Subject: Re: [scim] [Editorial Errata Reported] RFC7643 (6403)

From: Phil Hunt <[email-masked]>
Date: Thu, 25 Feb 2021 09:53:59 -0800

Regarding errata 6403…

EDIT - Editorial

While I agree for consistency that “RECOMMENDED" is not the best, I believe the group wanted “RECOMMENDED” to encourage more support for use. In particular it was probably bad to make it all caps because it is not normative in the protocol sense.

Related, the example schema on page 71 shows the attribute is optional (Required = false).  Also, the enterprise user schema which contains the “manager” attribute is optional in practical terms.

In practical terms, any deployer is free to make such attributes mandatory or not as long as they publish the deployed schema in the /Schemas endpoint.

I would recommend changing “RECOMMENDED” to “Recommended” as the use is not normative.

Phil Hunt
@independentid
[email-masked]

> On Feb 25, 2021, at 5:58 AM, Barry Leiba <[email-masked]> wrote:
> 
>> Re. my earlier errata for the same RFC:
>> https://www.rfc-editor.org/errata/eid6403 there was no feedback and
>> it's still unverified (as are a few others), so I wondered if anyone
>> was out there.  But I will take your non-rejection of it as
>> acceptance.
> 
> Unfortunately, we're not always good about handling errata reports,
> and we should do better.
> 
> Phil, errata report 6403 looks correct to me.  Will you take a look at
> it and comment, please?
> 
> Barry
> 
>> 
>> On another matter: I have questions about `userName` and its uniqueness constraint.  Where best to ask?  StackOverflow?
>> 
>> Thanks.
>> 
>> Yours,
>> Andrew
>> 
>> 
>> 
>> 
>> Andrew Webb
>> Senior Engineer (Architecture & Development)
>> OutThink
>> 
>> 
>> [email-masked] |
>> +44 203 432 4846 |
>> 35 New Broad Street, London, EC2M 1NH, United Kingdom
>> 
>> 
>> OutThink is the Highest Rated Security Awareness Solution
>> Reviews from your enterprise peers – verified by Gartner
>> Read our reviews or contribute a review today on Gartner Peer Insights
>> 
>> 
>> ________________________________
>> From: Barry Leiba <[email-masked]>
>> Sent: 23 February 2021 21:34
>> To: Phil Hunt <[email-masked]>
>> Cc: RFC Errata System <[email-masked]>; Kelly Grizzle <[email-masked]>; Erik Wahlström neXus <[email-masked]>; Chuck Mortimore <[email-masked]>; Murray Kucherawy <[email-masked]>; Morteza Ansari <[email-masked]>; Leif Johansson <[email-masked]>; Andrew Webb <[email-masked]>; [email-masked] <[email-masked]>
>> Subject: Re: [Editorial Errata Reported] RFC7643 (6438)
>> 
>> Yes, Phil, and I already rejected the errata report a few hours ago.
>> 
>> Barry
>> 
>> On Tue, Feb 23, 2021 at 2:10 PM Phil Hunt <[email-masked]> wrote:
>>> 
>>> I believe this is a technical issue within the RFC issue. Officially the .txt is considered normative.
>>> 
>>> Please correct me if I am wrong.
>>> 
>>> 
>>> Phil Hunt (RFC7643 editor)
>>> [email-masked]
>>> 
>>> 
>>> 
>>>> On Feb 23, 2021, at 3:18 AM, RFC Errata System <[email-masked]> wrote:
>>>> 
>>>> The following errata report has been submitted for RFC7643,
>>>> "System for Cross-domain Identity Management: Core Schema".
>>>> 
>>>> --------------------------------------
>>>> You may review the report below and at:
>>>> https://www.rfc-editor.org/errata/eid6438
>>>> 
>>>> --------------------------------------
>>>> Type: Editorial
>>>> Reported by: Andrew Webb <[email-masked]>
>>>> 
>>>> Section: 3.1.
>>>> 
>>>> Original Text
>>>> -------------
>>>>    version  The version of the resource being returned.  This value
>>>>        must be the same as the entity-tag (ETag) HTTP response header
>>>>        (see Sections 2.1 and 2.3 of [RFC7232]).  This attribute has
>>>>        "caseExact" as "true".  Service provider support for this
>>>>        attribute is optional and subject to the service provider's
>>>>        support for versioning (see Section 3.14 of [RFC7644]).  If a
>>>>        service provider provides "version" (entity-tag) for a
>>>>        representation and the generation of that entity-tag does not
>>>>        satisfy all of the characteristics of a strong validator (see
>>>>        Section 2.1 of [RFC7232]), then the origin server MUST mark the
>>>>        "version" (entity-tag) as weak by prefixing its opaque value
>>>>        with "W/" (case sensitive).
>>>> 
>>>> Corrected Text
>>>> --------------
>>>>    version  The version of the resource being returned.  This value
>>>>        must be the same as the entity-tag (ETag) HTTP response header
>>>>        (see Sections 2.1 and 2.3 of [RFC7232]).  This attribute has
>>>>        "caseExact" as "true".  Service provider support for this
>>>>        attribute is optional and subject to the service provider's
>>>>        support for versioning (see Section 3.14 of [RFC7644]).  If a
>>>>        service provider provides "version" (entity-tag) for a
>>>>        representation and the generation of that entity-tag does not
>>>>        satisfy all of the characteristics of a strong validator (see
>>>>        Section 2.1 of [RFC7232]), then the origin server MUST mark the
>>>>        "version" (entity-tag) as weak by prefixing its opaque value
>>>>        with "W/" (case sensitive).
>>>> 
>>>> Notes
>>>> -----
>>>> In the original text, the hyperlinks applied to "2.1" and "2.3" incorrectly link to those sections in RFC 7643, whereas they should link to those sections in RFC 7232.
>>>> 
>>>> Instructions:
>>>> -------------
>>>> This erratum is currently posted as "Reported". If necessary, please
>>>> use "Reply All" to discuss whether it should be verified or
>>>> rejected. When a decision is reached, the verifying party
>>>> can log in to change the status and edit the report, if necessary.
>>>> 
>>>> --------------------------------------
>>>> RFC7643 (draft-ietf-scim-core-schema-22)
>>>> --------------------------------------
>>>> Title               : System for Cross-domain Identity Management: Core Schema
>>>> Publication Date    : September 2015
>>>> Author(s)           : P. Hunt, Ed., K. Grizzle, E. Wahlstroem, C. Mortimore
>>>> Category            : PROPOSED STANDARD
>>>> Source              : System for Cross-domain Identity Management
>>>> Area                : Applications and Real-Time
>>>> Stream              : IETF
>>>> Verifying Party     : IESG
>>>