Subject: [scim] [Technical Errata Reported] RFC7643 (6001)

From: RFC Errata System <[email-masked]>
Date: Mon, 2 Mar 2020 09:19:03 -0800 (PST)

The following errata report has been submitted for RFC7643,
"System for Cross-domain Identity Management: Core Schema".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid6001

--------------------------------------
Type: Technical
Reported by: Shelley Baker <[email-masked]>

Section: 8.7.1

Original Text
-------------
      {
        "name" : "profileUrl",
        "type" : "reference",
        "referenceTypes" : ["external"],
        "multiValued" : false,
        "description" : "A fully qualified URL pointing to a page representing the User's online profile.",
        "required" : false,
        "caseExact" : false,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      },

      {
        "name" : "photos",
        "type" : "complex",
        "multiValued" : true,
        "description" : "URLs of photos of the User.",
        "required" : false,
        "subAttributes" : [
          {
            "name" : "value",
            "type" : "reference",
            "referenceTypes" : ["external"],
            "multiValued" : false,
            "description" : "URL of a photo of the User.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },

          {
            "name" : "$ref",
            "type" : "reference",
            "referenceTypes" : [
              "User",
              "Group"
            ],
            "multiValued" : false,
            "description" : "The URI of the corresponding 'Group' resource to which the user belongs.",
            "required" : false,
            "caseExact" : false,
            "mutability" : "readOnly",
            "returned" : "default",
            "uniqueness" : "none"
          },

Corrected Text
--------------
      {
        "name" : "profileUrl",
        "type" : "reference",
        "referenceTypes" : ["external"],
        "multiValued" : false,
        "description" : "A fully qualified URL pointing to a page representing the User's online profile.",
        "required" : false,
        "caseExact" : true,
        "mutability" : "readWrite",
        "returned" : "default",
        "uniqueness" : "none"
      },

      {
        "name" : "photos",
        "type" : "complex",
        "multiValued" : true,
        "description" : "URLs of photos of the User.",
        "required" : false,
        "subAttributes" : [
          {
            "name" : "value",
            "type" : "reference",
            "referenceTypes" : ["external"],
            "multiValued" : false,
            "description" : "URL of a photo of the User.",
            "required" : false,
            "caseExact" : true,
            "mutability" : "readWrite",
            "returned" : "default",
            "uniqueness" : "none"
          },

          {
            "name" : "$ref",
            "type" : "reference",
            "referenceTypes" : [
              "User",
              "Group"
            ],
            "multiValued" : false,
            "description" : "The URI of the corresponding 'Group' resource to which the user belongs.",
            "required" : false,
            "caseExact" : true,
            "mutability" : "readOnly",
            "returned" : "default",
            "uniqueness" : "none"
          },

Notes
-----
Section 2.3.7 indicates that "A reference is case exact." Section 8.7.1 defines a number of "reference" attributes that incorrectly have the "caseExact" characteristic set to "false"; these should instead be "true."

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC7643 (draft-ietf-scim-core-schema-22)
--------------------------------------
Title               : System for Cross-domain Identity Management: Core Schema
Publication Date    : September 2015
Author(s)           : P. Hunt, Ed., K. Grizzle, E. Wahlstroem, C. Mortimore
Category            : PROPOSED STANDARD
Source              : System for Cross-domain Identity Management
Area                : Applications and Real-Time
Stream              : IETF
Verifying Party     : IESG

---

From: Phil Hunt <[email-masked]>
Date: Tue, 10 Mar 2020 11:51:36 -0700

VERIFIED

This feels like a bit of a ‘nit’. Note that the examples are not normative and it is allowed that the schema may be set to caseExact false.

I am ok with the correction going in or staying the same.

Phil Hunt
[email-masked]

> On Mar 2, 2020, at 9:19 AM, RFC Errata System <[email-masked]> wrote:
> 
> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim

---

From: Phil Hunt <[email-masked]>
Date: Tue, 10 Mar 2020 11:51:36 -0700

VERIFIED

Phil Hunt
[email-masked]

---

From: Shelley <[email-masked]>
Date: Tue, 10 Mar 2020 15:00:23 -0500

>
> it is allowed that the schema may be set to caseExact false

Is Section 2.3.7 not normative? If not, perhaps that section should not
prescribe a caseExact characteristic for references at all then.

On Tue, Mar 10, 2020 at 1:51 PM Phil Hunt <[email-masked]> wrote:

> VERIFIED
>
> This feels like a bit of a ‘nit’. Note that the examples are not normative
> and it is allowed that the schema may be set to caseExact false.
>
>        "description" : "A fully qualified URL pointing to a page
> representing the User's online profile.",
>        "required" : false,
>        "caseExact" : false,
>        "description" : "A fully qualified URL pointing to a page
> representing the User's online profile.",
>        "required" : false,
>        "caseExact" : true,
> Section 2.3.7 indicates that "A reference is case exact." Section 8.7.1
> defines a number of "reference" attributes that incorrectly have the
> "caseExact" characteristic set to "false"; these should instead be "true."
>
> Instructions:
> -------------

---

From: Phil Hunt <[email-masked]>
Date: Wed, 11 Mar 2020 11:11:54 -0700

Shelley,

I agree with Leif’s suggestion that this is the kind of stuff best deli with in a SCIMbis group.

SCIM is badly in need of a certification test that captures common implementation and normalizes behaviours and best practices. In and of itself would be a good feed back to any SCIMbis work.  I have been trying to lobby for this, but without a major sponsor and host organization, I fear this will not happen.

Phil Hunt
[email-masked]

> On Mar 11, 2020, at 6:48 AM, Shelley <[email-masked]> wrote:
> 
> The more I think about this, the more I am leaning towards the problem here being in Section 2.3.7, not 8.7.1.
> 
> As noted here [1], I have some general concerns with "caseExact," namely that there should be some separation of concerns between attribute characteristics and filtering capabilities. The fact that Section 2.3.7 requires all "reference" types to be "case exact" [2] seems overly-limiting.
> 
> URNs, for instance, are not entirely case-sensitive; they define a lexical equivalence, in which only some parts of the URN are case-sensitive [3]. For example, the following two URNs are lexically equivalent:
> urn:ietf:params:scim:schemas:core:2.0:User
> URN:IETF:params:scim:schemas:core:2.0:User
> 
> Given this, I would suggest that a filter for a URN attribute should match on either of the above. However, with the requirements outlined in Section 2.3.7, a client would need to provide the case-exact equivalent in order to match.
> 
> Therefore, perhaps Section 2.3.7's requirement that "A reference is case exact" could/should be removed (in which case my initially proposed change in Section 8.7.1 is optional)?
> 
> [1] https://mailarchive.ietf.org/arch/msg/scim/7ElDxpsgHZGRmQrXOTIR1jwuTts/ <https://mailarchive.ietf.org/arch/msg/scim/7ElDxpsgHZGRmQrXOTIR1jwuTts/>
> [2] https://tools.ietf.org/html/rfc7643#section-2.3.7 <https://tools.ietf.org/html/rfc7643#section-2.3.7>
> [3] https://tools.ietf.org/html/rfc8141#section-3 <https://tools.ietf.org/html/rfc8141#section-3>
> On Wed, Mar 11, 2020 at 4:05 AM Leif Johansson <[email-masked] <mailto:[email-masked]>> wrote:
> 
> 
> On 2020-03-10 21:00, Shelley wrote:
> > Is Section 2.3.7 not normative? If not, perhaps that section should not prescribe a caseExact characteristic for references at all then.
> > 
> 
> I think Phil meant that the /examples/ are not normative.
> 
> I'm also supportive of going either way on this. There has been talk of a
> 'bis' process for SCIM and if that happens this would certainly get included.
> 
>         Cheers Leif

---

From: Phil Hunt <[email-masked]>
Date: Wed, 11 Mar 2020 11:11:54 -0700

Shelley,

Phil Hunt
[email-masked]

---

From: Barry Leiba <[email-masked]>
Date: Wed, 11 Mar 2020 14:49:32 -0400

Should this then go to "held for document update", rather than "verified"?

Barry

On Wed, Mar 11, 2020 at 2:12 PM Phil Hunt <[email-masked]> wrote:
> [1] https://mailarchive.ietf.org/arch/msg/scim/7ElDxpsgHZGRmQrXOTIR1jwuTts/
> [2] https://tools.ietf.org/html/rfc7643#section-2.3.7
> [3] https://tools.ietf.org/html/rfc8141#section-3
>
> On Wed, Mar 11, 2020 at 4:05 AM Leif Johansson <[email-masked]> wrote:
>>
>>
>>