Vella, Shon <[email-masked]>
wrote:

> But if I query, for example, GET /Users/abc123?filter=whatever and user
> abc123 exists but doesn't match the filter?
>
> Or even better GET /Users/abc123?startIndex=2&itemsPerPage=1
>
> *Shon Vella*
> *Identity Automation*
> Manager of Product Engineering
> 281-220-0021 x2030 office
> 281-817-5579 fax
> www.identityautomation.com
>
> On Wed, Nov 2, 2016 at 3:49 PM, Phil Hunt <[email-masked]> wrote:
>
>> Vella,
>>
>> If you query the /Users endpoint typically you get a ListResponse
>> (ListResponse just allows for multiple objects to be returned).  When
>> querying for a specific resource, the list response is not needed and just
>> the user resource is returned.
>>
>> If you query a specific resource that does not exist you just get a 404.
>> You typically only get an error response for a Status 400 class error.
>>
>> Phil
>>
>> @independentid
>> www.independentid.com
>> [email-masked]
>>
>>
>>
>>
>>
>> I just starting an implementation of the SCIM 2.0 specification and I
>> found something that seems a little ambiguous in the RFC 7644.
>>
>> urn:ietf:params:scim:schemas:core:2.0:User. What it does not say, but
>> can be inferred by section 3.12 is that if the resource doesn't exist, it
>> should return status code 404 with associated urn:ietf:params:scim:api:
>> messages:2.0:Error message.
>>