Subject: [scim] Uniqueness Violation Response Code

From: Shelley <[email-masked]>
Date: Thu, 12 Mar 2020 14:29:10 -0500

RFC 7643 Section 7 [1] indicates the following:

uniqueness  A single keyword value that specifies how the service
>    provider enforces uniqueness of attribute values.
> *  A server MAY   reject an invalid value based on uniqueness by returning
> HTTP*
> *   response code 400 (Bad Request).*
>

This contradicts the requirements in RFC 7644 Section 3.3 [2] which
indicates that service providers "*MUST return HTTP status code 409
(Conflict)*" when the creation of a requested resource would conflict with
an existing resource, i.e. by violating an attribute's uniqueness.
Therefore, servers *MAY NOT* reject invalid values based on uniqueness with
a 400, as RFC 7643 Section 7 currently indicates.

I assume 409 is the preferred response here, and so I was initially going
to report an errata that proposed 409 instead of 400 in RFC 7643 Section 7;
however, to avoid dependencies on specific HTTP response codes from RFC
7644, I would propose the section could be updated as follows instead, such
that the HTTP response code is omitted entirely:

uniqueness  A single keyword value that specifies how the service
>    provider enforces uniqueness of attribute values.  A server MAY
>    reject an invalid value based on uniqueness.

Any feedback is welcome. I'm happy to report the proposed errata if there
is consensus; otherwise, I at least wanted to bring awareness to the
contradiction between specs here.

[1] https://tools.ietf.org/html/rfc7643#section-7
[2] https://tools.ietf.org/html/rfc7644#section-3.3

---

From: Phillip Hunt <[email-masked]>
Date: Thu, 12 Mar 2020 14:02:47 -0700

It seems to me that http protocol issues should not be in schema. 

However it is a MAY and thus 7644 overrides. 

I don’t think this can be handled as errata but rather a good item for a bis. 

Phil

> On Mar 12, 2020, at 12:29 PM, Shelley <[email-masked]> wrote:
> 
> 
>>    reject an invalid value based on uniqueness by returning HTTP
>>    response code 400 (Bad Request).
> 
> 
> This contradicts the requirements in RFC 7644 Section 3.3 [2] which indicates that service providers "MUST return HTTP status code 409 (Conflict)" when the creation of a requested resource would conflict with an existing resource, i.e. by violating an attribute's uniqueness. Therefore, servers MAY NOT reject invalid values based on uniqueness with a 400, as RFC 7643 Section 7 currently indicates.
> 
> I assume 409 is the preferred response here, and so I was initially going to report an errata that proposed 409 instead of 400 in RFC 7643 Section 7; however, to avoid dependencies on specific HTTP response codes from RFC 7644, I would propose the section could be updated as follows instead, such that the HTTP response code is omitted entirely:
> 
> Any feedback is welcome. I'm happy to report the proposed errata if there is consensus; otherwise, I at least wanted to bring awareness to the contradiction between specs here.
> 
> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim