Re: [scim] userids, usernames, and group names

And less problematic, Group Description is missing as well.
That's a field that usually our customers are asking to synchronize.

--
Regards,
Emmanuel Dreux
http://www.cloudiway.com
Tel: +33 4 26 78 17 58
Mobile: +33 6 47 81 26 70
skype: Emmanuel.Dreux

De : Emmanuel Dreux
Envoyé : lundi 3 septembre 2012 22:08
À : 'Hasini Gunasinghe'; Dale Olds
Cc : scim@ietf.org
Objet : RE: [scim] userids, usernames, and group names

My understanding of Dale issue is the following:

I have a group in Google ( let's talk about Google if Active Directory does not ring bells):
DisplayName: Developpers
Group email address (= Id) : devs@company.com<mailto:devs@company.com>

How do you represent it in SCIM?
According to the spec here ( http://tools.ietf.org/html/draft-ietf-scim-core-schema-00#section-11.4), a "groupID" (or call it GroupUsername) is missing.

--
Regards,
Emmanuel Dreux
http://www.cloudiway.com
Tel: +33 4 26 78 17 58
Mobile: +33 6 47 81 26 70
skype: Emmanuel.Dreux

De : Hasini Gunasinghe [mailto:hasini@wso2.com]
Envoyé : lundi 3 septembre 2012 11:16
À : Dale Olds
Cc : scim@ietf.org<mailto:scim@ietf.org>
Objet : Re: [scim] userids, usernames, and group names

Hi Dale,
On Sat, Sep 1, 2012 at 3:29 AM, Dale Olds <olds@rbcon.com<mailto:olds@rbcon.com>> wrote:
In our scim implementation we assign the following meanings to these user attributes:

* id: unique, immutable, required, not intended to be typed by humans. The only identifier safe to store in external systems.

* userName: unique, mutable, required, though rarely changed in practice, not localized -- more like a keyword. It's what humans can use when they need to type in a reference to a user.

* displayName: not unique, mutable, optional, used as input to some display context but might not be literally displayed.

Access control for the id and userName fields is identical -- they are both essentially treated as identifiers, displayName is different. These meanings work for us. All 3 attributes are used for specific purposes, and I believe our use does not violate the current spec. BTW, thanks for changing userName to be mutable in 1.1.

We are now implementing groups.

IIRC, the only choice the spec gives for human readable group names is displayName, but we have tools (e.g. CLIs) that need to accept a reference to a group typed in by a user. We could use displayName for that purpose, but then we lose the displayName capability that we have for users.
I do not see a reason why you can not use displayName of groups here. IIUC, displayName for user and group are two separate attributes and you can use them independently.

I've checked for this issue in the list archives but did not see any discussion. Has the group discussed a naming attribute for groups that would be more like userName than displayName?
Another option would be externalId - which is defined in the common schema.

Thanks,
Hasini.

A related issue is compound attributes such as Users.groups and Groups.members. If Groups had groupName attribute similar to userName for users, it would be most useful if these attributes could have sub-attributes like this:

User:
{
  id: 111111
  userName: 'joe'
  groups: [{display: 'Hiking Tour Guides', name: 'guides', value: 22222}]
}

Group:
{
  id: 22222
  groupName: 'guides'
  members: [{display: 'Joey', name: 'joe', value: 11111}]
}

I suppose we could add this capability as an extension, but would like to see if others would find this useful as well.

--Dale

_______________________________________________
scim mailing list
scim@ietf.org<mailto:scim@ietf.org>
https://www.ietf.org/mailman/listinfo/scim