Subject: [scim] HTTP Status Code 501

From: Shelley <[email-masked]>
Date: Tue, 25 Feb 2020 14:09:30 -0600

*/Me Endpoint Support*

The SCIM 2 specification indicates that if a service provider does not
support the "/Me" endpoint, it should respond with HTTP 501 [1].

This doesn't seem inline with the HTTP specification, which indicates that
501 is used when the server *does not recognize the request method* [2].

In the case of the "/Me" endpoint, however, the server *does *recognize the
*method* (GET), but simply does not support a representation for the
requested resource, which seems more inline with a *404* [3].

What was the reasoning behind the 501? Given the requirement is a "SHOULD"
recommendation, I'm inclined to return the HTTP standard 404 in my service
provider implementation, instead of the SCIM recommended 501.

*PATCH Operation Support*

The SCIM 1.1 and 2.0 specifications also imply that 501 should be returned
when PATCH is not supported [4]. This also seems to violate the HTTP spec,
if the server recognizes the PATCH method, but simply does not support this
method for the requested resource. Instead, a *405* (Method Not Allowed)
[5] seems more appropriate.

[1] https://tools.ietf.org/html/rfc7644#section-3.11
[2] https://tools.ietf.org/html/rfc7231#section-6.6.2
[3] https://tools.ietf.org/html/rfc7231#section-6.5.4
[4] https://tools.ietf.org/html/rfc7644#section-3.12
[5] https://tools.ietf.org/html/rfc7231#section-6.5.5

---

From: Phillip Hunt <[email-masked]>
Date: Tue, 25 Feb 2020 12:27:24 -0800

There are two possibilities:
- 501 the function of alias path mapping a security credential to a resource is not available
- 404 would make sense if the security credential used does not map to a scim resource in the server.

Phil

> On Feb 25, 2020, at 12:09 PM, Shelley <[email-masked]> wrote:
> 
> 
> /Me Endpoint Support
> 
> The SCIM 2 specification indicates that if a service provider does not support the "/Me" endpoint, it should respond with HTTP 501 [1].
> 
> This doesn't seem inline with the HTTP specification, which indicates that 501 is used when the server does not recognize the request method [2].
> 
> In the case of the "/Me" endpoint, however, the server does recognize the method (GET), but simply does not support a representation for the requested resource, which seems more inline with a 404 [3].
> 
> What was the reasoning behind the 501? Given the requirement is a "SHOULD" recommendation, I'm inclined to return the HTTP standard 404 in my service provider implementation, instead of the SCIM recommended 501.
> 
> PATCH Operation Support
> 
> The SCIM 1.1 and 2.0 specifications also imply that 501 should be returned when PATCH is not supported [4]. This also seems to violate the HTTP spec, if the server recognizes the PATCH method, but simply does not support this method for the requested resource. Instead, a 405 (Method Not Allowed) [5] seems more appropriate.
> 
> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim