Subject: [scim] unknown attribute type in attribute selection parameter

From: Dale Olds <[email-masked]>
Date: Wed, 9 May 2018 14:52:09 -0700

I have a question regarding how a SCIM server should handle unknown 
attribute names in an attribute selection parameter. The SCIM 2.0 spec, 
section 3.9, defines the "attributes" parameter. We're seeing an 
implementation that returns an error if one of the given attribute types 
is unknown to that server.

 From previous experience working with directory services it was very 
important that servers not return an error, but simply ignore that 
attribute since resources will not contain a value for it. This allowed 
for requests to be coded in a more portable fashion. If an app really 
needed to know what schema was supported, it could query the schema.

However, in looking over the SCIM 2.0 spec, I can't find anything that 
would directly address this case. It is somewhat indirectly addressed in 
that I can't find an error defined for invalid or undefined attribute type.

Is there an expected behavior for this situation or is it up to the 
server implementation?

--Dale Olds

---

From: Phil Hunt <[email-masked]>
Date: Thu, 10 May 2018 19:19:51 -0700

Dale

I believe your view is correct. 

The spec is a bit weak on the processing rules for the attributes parameter. 

One would expect behavior consistent with the filter rules which say undefined attributes can be evaluated as null or false etc. 

Phil

> On May 9, 2018, at 2:52 PM, Dale Olds <[email-masked]> wrote:
> 
> I have a question regarding how a SCIM server should handle unknown attribute names in an attribute selection parameter. The SCIM 2.0 spec, section 3.9, defines the "attributes" parameter. We're seeing an implementation that returns an error if one of the given attribute types is unknown to that server. 
> 
> From previous experience working with directory services it was very important that servers not return an error, but simply ignore that attribute since resources will not contain a value for it. This allowed for requests to be coded in a more portable fashion. If an app really needed to know what schema was supported, it could query the schema.
> 
> However, in looking over the SCIM 2.0 spec, I can't find anything that would directly address this case. It is somewhat indirectly addressed in that I can't find an error defined for invalid or undefined attribute type. 
> 
> Is there an expected behavior for this situation or is it up to the server implementation? 
> 
> --Dale Olds
> _______________________________________________
> scim mailing list
> [email-masked]
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_scim&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=pb0U4X3Kl2WACP79HHA7FmtCfg6YoFmk97APnIwAGrM&s=9BqVUKO4TTZGgD7H4U1tHHM7ZvxspP3xipmcFjyfWaE&e=

---

From: Dale Olds <[email-masked]>
Date: Thu, 10 May 2018 19:34:15 -0700

Thanks, Phil. I agree that the behavior should be consistent with filter 
rules, but I didn't see where the Filtering section mentioned undefined 
attributes. By searching for "undefined" I see what you describe is 
there, in the Query Endpoints section. Odd, but good enough. Thanks again.

--Dale

---

From: Phil Hunt <[email-masked]>
Date: Thu, 10 May 2018 19:52:26 -0700

Dale

This is what I was thinking of. 

3.4.2.1
> When processing query operations using endpoints that include more than one SCIM resource type (e.g., a query from the server root endpoint), filters MUST be processed as outlined in Section 3.4.2.2. For filtered attributes that are not part of a particular resource type, the service provider SHALL treat the attribute as if there is no attribute value. For example, a presence or equality filter for an undefined attribute evaluates to false.

Cheers,

Phil

> On May 10, 2018, at 7:34 PM, Dale Olds <[email-masked]> wrote:
> 
> Thanks, Phil. I agree that the behavior should be consistent with filter rules, but I didn't see where the Filtering section mentioned undefined attributes. By searching for "undefined" I see what you describe is there, in the Query Endpoints section. Odd, but good enough. Thanks again. 
> 
> --Dale  
>