Subject: [scim] Fwd: Escape search filter values

From: Mark Dobrinic <[email-masked]>
Date: Mon, 5 Nov 2018 09:50:28 +0100

Hi guys,

have posted this question a month ago and didn't get a follow up.
Anybody has thoughts on it?

Thanks,

Mark

-------- Forwarded Message --------
Subject: 	Escape search filter values
Date: 	Wed, 3 Oct 2018 17:37:07 +0200
From: 	Mark Dobrinic <[email-masked]>
To: 	[email-masked]

Hi scim,

I've got a question on how to escape values that are part of the search
filter query in scim 2.

For example, when sending out a search request for a user with a
password, we're posting a JSON-message like this to our SCIM server:

{
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:SearchRequest"
    ],
    "filter": "userName eq \"teddie\" and password eq "\secret\""
}

But when the password contains control characters, like a double-quote
(") or backslash (\), what should we send to the other end?

For now, we've been following the JSON approach, and are JSON-escaping
the values inside the filter, such that when the password would be
'sec"ret', the JSON-message as it would be sent over becomes:

{
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:SearchRequest"
    ],
    "filter": "userName eq \"teddie\" and password eq "\sec\\\"ret\""
}

... but I could not find out how to deal with this in the spec.

What do you think is the right thing to do here?

-- 
Regards,

Mark Dobrinic
Software Engineer and Identity Specialist
Curity AB

[email-masked]
www.curity.io

---

From: Phil Hunt <[email-masked]>
Date: Mon, 5 Nov 2018 09:26:36 -0800

Mark

You are correct. Per sec 3.1, SCIM uses RFC7159/JSON for protocol payload messages as well as resources. 

Iow. Escape as specified in json. 

Phil

> On Nov 5, 2018, at 12:50 AM, Mark Dobrinic <[email-masked]> wrote:
> 
> Hi guys, 
> 
> .... but I could not find out how to deal with this in the spec.
> 
> _______________________________________________
> scim mailing list
> [email-masked]
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_scim&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=yuuDrNYVFRE1h4L9M7aHG0iY0D9sKoCorF5SKqb_du0&s=QOewzWBRy4HUgd1QL4mtSXaUd_2SaGPHnZxOuwpIl1I&e=

---

From: Mark Dobrinic <[email-masked]>
Date: Tue, 6 Nov 2018 09:59:25 +0100

Hi Phil,

Gotcha, and thanks for that!

We'll continue with the JSON-encoding approach.

Kind regards,

Mark

On 05/11/18 18:26, Phil Hunt wrote:
> On Nov 5, 2018, at 12:50 AM, Mark Dobrinic <[email-masked]
> <mailto:[email-masked]>> wrote:
>
>> Hi guys,
>>
>> [email-masked] <mailto:[email-masked]>

-- 
Regards,

Mark Dobrinic

[email-masked]
www.curity.io