Subject: [scim] How to patch multi-valued nested attributes?

From: Aleksey Chernoraenko <[email-masked]>
Date: Mon, 25 Feb 2019 12:37:07 -0600

Hello,

In our SCIM Resource Provider we have resources that have the nested
multi-valued attributes. It looks like this:
GET /GroupSets/98ae2a7c-40a5-4fff-b59a-5b922908239e
{    ...
    "name": "collection #1",
    "groups": [ {
        "value": "a0115001-0fd7-4b50-b7b4-ac29d57cc623",
        "$ref": ".../groups/a0115001-0fd7-4b50-b7b4-ac29d57cc623",
        ...
        }, ...
    ], ...
}

We use groups endpoint when we update group members, like
PATCH /Groups/a0115001-0fd7-4b50-b7b4-ac29d57cc623
{   ...
    "operations": [ {
        "op": "add", "path": "members", "value":
"db81119f-5ee0-464e-b7e3-51573b62b56a"
        } ]
}

I understand how the request should look like if I want to update one group
members via parent (groupset) endpoint:
PATCH /GroupSets/98ae2a7c-40a5-4fff-b59a-5b922908239e
{   ...
    "operations": [ {
        "op": "add", "path": "groups[value eq
\"a0115001-0fd7-4b50-b7b4-ac29d57cc623\"].members", ...
        } ]
}

but wonder how I can specify "members" from all or a filtered set of
"groups" without enumeration all of them on client side?

The path value might look like "groups[].members", or "groups[*].members",
or even "groups.members".

It seems that the spec leaves this question open. What should or can happen
if more than one group would be found?

---
Thank you,
Alexei

---

From: Phil Hunt <[email-masked]>
Date: Mon, 25 Feb 2019 11:09:57 -0800

Aleksey

Unfortunately there is no mass-update style function in SCIM. PATCH only impacts one specific resource at a time. By design each transaction impacts only a single resource at a time. Even inside of “bulk” the transaction semantics a per resource.

You really have to do this in two or more steps.  

1. Query for a set of resources that need updating
2. Apply the patch to each resource

For step 2, you can do as multiple calls for each resource, or be as a “bulk” request if supported by the provider.

Phil Hunt | Cloud Security and Identity Architect
Oracle Corporation, Oracle Cloud Infrastructure
@independentid
www.independentid.com
[email-masked]

> On Feb 25, 2019, at 10:37 AM, Aleksey Chernoraenko <[email-masked]> wrote:
> 
> Hello,
> 
> In our SCIM Resource Provider we have resources that have the nested multi-valued attributes. It looks like this:
>         "op": "add", "path": "members", "value": "db81119f-5ee0-464e-b7e3-51573b62b56a" 
>         } ]
> }
> 
> I understand how the request should look like if I want to update one group members via parent (groupset) endpoint:
>         "op": "add", "path": "groups[value eq \"a0115001-0fd7-4b50-b7b4-ac29d57cc623\"].members", ...
>         } ]
> }
> 
> but wonder how I can specify "members" from all or a filtered set of "groups" without enumeration all of them on client side?
> 
> The path value might look like "groups[].members", or "groups[*].members", or even "groups.members".
> 
> It seems that the spec leaves this question open. What should or can happen if more than one group would be found?
> 
> ---
> Thank you,
> Alexei
> 
> _______________________________________________
> scim mailing list
> [email-masked]
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_scim&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=J5uAPT1VUXS--3Zqx02iJFx-Kh1FYPojmNLiY1UIV9c&s=3pJVZK_E4QPr_rZxk8h7qoWTXDo2XRCEJTDhYKRAgD0&e=

---

From: Aleksey Chernoraenko <[email-masked]>
Date: Mon, 25 Feb 2019 16:31:56 -0600

Thank you for response!

> For step 2, you can do as multiple calls for each resource, or be as a “bulk” request if supported by the provider.

This probably might be "worked around" as a PATCH request to groups
endpoint with query parameters.
It would be like a “bulk” request but in more declarative way, I guess.

PATCH /Groups?groupSet=98ae2a7c-40a5-4fff-b59a-5b922908239e
{   ...
    "operations": [ {
        "op": "add", "path": "members", "value":
"db81119f-5ee0-464e-b7e3-51573b62b56a"
        } ]
}

Would it be still SCIM compliant?

---
Alexei

---

From: Phil Hunt <[email-masked]>
Date: Mon, 25 Feb 2019 14:40:46 -0800

No it would not be compliant  

Scim as a restful api can only impact one resource at a time. 

To enhnce would require a new draft. 

Phil

> On Feb 25, 2019, at 2:31 PM, Aleksey Chernoraenko <[email-masked]> wrote:
> 
> Thank you for response!
>