diff options
Diffstat (limited to 'doc/rfc/rfc7643.txt')
| -rw-r--r-- | doc/rfc/rfc7643.txt | 5827 |
1 files changed, 5827 insertions, 0 deletions
diff --git a/doc/rfc/rfc7643.txt b/doc/rfc/rfc7643.txt new file mode 100644 index 0000000..e3759b2 --- /dev/null +++ b/doc/rfc/rfc7643.txt @@ -0,0 +1,5827 @@ + + + + + + +Internet Engineering Task Force (IETF) P. Hunt, Ed. +Request for Comments: 7643 Oracle +Category: Standards Track K. Grizzle +ISSN: 2070-1721 SailPoint + E. Wahlstroem + Nexus Technology + C. Mortimore + Salesforce + September 2015 + + + System for Cross-domain Identity Management: Core Schema + +Abstract + + The System for Cross-domain Identity Management (SCIM) specifications + are designed to make identity management in cloud-based applications + and services easier. The specification suite builds upon experience + with existing schemas and deployments, placing specific emphasis on + simplicity of development and integration, while applying existing + authentication, authorization, and privacy models. Its intent is to + reduce the cost and complexity of user management operations by + providing a common user schema and extension model as well as binding + documents to provide patterns for exchanging this schema using HTTP. + + This document provides a platform-neutral schema and extension model + for representing users and groups and other resource types in JSON + format. This schema is intended for exchange and use with cloud + service providers. + +Status of This Memo + + This is an Internet Standards Track document. + + This document is a product of the Internet Engineering Task Force + (IETF). It represents the consensus of the IETF community. It has + received public review and has been approved for publication by the + Internet Engineering Steering Group (IESG). Further information on + Internet Standards is available in Section 2 of RFC 5741. + + Information about the current status of this document, any errata, + and how to provide feedback on it may be obtained at + http://www.rfc-editor.org/info/rfc7643. + + + + + + + + +Hunt, et al. Standards Track [Page 1] + +RFC 7643 SCIM Core Schema September 2015 + + +Copyright Notice + + Copyright (c) 2015 IETF Trust and the persons identified as the + document authors. All rights reserved. + + This document is subject to BCP 78 and the IETF Trust's Legal + Provisions Relating to IETF Documents + (http://trustee.ietf.org/license-info) in effect on the date of + publication of this document. Please review these documents + carefully, as they describe your rights and restrictions with respect + to this document. Code Components extracted from this document must + include Simplified BSD License text as described in Section 4.e of + the Trust Legal Provisions and are provided without warranty as + described in the Simplified BSD License. + +Table of Contents + + 1. Introduction and Overview .......................................3 + 1.1. Requirements Notation and Conventions ......................4 + 1.2. Definitions ................................................5 + 2. SCIM Schema .....................................................6 + 2.1. Attributes .................................................7 + 2.2. Attribute Characteristics ..................................8 + 2.3. Attribute Data Types .......................................8 + 2.3.1. String ..............................................9 + 2.3.2. Boolean .............................................9 + 2.3.3. Decimal ............................................10 + 2.3.4. Integer ............................................10 + 2.3.5. DateTime ...........................................10 + 2.3.6. Binary .............................................10 + 2.3.7. Reference ..........................................10 + 2.3.8. Complex ............................................11 + 2.4. Multi-Valued Attributes ...................................11 + 2.5. Unassigned and Null Values ................................13 + 3. SCIM Resources .................................................13 + 3.1. Common Attributes .........................................16 + 3.2. Defining New Resource Types ...............................18 + 3.3. Attribute Extensions to Resources .........................18 + 4. SCIM Core Resources and Extensions .............................19 + 4.1. "User" Resource Schema ....................................19 + 4.1.1. Singular Attributes ................................19 + 4.1.2. Multi-Valued Attributes ............................23 + 4.2. "Group" Resource Schema ...................................25 + 4.3. Enterprise User Schema Extension ..........................26 + 5. Service Provider Configuration Schema ..........................27 + 6. ResourceType Schema ............................................29 + 7. Schema Definition ..............................................30 + + + + +Hunt, et al. Standards Track [Page 2] + +RFC 7643 SCIM Core Schema September 2015 + + + 8. JSON Representation ............................................34 + 8.1. Minimal User Representation ...............................34 + 8.2. Full User Representation ..................................35 + 8.3. Enterprise User Extension Representation ..................39 + 8.4. Group Representation ......................................43 + 8.5. Service Provider Configuration Representation .............44 + 8.6. Resource Type Representation ..............................46 + 8.7. Schema Representation .....................................47 + 8.7.1. Resource Schema Representation .....................47 + 8.7.2. Service Provider Schema Representation .............74 + 9. Security Considerations ........................................92 + 9.1. Protocol ..................................................92 + 9.2. Passwords and Other Sensitive Security Data ...............92 + 9.3. Privacy ...................................................92 + 10. IANA Considerations ...........................................94 + 10.1. Registration of SCIM URN Sub-namespace and SCIM + Registry .................................................94 + 10.2. URN Sub-namespace for SCIM ...............................94 + 10.2.1. Specification Template ............................95 + 10.3. Registering SCIM Schemas .................................97 + 10.3.1. Registration Procedure ............................97 + 10.3.2. Schema Registration Template ......................98 + 10.4. Initial SCIM Schema Registry .............................99 + 11. References ...................................................100 + 11.1. Normative References ....................................100 + 11.2. Informative References ..................................101 + Acknowledgements .................................................103 + Authors' Addresses ...............................................104 + +1. Introduction and Overview + + While there are existing standards for describing and exchanging user + information, many of these standards can be difficult to implement + and/or use; e.g., their wire protocols do not easily traverse + firewalls and/or are not easily layered onto existing web protocols. + As a result, many cloud providers implement non-standardized + protocols for managing users within their services. This increases + both the cost and complexity associated with organizations adopting + products and services from multiple cloud providers, as they must + perform redundant integration development. Similarly, cloud service + providers seeking to interoperate with multiple application + marketplaces or cloud identity providers would require pairwise + integration. + + SCIM seeks to simplify this problem through an easily implemented + specification suite that provides a common user schema and extension + model, as well as a SCIM protocol document that defines exchanging + this schema via an HTTP-based protocol [RFC7644]. The SCIM + + + +Hunt, et al. Standards Track [Page 3] + +RFC 7643 SCIM Core Schema September 2015 + + + specifications draw design input and feedback from existing + identity-related protocols and schemas from a wide variety of sources + including, but not limited to, existing services exposed by cloud + providers, PortableContacts [PortableContacts], vCards [RFC6350], and + Lightweight Directory Access Protocol (LDAP) directory services + [RFC4512]. + + The SCIM protocol is an application-level protocol for provisioning + and managing identity data specified through SCIM schemas. The + protocol supports creation, modification, retrieval, and discovery of + core identity resources such as Users and Groups, using a subset of + the HTTP methods (GET for retrieval of resources; POST for creation, + searching, and bulk modification; PUT for attribute replacement + within resources; PATCH for partial update of attributes; and DELETE + for removing resources). + + While the SCIM protocol and core schema specifications are intended + to cover point-to-point scenarios, implementers and deployers should + consider multi-hop and multi-party scenarios such as a service + provider acting as a general profile service for in-domain + applications (e.g., a directory), as well as scenarios where a + service provider in turn passes information to a third-party service + provider by acting as either a SCIM client or a SCIM service + provider. Implementers and deployers should carefully consider their + service level agreements and privacy agreements when distributing or + propagating personal information (see Section 9.3). + + This document provides a JSON-based schema and extension model for + representing users and groups, as well as service provider + configuration. This schema is intended for exchange and use with + cloud service providers and other cross-domain scenarios. + +1.1. Requirements Notation and Conventions + + The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", + "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this + document are to be interpreted as described in [RFC2119]. + + The key words "REQUIRED" and "OPTIONAL" are used throughout this + document to indicate whether an attribute or schema element is + required or optional. These key words may be used alone (e.g., + "REQUIRED.") or in a sentence. If not specified, an attribute is + considered to be optional. + + The word "DEFAULT" as used in Section 7 indicates that a "keyword" + value for an attribute characteristic is the default behavior. + + + + + +Hunt, et al. Standards Track [Page 4] + +RFC 7643 SCIM Core Schema September 2015 + + + Throughout this document, values are quoted to indicate that they are + to be taken literally. When using these values in protocol messages, + the quotes MUST NOT be used as part of the value. + + Throughout this document, figures may contain spaces and extra line + wrapping to improve readability and accommodate space limitations. + Similarly, some URIs contained within examples have been shortened + for space and readability reasons. + +1.2. Definitions + + Service Provider + An HTTP web application that provides identity information via the + SCIM protocol. + + Client + A website or application that uses the SCIM protocol to manage + identity data maintained by the service provider. The client + initiates SCIM HTTP requests to a target service provider. + + Provisioning Domain + A provisioning domain is an administrative domain external to the + domain of a service provider for legal or technical reasons. For + example, a SCIM client in an enterprise (provisioning client) + communicates with a SCIM service provider that is owned or + controlled by a different legal entity. + + Resource Type + A type of a resource that is managed by a service provider. The + resource type defines the resource name, endpoint URL, schemas, + and other metadata that indicate where a resource is managed and + how it is composed, e.g., "User" or "Group". + + Resource + An artifact that is managed by a service provider and that + contains one or more attributes, e.g., "User" or "Group". + + Endpoint + An endpoint for a service provider is a defined base path relative + to the service provider's Base URI (see Section 1.3 of [RFC7644]), + over which SCIM operations may be performed against SCIM + resources. For example, assuming that the service provider's Base + URI is "https://example.com/", "User" resources may be accessed at + the "https://example.com/Users" or "https://example.com/v2/Users" + endpoint (see Section 3.13 of [RFC7644] for details regarding + protocol versioning, e.g., 'v2'). Service provider schemas MAY be + returned from the "/Schemas" endpoint. + + + + +Hunt, et al. Standards Track [Page 5] + +RFC 7643 SCIM Core Schema September 2015 + + + Schema + A collection of attribute definitions that describe the contents + of an entire or partial resource, e.g., + "urn:ietf:params:scim:schemas:core:2.0:User". The attribute + definitions specify the name of the attribute, and metadata such + as type (e.g., string, binary), cardinality (singular, multi, + complex), mutability, and returnability. + + Singular Attribute + A resource attribute that contains 0..1 values, e.g., + "displayName". + + Multi-valued Attribute + A resource attribute that contains 0..n values, e.g., "emails". + + Simple Attribute + A singular or multi-valued attribute whose value is a primitive, + e.g., "String". A simple attribute MUST NOT contain + sub-attributes. + + Complex Attribute + A singular or multi-valued attribute whose value is a composition + of one or more simple attributes; e.g., "addresses" has the + sub-attributes "streetAddress", "locality", "postalCode", and + "country". + + Sub-Attribute + A simple attribute that is contained within a complex attribute. + +2. SCIM Schema + + A SCIM server provides a set of resources, the allowable contents of + which are defined by a set of schema URIs and a resource type. + SCIM's schema is not a document-centric one such as with + [XML-Schema]. Instead, SCIM's support of schema is attribute based, + where each attribute may have different type, mutability, + cardinality, or returnability. Validation of documents and messages + is always performed by an intended receiver, as specified by the SCIM + specifications. Validation is performed by the receiver in the + context of a SCIM protocol request (see [RFC7644]). For example, a + SCIM service provider, upon receiving a request to replace an + existing resource with a replacement JSON object, evaluates each + asserted attribute based on its characteristics as defined in the + relevant schema (e.g., mutability) and decides which attributes may + be replaced or ignored. + + + + + + +Hunt, et al. Standards Track [Page 6] + +RFC 7643 SCIM Core Schema September 2015 + + + This specification provides a minimal core schema for representing + users and groups (resources), encompassing common attributes found in + many existing deployments and schemas. In addition to the minimal + core schema, this document also specifies a standardized means by + which service providers may extend schemas to define new resources + and attributes in both standardized and service-provider-specific + cases. + + Resources are categorized into common resource types such as "User" + or "Group". Collections of resources of the same type are usually + contained within the same "container" ("folder") endpoint. + +2.1. Attributes + + A resource is a collection of attributes identified by one or more + schemas. Minimally, an attribute consists of the attribute name and + at least one simple or complex value, either of which may be + multi-valued. For each attribute, a SCIM schema defines the data + type, plurality, mutability, and other distinguishing features of an + attribute. + + Attribute names are case insensitive and are often "camel-cased" + (e.g., "camelCase"). SCIM resources are represented in JSON + [RFC7159] format and MUST specify schema via the "schemas" attribute + per Section 3. + + Attribute names MUST conform to the following ABNF rules: + + ATTRNAME = ALPHA *(nameChar) + nameChar = "$" / "-" / "_" / DIGIT / ALPHA + + Figure 1: ABNF for Attribute Names + + The above rules (and other rules in this specification) use the "Core + Rules" from ABNF; see Appendix B of [RFC5234]. Unless otherwise + specified in this document, all ABNF strings are case insensitive and + the character set for these strings is US-ASCII. For example, all + attribute names defined by the above rule are case insensitive. + + When defining attribute names, it should be noted that the hyphen + ("-") is not permitted in JavaScript attribute names (or in attribute + names for some other languages). While there are no known issues + within HTTP protocol and JSON notation, attribute names containing + hyphens may need to be escaped when declaring corresponding names of + JavaScript attributes. + + + + + + +Hunt, et al. Standards Track [Page 7] + +RFC 7643 SCIM Core Schema September 2015 + + +2.2. Attribute Characteristics + + All attributes have a set of characteristics that describe their type + and handling by a service provider; full definitions may be found in + Section 7. The characteristics include: + + o "required", + + o "canonicalValues", + + o "caseExact", + + o "mutability", + + o "returned", + + o "uniqueness", and + + o "referenceTypes". + + If not otherwise stated in Section 7, SCIM attributes have the + following characteristics: + + o "required" is "false" (i.e., not REQUIRED), + + o "canonicalValues": none assigned (for example, the "type" + sub-attribute as described in Section 2.4), + + o "caseExact" is "false" (i.e., case-insensitive), + + o "mutability" is "readWrite" (i.e., modifiable), + + o "returned" is "default" (the attribute value is returned by + default), + + o "uniqueness" is "none" (has no uniqueness enforced), and + + o "type" is "string" (Section 2.3.1). + +2.3. Attribute Data Types + + Attribute data types are derived from JSON [RFC7159]. The JSON + format defines a limited set of data types; hence, where appropriate, + alternate JSON representations derived from XML Schema [XML-Schema] + are defined below. SCIM extensions SHOULD NOT introduce new data + types. + + + + + +Hunt, et al. Standards Track [Page 8] + +RFC 7643 SCIM Core Schema September 2015 + + + Table 1 maps the following SCIM data types to their corresponding + SCIM schema type and underlying JSON data type: + + +-----------+-------------+-----------------------------------------+ + | SCIM Data | SCIM Schema | JSON Type | + | Type | "type" | | + +-----------+-------------+-----------------------------------------+ + | String | "string" | String per Section 7 of [RFC7159] | + | | | | + | Boolean | "boolean" | Value per Section 3 of [RFC7159] | + | | | | + | Decimal | "decimal" | Number per Section 6 of [RFC7159] | + | | | | + | Integer | "integer" | Number per Section 6 of [RFC7159] | + | | | | + | DateTime | "dateTime" | String per Section 7 of [RFC7159] | + | | | | + | Binary | "binary" | Binary value base64 encoded per Section | + | | | 4 of [RFC4648], or with URL and | + | | | filename safe alphabet URL per Section | + | | | 5 of [RFC4648] that is passed as a JSON | + | | | string per Section 7 of [RFC7159] | + | | | | + | Reference | "reference" | String per Section 7 of [RFC7159] | + | | | | + | Complex | "complex" | Object per Section 4 of [RFC7159] | + +-----------+-------------+-----------------------------------------+ + + Table 1: SCIM Data Type to JSON Representation + +2.3.1. String + + A sequence of zero or more Unicode characters encoded using UTF-8 as + per [RFC2277] and [RFC3629]. The JSON format is defined in Section 7 + of [RFC7159]. An attribute with SCIM schema type "string" MAY + specify a required data format. Additionally, when "canonicalValues" + is specified, service providers MAY restrict accepted values to the + specified values. + +2.3.2. Boolean + + The literal "true" or "false". The JSON format is defined in + Section 3 of [RFC7159]. A boolean has no case sensitivity or + uniqueness. + + + + + + + +Hunt, et al. Standards Track [Page 9] + +RFC 7643 SCIM Core Schema September 2015 + + +2.3.3. Decimal + + A real number with at least one digit to the left and right of the + period. The JSON format is defined in Section 6 of [RFC7159]. A + decimal has no case sensitivity. + +2.3.4. Integer + + A whole number with no fractional digits or decimal. The JSON format + is defined in Section 6 of [RFC7159], with the additional constraint + that the value MUST NOT contain fractional or exponent parts. An + integer has no case sensitivity. + +2.3.5. DateTime + + A DateTime value (e.g., 2008-01-23T04:56:22Z). The attribute value + MUST be encoded as a valid xsd:dateTime as specified in Section 3.3.7 + of [XML-Schema] and MUST include both a date and a time. A date time + format has no case sensitivity or uniqueness. + + Values represented in JSON format MUST conform to the XML constraints + above and are represented as a JSON string per Section 7 of + [RFC7159]. + +2.3.6. Binary + + Arbitrary binary data. The attribute value MUST be base64 encoded as + specified in Section 4 of [RFC4648]. In cases where a URL-safe + encoding is required, the attribute definition MAY specify that + base64 URL encoding be used as per Section 5 of [RFC4648]. Unless + otherwise specified in the attribute definition, trailing padding + characters MAY be omitted ("="). + + In JSON representation, the encoded values are represented as a JSON + string per Section 7 of [RFC7159]. A binary is case exact and has no + uniqueness. + +2.3.7. Reference + + A URI for a resource. A resource MAY be a SCIM resource, an external + link to a resource (e.g., a photo), or an identifier such as a URN. + The value MUST be the absolute or relative URI of the target + resource. Relative URIs should be resolved as specified in + Section 5.2 of [RFC3986]. However, the base URI for relative URI + resolution MUST include all URI components and path segments up to, + but not including, the Endpoint URI (the SCIM service provider root + + + + + +Hunt, et al. Standards Track [Page 10] + +RFC 7643 SCIM Core Schema September 2015 + + + endpoint); e.g., the base URI for a request to + "https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646" + would be "https://example.com/v2/", and the relative URI for this + resource would be "Users/2819c223-7f76-453a-919d-413861904646". + + In JSON representation, the URI value is represented as a JSON string + per Section 7 of [RFC7159]. A reference is case exact. A reference + has a "referenceTypes" attribute that indicates what types of + resources may be linked, as per Section 7 of this document. + + A reference URI MUST be to an HTTP-addressable resource. An HTTP + client performing a GET operation on a reference URI MUST receive the + target resource or an appropriate HTTP response code. A SCIM service + provider MAY choose to enforce referential integrity for reference + types referring to SCIM resources. + + By convention, a reference is commonly represented as a "$ref" + sub-attribute in complex or multi-valued attributes; however, this is + OPTIONAL. + +2.3.8. Complex + + A singular or multi-valued attribute whose value is a composition of + one or more simple attributes. The JSON format is defined in + Section 4 of [RFC7159]. The order of the component attributes is not + significant. Servers and clients MUST NOT require or expect + attributes to be in any specific order when an object is either + generated or analyzed. A complex attribute has no uniqueness or case + sensitivity. A complex attribute MUST NOT contain sub-attributes + that have sub-attributes (i.e., that are complex). + +2.4. Multi-Valued Attributes + + Multi-valued attributes contain a list of elements using the JSON + array format defined in Section 5 of [RFC7159]. Elements can be + either of the following: + + o primitive values, or + + o objects with a set of sub-attributes and values, using the JSON + object format defined in Section 4 of [RFC7159], in which case + they SHALL be considered to be complex attributes. As with + complex attributes, the order of sub-attributes is not + significant. The predefined sub-attributes listed in this section + can be used with multi-valued attribute objects, but these + sub-attributes MUST be used with the meanings defined here. + + + + + +Hunt, et al. Standards Track [Page 11] + +RFC 7643 SCIM Core Schema September 2015 + + + If not otherwise defined, the default set of sub-attributes for a + multi-valued attribute is as follows: + + type + A label indicating the attribute's function, e.g., "work" or + "home". + + primary + A Boolean value indicating the 'primary' or preferred attribute + value for this attribute, e.g., the preferred mailing address or + the primary email address. The primary attribute value "true" + MUST appear no more than once. If not specified, the value of + "primary" SHALL be assumed to be "false". + + display + A human-readable name, primarily used for display purposes and + having a mutability of "immutable". + + value + The attribute's significant value, e.g., email address, phone + number. + + $ref + The reference URI of a target resource, if the attribute is a + reference. URIs are canonicalized per Section 6.2 of [RFC3986]. + While the representation of a resource may vary in different SCIM + protocol API versions (see Section 3.13 of [RFC7644]), URIs for + SCIM resources with an API version SHALL be considered comparable + to URIs without a version or with a different version. For + example, "https://example.com/Users/12345" is equivalent to + "https://example.com/v2/Users/12345". + + When returning multi-valued attributes, service providers SHOULD + canonicalize the value returned (e.g., by returning a value for the + sub-attribute "type", such as "home" or "work") when appropriate + (e.g., for email addresses and URLs). + + Service providers MAY return element objects with the same "value" + sub-attribute more than once with a different "type" sub-attribute + (e.g., the same email address may be used for work and home) but + SHOULD NOT return the same (type, value) combination more than once + per attribute, as this complicates processing by the client. + + When defining schema for multi-valued attributes, it is considered a + good practice to provide a type attribute that MAY be used for the + purpose of canonicalization of values. In the schema definition for + an attribute, the service provider MAY define the recommended + canonical values (see Section 7). + + + +Hunt, et al. Standards Track [Page 12] + +RFC 7643 SCIM Core Schema September 2015 + + +2.5. Unassigned and Null Values + + Unassigned attributes, the null value, or an empty array (in the case + of a multi-valued attribute) SHALL be considered to be equivalent in + "state". Assigning an attribute with the value "null" or an empty + array (in the case of multi-valued attributes) has the effect of + making the attribute "unassigned". When a resource is expressed in + JSON format, unassigned attributes, although they are defined in + schema, MAY be omitted for compactness. + +3. SCIM Resources + + Each SCIM resource is a JSON object that has the following + components: + + Resource Type + Each resource (or JSON object) in SCIM has a resource type + ("meta.resourceType"; see Section 3.1) that defines the resource's + core attribute schema and any attribute extension schema, as well + as the endpoint where objects of the same type may be found. More + information about a resource MAY be found in its resource type + definition (see Section 6). + + "Schemas" Attribute + The "schemas" attribute is a REQUIRED attribute and is an array of + Strings containing URIs that are used to indicate the namespaces + of the SCIM schemas that define the attributes present in the + current JSON structure. This attribute may be used by parsers to + define the attributes present in the JSON structure that is the + body to an HTTP request or response. Each String value must be a + unique URI. All representations of SCIM schemas MUST include a + non-empty array with value(s) of the URIs supported by that + representation. The "schemas" attribute for a resource MUST only + contain values defined as "schema" and "schemaExtensions" for the + resource's defined "resourceType". Duplicate values MUST NOT be + included. Value order is not specified and MUST NOT impact + behavior. + + Common Attributes + A resource's common attributes are those attributes that are part + of every SCIM resource, regardless of the value of the "schemas" + attribute present in a JSON body. These attributes are not + defined in any particular schema but SHALL be assumed to be + present in every resource, regardless of the value of the + "schemas" attribute. See Section 3.1. + + + + + + +Hunt, et al. Standards Track [Page 13] + +RFC 7643 SCIM Core Schema September 2015 + + + Core Attributes + A resource's core attributes are those attributes that sit at the + top level of the JSON object together with the common attributes + (such as the resource "id"). The list of valid attributes is + specified by the resource's resource type "schema" attribute (see + Section 6). This same value is also present in the resource's + "schemas" attribute. + + Extended Attributes + Extended schema attributes are specified by the resource's + resource type "schemaExtensions" attribute (see Section 6). + Unlike core attributes, extended attributes are kept in their own + sub-attribute namespace identified by the schema extension URI. + This avoids attribute name conflicts that may arise due to + conflicts from separate schema extensions. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 14] + +RFC 7643 SCIM Core Schema September 2015 + + + The following example "User" contains the common attributes "id" and + "externalId", as well as the complex attribute "meta", which contains + the sub-attribute "resourceType". The resource also contains core + attributes "userName" and "name", as well as extended enterprise User + attributes "employeeNumber" and "costCenter", which are contained in + their own JSON substructure identified by their schema URI. Some + values have been omitted (...), shortened, or spaced out for clarity. + + { + "schemas": + ["urn:ietf:params:scim:schemas:core:2.0:User", + "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"], + + "id": "2819c223-7f76-453a-413861904646", + "externalId": "701984", + + "userName": "bjensen@example.com", + "name": { + "formatted": "Ms. Barbara J Jensen, III", + "familyName": "Jensen", + "givenName": "Barbara", + "middleName": "Jane", + "honorificPrefix": "Ms.", + "honorificSuffix": "III" + }, + ... + + "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User": { + "employeeNumber": "701984", + "costCenter": "4130", + ... + }, + + "meta": { + "resourceType": "User", + "created": "2010-01-23T04:56:22Z", + "lastModified": "2011-05-13T04:42:34Z", + "version": "W\/\"3694e05e9dff591\"", + "location": + "https://example.com/v2/Users/2819c223-7f76-453a-413861904646" + } + } + + Figure 2: Example JSON Resource Structure + + + + + + + +Hunt, et al. Standards Track [Page 15] + +RFC 7643 SCIM Core Schema September 2015 + + +3.1. Common Attributes + + Each SCIM resource (Users, Groups, etc.) includes the following + common attributes. With the exception of the "ServiceProviderConfig" + and "ResourceType" server discovery endpoints and their associated + resources, these attributes MUST be defined for all resources, + including any extended resource types. When accepted by a service + provider (e.g., after a SCIM create), the attributes "id" and "meta" + (and its associated sub-attributes) MUST be assigned values by the + service provider. Common attributes are considered to be part of + every base resource schema and do not use their own "schemas" URI. + + For backward compatibility, some existing schema definitions MAY list + common attributes as part of the schema. The attribute + characteristics (see Section 2.2) listed here SHALL take precedence + over older definitions that may be included in existing schemas. + + id + A unique identifier for a SCIM resource as defined by the service + provider. Each representation of the resource MUST include a + non-empty "id" value. This identifier MUST be unique across the + SCIM service provider's entire set of resources. It MUST be a + stable, non-reassignable identifier that does not change when the + same resource is returned in subsequent requests. The value of + the "id" attribute is always issued by the service provider and + MUST NOT be specified by the client. The string "bulkId" is a + reserved keyword and MUST NOT be used within any unique identifier + value. The attribute characteristics are "caseExact" as "true", a + mutability of "readOnly", and a "returned" characteristic of + "always". See Section 9 for additional considerations regarding + privacy. + + externalId + A String that is an identifier for the resource as defined by the + provisioning client. The "externalId" may simplify identification + of a resource between the provisioning client and the service + provider by allowing the client to use a filter to locate the + resource with an identifier from the provisioning domain, + obviating the need to store a local mapping between the + provisioning domain's identifier of the resource and the + identifier used by the service provider. Each resource MAY + include a non-empty "externalId" value. The value of the + "externalId" attribute is always issued by the provisioning client + and MUST NOT be specified by the service provider. The service + provider MUST always interpret the externalId as scoped to the + provisioning domain. While the server does not enforce + uniqueness, it is assumed that the value's uniqueness is + controlled by the client setting the value. See Section 9 for + + + +Hunt, et al. Standards Track [Page 16] + +RFC 7643 SCIM Core Schema September 2015 + + + additional considerations regarding privacy. This attribute has + "caseExact" as "true" and a mutability of "readWrite". This + attribute is OPTIONAL. + + meta + A complex attribute containing resource metadata. All "meta" + sub-attributes are assigned by the service provider (have a + "mutability" of "readOnly"), and all of these sub-attributes have + a "returned" characteristic of "default". This attribute SHALL be + ignored when provided by clients. "meta" contains the following + sub-attributes: + + resourceType The name of the resource type of the resource. This + attribute has a mutability of "readOnly" and "caseExact" as + "true". + + created The "DateTime" that the resource was added to the service + provider. This attribute MUST be a DateTime. + + lastModified The most recent DateTime that the details of this + resource were updated at the service provider. If this + resource has never been modified since its initial creation, + the value MUST be the same as the value of "created". + + location The URI of the resource being returned. This value MUST + be the same as the "Content-Location" HTTP response header (see + Section 3.1.4.2 of [RFC7231]). + + version The version of the resource being returned. This value + must be the same as the entity-tag (ETag) HTTP response header + (see Sections 2.1 and 2.3 of [RFC7232]). This attribute has + "caseExact" as "true". Service provider support for this + attribute is optional and subject to the service provider's + support for versioning (see Section 3.14 of [RFC7644]). If a + service provider provides "version" (entity-tag) for a + representation and the generation of that entity-tag does not + satisfy all of the characteristics of a strong validator (see + Section 2.1 of [RFC7232]), then the origin server MUST mark the + "version" (entity-tag) as weak by prefixing its opaque value + with "W/" (case sensitive). + + + + + + + + + + + +Hunt, et al. Standards Track [Page 17] + +RFC 7643 SCIM Core Schema September 2015 + + +3.2. Defining New Resource Types + + SCIM may be extended to define new classes of resources by defining a + resource type. Each resource type defines the name, endpoint, base + schema (the attributes), and any schema extensions registered for use + with the resource type. In order to offer new types of resources, a + service provider defines the new resource type as specified in + Section 6 and defines a schema representation (see Section 8.7). + +3.3. Attribute Extensions to Resources + + SCIM allows resource types to have extensions in addition to their + core schema. This is similar to how "objectClasses" are used in LDAP + [RFC4512]. However, unlike LDAP, there is no inheritance model; all + extensions are additive (similar to the LDAP auxiliary object class). + Each value in the "schemas" attribute indicates additive schema that + MAY exist in a SCIM resource representation. The "schemas" attribute + MUST contain at least one value, which SHALL be the base schema for + the resource. The "schemas" attribute MAY contain additional values + indicating extended schemas that are in use. Schema extensions + SHOULD avoid redefining any attributes defined in this specification + and SHOULD follow conventions defined in this specification. Except + for the base object schema, the schema extension URI SHALL be used as + a JSON container to distinguish attributes belonging to the extension + namespace from base schema attributes. See Figure 5, which is an + example of the JSON representation of an enterprise User and is also + an example of a User with extended schema. + + In order to determine which URI value in the "schemas" attribute is + the base schema and which is an extended schema for any given + resource, the resource's "resourceType" attribute value MAY be used + to retrieve the resource's "ResourceType" schema (see Section 6). + See the "ResourceType" representation in Figure 8 for an example. + + + + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 18] + +RFC 7643 SCIM Core Schema September 2015 + + +4. SCIM Core Resources and Extensions + + This section defines the default resource schemas present in a SCIM + server. SCIM is not exclusive to these resources and may be extended + to support other resource types (see Section 3.2). + +4.1. "User" Resource Schema + + SCIM provides a resource type for "User" resources. The core schema + for "User" is identified using the following schema URI: + "urn:ietf:params:scim:schemas:core:2.0:User". The following + attributes are defined in addition to the core schema attributes: + +4.1.1. Singular Attributes + + userName + A service provider's unique identifier for the user, typically + used by the user to directly authenticate to the service provider. + Often displayed to the user as their unique identifier within the + system (as opposed to "id" or "externalId", which are generally + opaque and not user-friendly identifiers). Each User MUST include + a non-empty userName value. This identifier MUST be unique across + the service provider's entire set of Users. This attribute is + REQUIRED and is case insensitive. + + name + The components of the user's name. Service providers MAY return + just the full name as a single string in the formatted + sub-attribute, or they MAY return just the individual component + attributes using the other sub-attributes, or they MAY return + both. If both variants are returned, they SHOULD be describing + the same name, with the formatted name indicating how the + component attributes should be combined. + + formatted The full name, including all middle names, titles, and + suffixes as appropriate, formatted for display (e.g., + "Ms. Barbara Jane Jensen, III"). + + familyName The family name of the User, or last name in most + Western languages (e.g., "Jensen" given the full name + "Ms. Barbara Jane Jensen, III"). + + givenName The given name of the User, or first name in most + Western languages (e.g., "Barbara" given the full name + "Ms. Barbara Jane Jensen, III"). + + middleName The middle name(s) of the User (e.g., "Jane" given the + full name "Ms. Barbara Jane Jensen, III"). + + + +Hunt, et al. Standards Track [Page 19] + +RFC 7643 SCIM Core Schema September 2015 + + + honorificPrefix The honorific prefix(es) of the User, or title in + most Western languages (e.g., "Ms." given the full name + "Ms. Barbara Jane Jensen, III"). + + honorificSuffix The honorific suffix(es) of the User, or suffix + in most Western languages (e.g., "III" given the full name + "Ms. Barbara Jane Jensen, III"). + + displayName + The name of the user, suitable for display to end-users. Each + user returned MAY include a non-empty displayName value. The name + SHOULD be the full name of the User being described, if known + (e.g., "Babs Jensen" or "Ms. Barbara J Jensen, III") but MAY be a + username or handle, if that is all that is available (e.g., + "bjensen"). The value provided SHOULD be the primary textual + label by which this User is normally displayed by the service + provider when presenting it to end-users. + + nickName + The casual way to address the user in real life, e.g., "Bob" or + "Bobby" instead of "Robert". This attribute SHOULD NOT be used to + represent a User's username (e.g., bjensen or mpepperidge). + + profileUrl + A URI that is a uniform resource locator (as defined in + Section 1.1.3 of [RFC3986]) and that points to a location + representing the user's online profile (e.g., a web page). URIs + are canonicalized per Section 6.2 of [RFC3986]. + + title + The user's title, such as "Vice President". + + userType + Used to identify the relationship between the organization and the + user. Typical values used might be "Contractor", "Employee", + "Intern", "Temp", "External", and "Unknown", but any value may be + used. + + preferredLanguage + Indicates the user's preferred written or spoken languages and is + generally used for selecting a localized user interface. The + value indicates the set of natural languages that are preferred. + The format of the value is the same as the HTTP Accept-Language + header field (not including "Accept-Language:") and is specified + in Section 5.3.5 of [RFC7231]. The intent of this value is to + enable cloud applications to perform matching of language tags + [RFC4647] to the user's language preferences, regardless of what + may be indicated by a user agent (which might be shared), or in an + + + +Hunt, et al. Standards Track [Page 20] + +RFC 7643 SCIM Core Schema September 2015 + + + interaction that does not involve a user (such as in a delegated + OAuth 2.0 [RFC6749] style interaction) where normal HTTP + Accept-Language header negotiation cannot take place. + + locale + Used to indicate the User's default location for purposes of + localizing such items as currency, date time format, or numerical + representations. A valid value is a language tag as defined in + [RFC5646]. Computer languages are explicitly excluded. + + A language tag is a sequence of one or more case-insensitive + sub-tags, each separated by a hyphen character ("-", %x2D). For + backward compatibility, servers MAY accept tags separated by an + underscore character ("_", %x5F). In most cases, a language tag + consists of a primary language sub-tag that identifies a broad + family of related languages (e.g., "en" = English) and that is + optionally followed by a series of sub-tags that refine or narrow + that language's range (e.g., "en-CA" = the variety of English as + communicated in Canada). Whitespace is not allowed within a + language tag. Example tags include: + + fr, en-US, es-419, az-Arab, x-pig-latin, man-Nkoo-GN + + See [RFC5646] for further information. + + timezone + The User's time zone, in IANA Time Zone database format [RFC6557], + also known as the "Olson" time zone database format [Olson-TZ] + (e.g., "America/Los_Angeles"). + + active + A Boolean value indicating the user's administrative status. The + definitive meaning of this attribute is determined by the service + provider. As a typical example, a value of true implies that the + user is able to log in, while a value of false implies that the + user's account has been suspended. + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 21] + +RFC 7643 SCIM Core Schema September 2015 + + + password + This attribute is intended to be used as a means to set, replace, + or compare (i.e., filter for equality) a password. The cleartext + value or the hashed value of a password SHALL NOT be returnable by + a service provider. If a service provider holds the value + locally, the value SHOULD be hashed. When a password is set or + changed by the client, the cleartext password SHOULD be processed + by the service provider as follows: + + * Prepare the cleartext value for international language + comparison. See Section 7.8 of [RFC7644]. + + * Validate the value against server password policy. Note: The + definition and enforcement of password policy are beyond the + scope of this document. + + * Ensure that the value is encrypted (e.g., hashed). See + Section 9.2 for acceptable hashing and encryption handling when + storing or persisting for provisioning workflow reasons. + + A service provider that immediately passes the cleartext value on + to another system or programming interface MUST pass the value + directly over a secured connection (e.g., Transport Layer Security + (TLS)). If the value needs to be temporarily persisted for a + period of time (e.g., because of a workflow) before provisioning, + then the value MUST be protected by some method, such as + encryption. + + Testing for an equality match MAY be supported if there is an + existing stored hashed value. When testing for equality, the + service provider: + + * Prepares the filter value for international language + comparison. See Section 7.8 of [RFC7644]. + + * Generates the salted hash of the filter value and tests for a + match with the locally held value. + + The mutability of the password attribute is "writeOnly", + indicating that the value MUST NOT be returned by a service + provider in any form (the attribute characteristic "returned" is + "never"). + + + + + + + + + +Hunt, et al. Standards Track [Page 22] + +RFC 7643 SCIM Core Schema September 2015 + + +4.1.2. Multi-Valued Attributes + + The following multi-valued attributes are defined. + + emails + Email addresses for the User. The value SHOULD be specified + according to [RFC5321]. Service providers SHOULD canonicalize the + value according to [RFC5321], e.g., "bjensen@example.com" instead + of "bjensen@EXAMPLE.COM". The "display" sub-attribute MAY be used + to return the canonicalized representation of the email value. + The "type" sub-attribute is used to provide a classification + meaningful to the (human) user. The user interface should + encourage the use of basic values of "work", "home", and "other" + and MAY allow additional type values to be used at the discretion + of SCIM clients. + + phoneNumbers + Phone numbers for the user. The value SHOULD be specified + according to the format defined in [RFC3966], e.g., + 'tel:+1-201-555-0123'. Service providers SHOULD canonicalize the + value according to [RFC3966] format, when appropriate. The + "display" sub-attribute MAY be used to return the canonicalized + representation of the phone number value. The sub-attribute + "type" often has typical values of "work", "home", "mobile", + "fax", "pager", and "other" and MAY allow more types to be defined + by the SCIM clients. + + ims + Instant messaging address for the user. No official + canonicalization rules exist for all instant messaging addresses, + but service providers SHOULD, when appropriate, remove all + whitespace and convert the address to lowercase. The "type" + sub-attribute SHOULD take one of the following values: "aim", + "gtalk", "icq", "xmpp", "msn", "skype", "qq", "yahoo", or "other" + (representing currently popular IM services at the time of this + writing). Service providers MAY add further values if new IM + services are introduced and MAY specify more detailed + canonicalization rules for each possible value. + + photos + A URI that is a uniform resource locator (as defined in + Section 1.1.3 of [RFC3986]) that points to a resource location + representing the user's image. The resource MUST be a file (e.g., + a GIF, JPEG, or PNG image file) rather than a web page containing + an image. Service providers MAY return the same image in + different sizes, although it is recognized that no standard for + describing images of various sizes currently exists. Note that + this attribute SHOULD NOT be used to send down arbitrary photos + + + +Hunt, et al. Standards Track [Page 23] + +RFC 7643 SCIM Core Schema September 2015 + + + taken by this user; instead, profile photos of the user that are + suitable for display when describing the user should be sent. + Instead of the standard canonical values for type, this attribute + defines the following canonical values to represent popular photo + sizes: "photo" and "thumbnail". + + addresses + A physical mailing address for this user. Canonical type values + of "work", "home", and "other". This attribute is a complex type + with the following sub-attributes. All sub-attributes are + OPTIONAL. + + formatted The full mailing address, formatted for display or use + with a mailing label. This attribute MAY contain newlines. + + streetAddress The full street address component, which may + include house number, street name, P.O. box, and multi-line + extended street address information. This attribute MAY + contain newlines. + + locality The city or locality component. + + region The state or region component. + + postalCode The zip code or postal code component. + + country The country name component. When specified, the value + MUST be in ISO 3166-1 "alpha-2" code format [ISO3166]; e.g., + the United States and Sweden are "US" and "SE", respectively. + + groups + A list of groups to which the user belongs, either through direct + membership, through nested groups, or dynamically calculated. The + values are meant to enable expression of common group-based or + role-based access control models, although no explicit + authorization model is defined. It is intended that the semantics + of group membership and any behavior or authorization granted as a + result of membership are defined by the service provider. The + canonical types "direct" and "indirect" are defined to describe + how the group membership was derived. Direct group membership + indicates that the user is directly associated with the group and + SHOULD indicate that clients may modify membership through the + "Group" resource. Indirect membership indicates that user + membership is transitive or dynamic and implies that clients + cannot modify indirect group membership through the "Group" + resource but MAY modify direct group membership through the + "Group" resource, which may influence indirect memberships. If + the SCIM service provider exposes a "Group" resource, the "value" + + + +Hunt, et al. Standards Track [Page 24] + +RFC 7643 SCIM Core Schema September 2015 + + + sub-attribute MUST be the "id", and the "$ref" sub-attribute must + be the URI of the corresponding "Group" resources to which the + user belongs. Since this attribute has a mutability of + "readOnly", group membership changes MUST be applied via the + "Group" Resource (Section 4.2). This attribute has a mutability + of "readOnly". + + entitlements + A list of entitlements for the user that represent a thing the + user has. An entitlement may be an additional right to a thing, + object, or service. No vocabulary or syntax is specified; service + providers and clients are expected to encode sufficient + information in the value so as to accurately and without ambiguity + determine what the user has access to. This value has no + canonical types, although a type may be useful as a means to scope + entitlements. + + roles + A list of roles for the user that collectively represent who the + user is, e.g., "Student", "Faculty". No vocabulary or syntax is + specified, although it is expected that a role value is a String + or label representing a collection of entitlements. This value + has no canonical types. + + x509Certificates + A list of certificates associated with the resource (e.g., a + User). Each value contains exactly one DER-encoded X.509 + certificate (see Section 4 of [RFC5280]), which MUST be base64 + encoded per Section 4 of [RFC4648]. A single value MUST NOT + contain multiple certificates and so does not contain the encoding + "SEQUENCE OF Certificate" in any guise. + +4.2. "Group" Resource Schema + + SCIM provides a schema for representing groups, identified using the + following schema URI: "urn:ietf:params:scim:schemas:core:2.0:Group". + + "Group" resources are meant to enable expression of common + group-based or role-based access control models, although no explicit + authorization model is defined. It is intended that the semantics of + group membership, and any behavior or authorization granted as a + result of membership, are defined by the service provider; these are + considered out of scope for this specification. + + + + + + + + +Hunt, et al. Standards Track [Page 25] + +RFC 7643 SCIM Core Schema September 2015 + + + The following singular attribute is defined in addition to the common + attributes defined in the SCIM core schema: + + displayName + A human-readable name for the Group. REQUIRED. + + The following multi-valued attribute is defined in addition to the + common attributes defined in the SCIM core schema: + + members + A list of members of the Group. While values MAY be added or + removed, sub-attributes of members are "immutable". The "value" + sub-attribute contains the value of an "id" attribute of a SCIM + resource, and the "$ref" sub-attribute must be the URI of a SCIM + resource such as a "User", or a "Group". The intention of the + "Group" type is to allow the service provider to support nested + groups. Service providers MAY require clients to provide a + non-empty value by setting the "required" attribute characteristic + of a sub-attribute of the "members" attribute in the "Group" + resource schema. + +4.3. Enterprise User Schema Extension + + The following SCIM extension defines attributes commonly used in + representing users that belong to, or act on behalf of, a business or + enterprise. The enterprise User extension is identified using the + following schema URI: + "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User". + + The following singular attributes are defined: + + employeeNumber + A string identifier, typically numeric or alphanumeric, assigned + to a person, typically based on order of hire or association with + an organization. + + costCenter + Identifies the name of a cost center. + + organization + Identifies the name of an organization. + + division + Identifies the name of a division. + + department + Identifies the name of a department. + + + + +Hunt, et al. Standards Track [Page 26] + +RFC 7643 SCIM Core Schema September 2015 + + + manager + The user's manager. A complex type that optionally allows service + providers to represent organizational hierarchy by referencing the + "id" attribute of another User. + + value The "id" of the SCIM resource representing the user's + manager. RECOMMENDED. + + $ref The URI of the SCIM resource representing the User's + manager. RECOMMENDED. + + displayName The displayName of the user's manager. This + attribute is OPTIONAL, and mutability is "readOnly". + +5. Service Provider Configuration Schema + + SCIM provides a schema for representing the service provider's + configuration, identified using the following schema URI: + "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig". + + The service provider configuration resource enables a service + provider to discover SCIM specification features in a standardized + form as well as provide additional implementation details to clients. + All attributes have a mutability of "readOnly". Unlike other core + resources, the "id" attribute is not required for the service + provider configuration resource. + + The following singular attributes are defined in addition to the + common attributes defined in the core schema: + + documentationUri + An HTTP-addressable URL pointing to the service provider's + human-consumable help documentation. OPTIONAL. + + patch + A complex type that specifies PATCH configuration options. + REQUIRED. See Section 3.5.2 of [RFC7644]. + + supported A Boolean value specifying whether or not the operation + is supported. REQUIRED. + + bulk + A complex type that specifies bulk configuration options. See + Section 3.7 of [RFC7644]. REQUIRED. + + supported A Boolean value specifying whether or not the operation + is supported. REQUIRED. + + + + +Hunt, et al. Standards Track [Page 27] + +RFC 7643 SCIM Core Schema September 2015 + + + maxOperations An integer value specifying the maximum number of + operations. REQUIRED. + + maxPayloadSize An integer value specifying the maximum payload + size in bytes. REQUIRED. + + filter + A complex type that specifies FILTER options. REQUIRED. See + Section 3.4.2.2 of [RFC7644]. + + supported A Boolean value specifying whether or not the operation + is supported. REQUIRED. + + maxResults An integer value specifying the maximum number of + resources returned in a response. REQUIRED. + + changePassword + A complex type that specifies configuration options related to + changing a password. REQUIRED. + + supported A Boolean value specifying whether or not the operation + is supported. REQUIRED. + + sort + A complex type that specifies Sort configuration options. + REQUIRED. + + supported A Boolean value specifying whether or not sorting is + supported. REQUIRED. + + etag + A complex type that specifies ETag configuration options. + REQUIRED. + + supported A Boolean value specifying whether or not the operation + is supported. REQUIRED. + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 28] + +RFC 7643 SCIM Core Schema September 2015 + + + The following multi-valued attribute is defined in addition to the + common attributes defined in the core schema: + + authenticationSchemes + A multi-valued complex type that specifies supported + authentication scheme properties. To enable seamless discovery of + configurations, the service provider SHOULD, with the appropriate + security considerations, make the authenticationSchemes attribute + publicly accessible without prior authentication. REQUIRED. The + following sub-attributes are defined: + + type The authentication scheme. This specification defines the + values "oauth", "oauth2", "oauthbearertoken", "httpbasic", and + "httpdigest". REQUIRED. + + name The common authentication scheme name, e.g., HTTP Basic. + REQUIRED. + + description A description of the authentication scheme. + REQUIRED. + + specUri An HTTP-addressable URL pointing to the authentication + scheme's specification. OPTIONAL. + + documentationUri An HTTP-addressable URL pointing to the + authentication scheme's usage documentation. OPTIONAL. + +6. ResourceType Schema + + The "ResourceType" schema specifies the metadata about a resource + type. Resource type resources are READ-ONLY and identified using the + following schema URI: + "urn:ietf:params:scim:schemas:core:2.0:ResourceType". Unlike other + core resources, all attributes are REQUIRED unless otherwise + specified. The "id" attribute is not required for the resource type + resource. + + The following singular attributes are defined: + + id + The resource type's server unique id. This is often the same + value as the "name" attribute. OPTIONAL. + + name + The resource type name. When applicable, service providers MUST + specify the name, e.g., "User" or "Group". This name is + referenced by the "meta.resourceType" attribute in all resources. + REQUIRED. + + + +Hunt, et al. Standards Track [Page 29] + +RFC 7643 SCIM Core Schema September 2015 + + + description + The resource type's human-readable description. When applicable, + service providers MUST specify the description. OPTIONAL. + + endpoint + The resource type's HTTP-addressable endpoint relative to the Base + URL of the service provider, e.g., "Users". REQUIRED. + + schema + The resource type's primary/base schema URI, e.g., + "urn:ietf:params:scim:schemas:core:2.0:User". This MUST be equal + to the "id" attribute of the associated "Schema" resource. + REQUIRED. + + schemaExtensions + A list of URIs of the resource type's schema extensions. + OPTIONAL. + + schema The URI of an extended schema, e.g., "urn:edu:2.0:Staff". + This MUST be equal to the "id" attribute of a "Schema" + resource. REQUIRED. + + required A Boolean value that specifies whether or not the schema + extension is required for the resource type. If true, a + resource of this type MUST include this schema extension and + also include any attributes declared as required in this schema + extension. If false, a resource of this type MAY omit this + schema extension. REQUIRED. + +7. Schema Definition + + This section defines a way to specify the schema in use by resources + available and accepted by a SCIM service provider. For each + "schemas" URI value, this schema specifies the defined attribute(s) + and their characteristics (mutability, returnability, etc). For + every schema URI used in a resource object, there is a corresponding + "Schema" resource. "Schema" resources are not modifiable, and their + associated attributes have a mutability of "readOnly". Except for + "id" (which is always returned), all attributes have a "returned" + characteristic of "default". Unless otherwise specified, all schema + attributes are case insensitive. These resources have a "schemas" + attribute with the following schema URI: + + urn:ietf:params:scim:schemas:core:2.0:Schema + + Unlike other core resources, the "Schema" resource MAY contain a + complex object within a sub-attribute, and all attributes are + REQUIRED unless otherwise specified. + + + +Hunt, et al. Standards Track [Page 30] + +RFC 7643 SCIM Core Schema September 2015 + + + The following singular attributes are defined: + + id + The unique URI of the schema. When applicable, service providers + MUST specify the URI, e.g., + "urn:ietf:params:scim:schemas:core:2.0:User". Unlike most other + schemas, which use some sort of Globally Unique Identifier (GUID) + for the "id", the schema "id" is a URI so that it can be + registered and is portable between different service providers and + clients. REQUIRED. + + name + The schema's human-readable name. When applicable, service + providers MUST specify the name, e.g., "User" or "Group". + OPTIONAL. + + description + The schema's human-readable description. When applicable, service + providers MUST specify the description. OPTIONAL. + + The following multi-valued attribute is defined: + + attributes + A complex type that defines service provider attributes and their + qualities via the following set of sub-attributes: + + name The attribute's name. + + type The attribute's data type. Valid values are "string", + "boolean", "decimal", "integer", "dateTime", "reference", and + "complex". When an attribute is of type "complex", there + SHOULD be a corresponding schema attribute "subAttributes" + defined, listing the sub-attributes of the attribute. + + subAttributes When an attribute is of type "complex", + "subAttributes" defines a set of sub-attributes. + "subAttributes" has the same schema sub-attributes as + "attributes". + + multiValued A Boolean value indicating the attribute's plurality. + + description The attribute's human-readable description. When + applicable, service providers MUST specify the description. + + required A Boolean value that specifies whether or not the + attribute is required. + + + + + +Hunt, et al. Standards Track [Page 31] + +RFC 7643 SCIM Core Schema September 2015 + + + canonicalValues A collection of suggested canonical values that + MAY be used (e.g., "work" and "home"). In some cases, service + providers MAY choose to ignore unsupported values. OPTIONAL. + + caseExact A Boolean value that specifies whether or not a string + attribute is case sensitive. The server SHALL use case + sensitivity when evaluating filters. For attributes that are + case exact, the server SHALL preserve case for any value + submitted. If the attribute is case insensitive, the server + MAY alter case for a submitted value. Case sensitivity also + impacts how attribute values MAY be compared against filter + values (see Section 3.4.2.2 of [RFC7644]). + + mutability A single keyword indicating the circumstances under + which the value of the attribute can be (re)defined: + + readOnly The attribute SHALL NOT be modified. + + readWrite The attribute MAY be updated and read at any time. + This is the default value. + + immutable The attribute MAY be defined at resource creation + (e.g., POST) or at record replacement via a request (e.g., a + PUT). The attribute SHALL NOT be updated. + + writeOnly The attribute MAY be updated at any time. Attribute + values SHALL NOT be returned (e.g., because the value is a + stored hash). Note: An attribute with a mutability of + "writeOnly" usually also has a returned setting of "never". + + returned A single keyword that indicates when an attribute and + associated values are returned in response to a GET request or + in response to a PUT, POST, or PATCH request. Valid keywords + are as follows: + + always The attribute is always returned, regardless of the + contents of the "attributes" parameter. For example, "id" + is always returned to identify a SCIM resource. + + never The attribute is never returned. This may occur because + the original attribute value (e.g., a hashed value) is not + retained by the service provider. A service provider MAY + allow attributes to be used in a search filter. + + + + + + + + +Hunt, et al. Standards Track [Page 32] + +RFC 7643 SCIM Core Schema September 2015 + + + default The attribute is returned by default in all SCIM + operation responses where attribute values are returned. If + the GET request "attributes" parameter is specified, + attribute values are only returned if the attribute is named + in the "attributes" parameter. DEFAULT. + + request The attribute is returned in response to any PUT, + POST, or PATCH operations if the attribute was specified by + the client (for example, the attribute was modified). The + attribute is returned in a SCIM query operation only if + specified in the "attributes" parameter. + + uniqueness A single keyword value that specifies how the service + provider enforces uniqueness of attribute values. A server MAY + reject an invalid value based on uniqueness by returning HTTP + response code 400 (Bad Request). A client MAY enforce + uniqueness on the client side to a greater degree than the + service provider enforces. For example, a client could make a + value unique while the server has uniqueness of "none". Valid + keywords are as follows: + + none The values are not intended to be unique in any way. + DEFAULT. + + server The value SHOULD be unique within the context of the + current SCIM endpoint (or tenancy) and MAY be globally + unique (e.g., a "username", email address, or other + server-generated key or counter). No two resources on the + same server SHOULD possess the same value. + + global The value SHOULD be globally unique (e.g., an email + address, a GUID, or other value). No two resources on any + server SHOULD possess the same value. + + referenceTypes A multi-valued array of JSON strings that indicate + the SCIM resource types that may be referenced. Valid values + are as follows: + + + A SCIM resource type (e.g., "User" or "Group"), + + + "external" - indicating that the resource is an external + resource (e.g., a photo), or + + + "uri" - indicating that the reference is to a service + endpoint or an identifier (e.g., a schema URN). + + This attribute is only applicable for attributes that are of + type "reference" (Section 2.3.7). + + + +Hunt, et al. Standards Track [Page 33] + +RFC 7643 SCIM Core Schema September 2015 + + +8. JSON Representation + +8.1. Minimal User Representation + + The following is a non-normative example of the minimal required SCIM + representation in JSON format. + +{ + "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"], + "id": "2819c223-7f76-453a-919d-413861904646", + "userName": "bjensen@example.com", + "meta": { + "resourceType": "User", + "created": "2010-01-23T04:56:22Z", + "lastModified": "2011-05-13T04:42:34Z", + "version": "W\/\"3694e05e9dff590\"", + "location": + "https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646" + } +} + + Figure 3: Example Minimal User JSON Representation + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 34] + +RFC 7643 SCIM Core Schema September 2015 + + +8.2. Full User Representation + + The following is a non-normative example of the fully populated SCIM + representation in JSON format. + +{ + "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"], + "id": "2819c223-7f76-453a-919d-413861904646", + "externalId": "701984", + "userName": "bjensen@example.com", + "name": { + "formatted": "Ms. Barbara J Jensen, III", + "familyName": "Jensen", + "givenName": "Barbara", + "middleName": "Jane", + "honorificPrefix": "Ms.", + "honorificSuffix": "III" + }, + "displayName": "Babs Jensen", + "nickName": "Babs", + "profileUrl": "https://login.example.com/bjensen", + "emails": [ + { + "value": "bjensen@example.com", + "type": "work", + "primary": true + }, + { + "value": "babs@jensen.org", + "type": "home" + } + ], + "addresses": [ + { + "type": "work", + "streetAddress": "100 Universal City Plaza", + "locality": "Hollywood", + "region": "CA", + "postalCode": "91608", + "country": "USA", + "formatted": "100 Universal City Plaza\nHollywood, CA 91608 USA", + "primary": true + }, + + + + + + + + +Hunt, et al. Standards Track [Page 35] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "type": "home", + "streetAddress": "456 Hollywood Blvd", + "locality": "Hollywood", + "region": "CA", + "postalCode": "91608", + "country": "USA", + "formatted": "456 Hollywood Blvd\nHollywood, CA 91608 USA" + } + ], + "phoneNumbers": [ + { + "value": "555-555-5555", + "type": "work" + }, + { + "value": "555-555-4444", + "type": "mobile" + } + ], + "ims": [ + { + "value": "someaimhandle", + "type": "aim" + } + ], + "photos": [ + { + "value": + "https://photos.example.com/profilephoto/72930000000Ccne/F", + "type": "photo" + }, + { + "value": + "https://photos.example.com/profilephoto/72930000000Ccne/T", + "type": "thumbnail" + } + ], + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 36] + +RFC 7643 SCIM Core Schema September 2015 + + + "userType": "Employee", + "title": "Tour Guide", + "preferredLanguage": "en-US", + "locale": "en-US", + "timezone": "America/Los_Angeles", + "active":true, + "password": "t1meMa$heen", + "groups": [ + { + "value": "e9e30dba-f08f-4109-8486-d5c6a331660a", + "$ref": +"https://example.com/v2/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a", + "display": "Tour Guides" + }, + { + "value": "fc348aa8-3835-40eb-a20b-c726e15c55b5", + "$ref": +"https://example.com/v2/Groups/fc348aa8-3835-40eb-a20b-c726e15c55b5", + "display": "Employees" + }, + { + "value": "71ddacd2-a8e7-49b8-a5db-ae50d0a5bfd7", + "$ref": +"https://example.com/v2/Groups/71ddacd2-a8e7-49b8-a5db-ae50d0a5bfd7", + "display": "US Employees" + } + ], + + + + + + + + + + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 37] + +RFC 7643 SCIM Core Schema September 2015 + + + "x509Certificates": [ + { + "value": + "MIIDQzCCAqygAwIBAgICEAAwDQYJKoZIhvcNAQEFBQAwTjELMAkGA1UEBhMCVVMx + EzARBgNVBAgMCkNhbGlmb3JuaWExFDASBgNVBAoMC2V4YW1wbGUuY29tMRQwEgYD + VQQDDAtleGFtcGxlLmNvbTAeFw0xMTEwMjIwNjI0MzFaFw0xMjEwMDQwNjI0MzFa + MH8xCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRQwEgYDVQQKDAtl + eGFtcGxlLmNvbTEhMB8GA1UEAwwYTXMuIEJhcmJhcmEgSiBKZW5zZW4gSUlJMSIw + IAYJKoZIhvcNAQkBFhNiamVuc2VuQGV4YW1wbGUuY29tMIIBIjANBgkqhkiG9w0B + AQEFAAOCAQ8AMIIBCgKCAQEA7Kr+Dcds/JQ5GwejJFcBIP682X3xpjis56AK02bc + 1FLgzdLI8auoR+cC9/Vrh5t66HkQIOdA4unHh0AaZ4xL5PhVbXIPMB5vAPKpzz5i + PSi8xO8SL7I7SDhcBVJhqVqr3HgllEG6UClDdHO7nkLuwXq8HcISKkbT5WFTVfFZ + zidPl8HZ7DhXkZIRtJwBweq4bvm3hM1Os7UQH05ZS6cVDgweKNwdLLrT51ikSQG3 + DYrl+ft781UQRIqxgwqCfXEuDiinPh0kkvIi5jivVu1Z9QiwlYEdRbLJ4zJQBmDr + SGTMYn4lRc2HgHO4DqB/bnMVorHB0CC6AV1QoFK4GPe1LwIDAQABo3sweTAJBgNV + HRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZp + Y2F0ZTAdBgNVHQ4EFgQU8pD0U0vsZIsaA16lL8En8bx0F/gwHwYDVR0jBBgwFoAU + dGeKitcaF7gnzsNwDx708kqaVt0wDQYJKoZIhvcNAQEFBQADgYEAA81SsFnOdYJt + Ng5Tcq+/ByEDrBgnusx0jloUhByPMEVkoMZ3J7j1ZgI8rAbOkNngX8+pKfTiDz1R + C4+dx8oU6Za+4NJXUjlL5CvV6BEYb1+QAEJwitTVvxB/A67g42/vzgAtoRUeDov1 + +GFiBZ+GNF/cAYKcMtGcrs2i97ZkJMo=" + } + ], + "meta": { + "resourceType": "User", + "created": "2010-01-23T04:56:22Z", + "lastModified": "2011-05-13T04:42:34Z", + "version": "W\/\"a330bc54f0671c9\"", + "location": +"https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646" + } +} + + Figure 4: Example Full User JSON Representation + + + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 38] + +RFC 7643 SCIM Core Schema September 2015 + + +8.3. Enterprise User Extension Representation + + The following is a non-normative example of the fully populated User + using the enterprise User extension in JSON format. + +{ + "schemas": + ["urn:ietf:params:scim:schemas:core:2.0:User", + "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"], + "id": "2819c223-7f76-453a-919d-413861904646", + "externalId": "701984", + "userName": "bjensen@example.com", + "name": { + "formatted": "Ms. Barbara J Jensen, III", + "familyName": "Jensen", + "givenName": "Barbara", + "middleName": "Jane", + "honorificPrefix": "Ms.", + "honorificSuffix": "III" + }, + "displayName": "Babs Jensen", + "nickName": "Babs", + "profileUrl": "https://login.example.com/bjensen", + "emails": [ + { + "value": "bjensen@example.com", + "type": "work", + "primary": true + }, + { + "value": "babs@jensen.org", + "type": "home" + } + ], + "addresses": [ + { + "streetAddress": "100 Universal City Plaza", + "locality": "Hollywood", + "region": "CA", + "postalCode": "91608", + "country": "USA", + "formatted": "100 Universal City Plaza\nHollywood, CA 91608 USA", + "type": "work", + "primary": true + }, + + + + + + +Hunt, et al. Standards Track [Page 39] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "streetAddress": "456 Hollywood Blvd", + "locality": "Hollywood", + "region": "CA", + "postalCode": "91608", + "country": "USA", + "formatted": "456 Hollywood Blvd\nHollywood, CA 91608 USA", + "type": "home" + } + ], + "phoneNumbers": [ + { + "value": "555-555-5555", + "type": "work" + }, + { + "value": "555-555-4444", + "type": "mobile" + } + ], + "ims": [ + { + "value": "someaimhandle", + "type": "aim" + } + ], + "photos": [ + { + "value": + "https://photos.example.com/profilephoto/72930000000Ccne/F", + "type": "photo" + }, + { + "value": + "https://photos.example.com/profilephoto/72930000000Ccne/T", + "type": "thumbnail" + } + ], + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 40] + +RFC 7643 SCIM Core Schema September 2015 + + + "userType": "Employee", + "title": "Tour Guide", + "preferredLanguage": "en-US", + "locale": "en-US", + "timezone": "America/Los_Angeles", + "active":true, + "password": "t1meMa$heen", + "groups": [ + { + "value": "e9e30dba-f08f-4109-8486-d5c6a331660a", + "$ref": "../Groups/e9e30dba-f08f-4109-8486-d5c6a331660a", + "display": "Tour Guides" + }, + { + "value": "fc348aa8-3835-40eb-a20b-c726e15c55b5", + "$ref": "../Groups/fc348aa8-3835-40eb-a20b-c726e15c55b5", + "display": "Employees" + }, + { + "value": "71ddacd2-a8e7-49b8-a5db-ae50d0a5bfd7", + "$ref": "../Groups/71ddacd2-a8e7-49b8-a5db-ae50d0a5bfd7", + "display": "US Employees" + } + ], + "x509Certificates": [ + { + "value": + "MIIDQzCCAqygAwIBAgICEAAwDQYJKoZIhvcNAQEFBQAwTjELMAkGA1UEBhMCVVMx + EzARBgNVBAgMCkNhbGlmb3JuaWExFDASBgNVBAoMC2V4YW1wbGUuY29tMRQwEgYD + VQQDDAtleGFtcGxlLmNvbTAeFw0xMTEwMjIwNjI0MzFaFw0xMjEwMDQwNjI0MzFa + MH8xCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRQwEgYDVQQKDAtl + eGFtcGxlLmNvbTEhMB8GA1UEAwwYTXMuIEJhcmJhcmEgSiBKZW5zZW4gSUlJMSIw + IAYJKoZIhvcNAQkBFhNiamVuc2VuQGV4YW1wbGUuY29tMIIBIjANBgkqhkiG9w0B + AQEFAAOCAQ8AMIIBCgKCAQEA7Kr+Dcds/JQ5GwejJFcBIP682X3xpjis56AK02bc + 1FLgzdLI8auoR+cC9/Vrh5t66HkQIOdA4unHh0AaZ4xL5PhVbXIPMB5vAPKpzz5i + PSi8xO8SL7I7SDhcBVJhqVqr3HgllEG6UClDdHO7nkLuwXq8HcISKkbT5WFTVfFZ + zidPl8HZ7DhXkZIRtJwBweq4bvm3hM1Os7UQH05ZS6cVDgweKNwdLLrT51ikSQG3 + DYrl+ft781UQRIqxgwqCfXEuDiinPh0kkvIi5jivVu1Z9QiwlYEdRbLJ4zJQBmDr + SGTMYn4lRc2HgHO4DqB/bnMVorHB0CC6AV1QoFK4GPe1LwIDAQABo3sweTAJBgNV + HRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZp + Y2F0ZTAdBgNVHQ4EFgQU8pD0U0vsZIsaA16lL8En8bx0F/gwHwYDVR0jBBgwFoAU + dGeKitcaF7gnzsNwDx708kqaVt0wDQYJKoZIhvcNAQEFBQADgYEAA81SsFnOdYJt + Ng5Tcq+/ByEDrBgnusx0jloUhByPMEVkoMZ3J7j1ZgI8rAbOkNngX8+pKfTiDz1R + C4+dx8oU6Za+4NJXUjlL5CvV6BEYb1+QAEJwitTVvxB/A67g42/vzgAtoRUeDov1 + +GFiBZ+GNF/cAYKcMtGcrs2i97ZkJMo=" + } + ], + + + + +Hunt, et al. Standards Track [Page 41] + +RFC 7643 SCIM Core Schema September 2015 + + + "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User": { + "employeeNumber": "701984", + "costCenter": "4130", + "organization": "Universal Studios", + "division": "Theme Park", + "department": "Tour Operations", + "manager": { + "value": "26118915-6090-4610-87e4-49d8ca9f808d", + "$ref": "../Users/26118915-6090-4610-87e4-49d8ca9f808d", + "displayName": "John Smith" + } + }, + "meta": { + "resourceType": "User", + "created": "2010-01-23T04:56:22Z", + "lastModified": "2011-05-13T04:42:34Z", + "version": "W\/\"3694e05e9dff591\"", + "location": +"https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646" + } +} + + Figure 5: Example Enterprise User JSON Representation + + + + + + + + + + + + + + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 42] + +RFC 7643 SCIM Core Schema September 2015 + + +8.4. Group Representation + + The following is a non-normative example of the SCIM Group + representation in JSON format. + + { + "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Group"], + "id": "e9e30dba-f08f-4109-8486-d5c6a331660a", + "displayName": "Tour Guides", + "members": [ + { + "value": "2819c223-7f76-453a-919d-413861904646", + "$ref": + "https://example.com/v2/Users/2819c223-7f76-453a-919d-413861904646", + "display": "Babs Jensen" + }, + { + "value": "902c246b-6245-4190-8e05-00816be7344a", + "$ref": + "https://example.com/v2/Users/902c246b-6245-4190-8e05-00816be7344a", + "display": "Mandy Pepperidge" + } + ], + "meta": { + "resourceType": "Group", + "created": "2010-01-23T04:56:22Z", + "lastModified": "2011-05-13T04:42:34Z", + "version": "W\/\"3694e05e9dff592\"", + "location": + "https://example.com/v2/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a" + } + } + + Figure 6: Example Group JSON Representation + + + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 43] + +RFC 7643 SCIM Core Schema September 2015 + + +8.5. Service Provider Configuration Representation + + The following is a non-normative example of the SCIM service provider + configuration representation in JSON format. + + { + "schemas": + ["urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"], + "documentationUri": "http://example.com/help/scim.html", + "patch": { + "supported":true + }, + "bulk": { + "supported":true, + "maxOperations":1000, + "maxPayloadSize":1048576 + }, + "filter": { + "supported":true, + "maxResults": 200 + }, + "changePassword": { + "supported":true + }, + "sort": { + "supported":true + }, + "etag": { + "supported":true + }, + "authenticationSchemes": [ + { + "name": "OAuth Bearer Token", + "description": + "Authentication scheme using the OAuth Bearer Token Standard", + "specUri": "http://www.rfc-editor.org/info/rfc6750", + "documentationUri": "http://example.com/help/oauth.html", + "type": "oauthbearertoken", + "primary": true + }, + + + + + + + + + + + +Hunt, et al. Standards Track [Page 44] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name": "HTTP Basic", + "description": + "Authentication scheme using the HTTP Basic Standard", + "specUri": "http://www.rfc-editor.org/info/rfc2617", + "documentationUri": "http://example.com/help/httpBasic.html", + "type": "httpbasic" + } + ], + "meta": { + "location": "https://example.com/v2/ServiceProviderConfig", + "resourceType": "ServiceProviderConfig", + "created": "2010-01-23T04:56:22Z", + "lastModified": "2011-05-13T04:42:34Z", + "version": "W\/\"3694e05e9dff594\"" + } + } + + Figure 7: Example Service Provider Configuration JSON Representation + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 45] + +RFC 7643 SCIM Core Schema September 2015 + + +8.6. Resource Type Representation + + The following is a non-normative example of the SCIM resource types + in JSON format. + + [{ + "schemas": ["urn:ietf:params:scim:schemas:core:2.0:ResourceType"], + "id": "User", + "name": "User", + "endpoint": "/Users", + "description": "User Account", + "schema": "urn:ietf:params:scim:schemas:core:2.0:User", + "schemaExtensions": [ + { + "schema": + "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User", + "required": true + } + ], + "meta": { + "location": "https://example.com/v2/ResourceTypes/User", + "resourceType": "ResourceType" + } + }, + { + "schemas": ["urn:ietf:params:scim:schemas:core:2.0:ResourceType"], + "id": "Group", + "name": "Group", + "endpoint": "/Groups", + "description": "Group", + "schema": "urn:ietf:params:scim:schemas:core:2.0:Group", + "meta": { + "location": "https://example.com/v2/ResourceTypes/Group", + "resourceType": "ResourceType" + } + }] + + Figure 8: Example Resource Type JSON Representation + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 46] + +RFC 7643 SCIM Core Schema September 2015 + + +8.7. Schema Representation + + The following sections provide representations of schemas for both + SCIM resources and service provider schemas. Note that the JSON + representation has been modified for readability and to fit the + specification format. + +8.7.1. Resource Schema Representation + + The following is intended as an example of the SCIM schema + representation in JSON format for SCIM resources. Where permitted, + individual values and schema MAY change. This example includes + schema representations for "User", "Group", and "EnterpriseUser"; + other schema representations are possible. + +[ + { + "id" : "urn:ietf:params:scim:schemas:core:2.0:User", + "name" : "User", + "description" : "User Account", + "attributes" : [ + { + "name" : "userName", + "type" : "string", + "multiValued" : false, + "description" : "Unique identifier for the User, typically +used by the user to directly authenticate to the service provider. +Each User MUST include a non-empty userName value. This identifier +MUST be unique across the service provider's entire set of Users. +REQUIRED.", + "required" : true, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "server" + }, + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 47] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "name", + "type" : "complex", + "multiValued" : false, + "description" : "The components of the user's real name. +Providers MAY return just the full name as a single string in the +formatted sub-attribute, or they MAY return just the individual +component attributes using the other sub-attributes, or they MAY +return both. If both variants are returned, they SHOULD be +describing the same name, with the formatted name indicating how the +component attributes should be combined.", + "required" : false, + "subAttributes" : [ + { + "name" : "formatted", + "type" : "string", + "multiValued" : false, + "description" : "The full name, including all middle +names, titles, and suffixes as appropriate, formatted for display +(e.g., 'Ms. Barbara J Jensen, III').", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "familyName", + "type" : "string", + "multiValued" : false, + "description" : "The family name of the User, or +last name in most Western languages (e.g., 'Jensen' given the full +name 'Ms. Barbara J Jensen, III').", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 48] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "givenName", + "type" : "string", + "multiValued" : false, + "description" : "The given name of the User, or +first name in most Western languages (e.g., 'Barbara' given the +full name 'Ms. Barbara J Jensen, III').", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "middleName", + "type" : "string", + "multiValued" : false, + "description" : "The middle name(s) of the User +(e.g., 'Jane' given the full name 'Ms. Barbara J Jensen, III').", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "honorificPrefix", + "type" : "string", + "multiValued" : false, + "description" : "The honorific prefix(es) of the User, or +title in most Western languages (e.g., 'Ms.' given the full name +'Ms. Barbara J Jensen, III').", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 49] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "honorificSuffix", + "type" : "string", + "multiValued" : false, + "description" : "The honorific suffix(es) of the User, or +suffix in most Western languages (e.g., 'III' given the full name +'Ms. Barbara J Jensen, III').", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + } + ], + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "displayName", + "type" : "string", + "multiValued" : false, + "description" : "The name of the User, suitable for display +to end-users. The name SHOULD be the full name of the User being +described, if known.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "nickName", + "type" : "string", + "multiValued" : false, + "description" : "The casual way to address the user in real +life, e.g., 'Bob' or 'Bobby' instead of 'Robert'. This attribute +SHOULD NOT be used to represent a User's username (e.g., 'bjensen' or +'mpepperidge').", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + + + + + + +Hunt, et al. Standards Track [Page 50] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "profileUrl", + "type" : "reference", + "referenceTypes" : ["external"], + "multiValued" : false, + "description" : "A fully qualified URL pointing to a page +representing the User's online profile.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "title", + "type" : "string", + "multiValued" : false, + "description" : "The user's title, such as +\"Vice President.\"", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "userType", + "type" : "string", + "multiValued" : false, + "description" : "Used to identify the relationship between +the organization and the user. Typical values used might be +'Contractor', 'Employee', 'Intern', 'Temp', 'External', and +'Unknown', but any value may be used.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 51] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "preferredLanguage", + "type" : "string", + "multiValued" : false, + "description" : "Indicates the User's preferred written or +spoken language. Generally used for selecting a localized user +interface; e.g., 'en_US' specifies the language English and country +US.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "locale", + "type" : "string", + "multiValued" : false, + "description" : "Used to indicate the User's default location +for purposes of localizing items such as currency, date time format, or +numerical representations.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "timezone", + "type" : "string", + "multiValued" : false, + "description" : "The User's time zone in the 'Olson' time zone +database format, e.g., 'America/Los_Angeles'.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 52] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "active", + "type" : "boolean", + "multiValued" : false, + "description" : "A Boolean value indicating the User's +administrative status.", + "required" : false, + "mutability" : "readWrite", + "returned" : "default" + }, + { + "name" : "password", + "type" : "string", + "multiValued" : false, + "description" : "The User's cleartext password. This +attribute is intended to be used as a means to specify an initial +password when creating a new User or to reset an existing User's +password.", + "required" : false, + "caseExact" : false, + "mutability" : "writeOnly", + "returned" : "never", + "uniqueness" : "none" + }, + { + "name" : "emails", + "type" : "complex", + "multiValued" : true, + "description" : "Email addresses for the user. The value +SHOULD be canonicalized by the service provider, e.g., +'bjensen@example.com' instead of 'bjensen@EXAMPLE.COM'. +Canonical type values of 'work', 'home', and 'other'.", + "required" : false, + "subAttributes" : [ + { + "name" : "value", + "type" : "string", + "multiValued" : false, + "description" : "Email addresses for the user. The value +SHOULD be canonicalized by the service provider, e.g., +'bjensen@example.com' instead of 'bjensen@EXAMPLE.COM'. +Canonical type values of 'work', 'home', and 'other'.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + + + +Hunt, et al. Standards Track [Page 53] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "display", + "type" : "string", + "multiValued" : false, + "description" : "A human-readable name, primarily used +for display purposes. READ-ONLY.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "type", + "type" : "string", + "multiValued" : false, + "description" : "A label indicating the attribute's +function, e.g., 'work' or 'home'.", + "required" : false, + "caseExact" : false, + "canonicalValues" : [ + "work", + "home", + "other" + ], + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "primary", + "type" : "boolean", + "multiValued" : false, + "description" : "A Boolean value indicating the 'primary' +or preferred attribute value for this attribute, e.g., the preferred +mailing address or primary email address. The primary attribute +value 'true' MUST appear no more than once.", + "required" : false, + "mutability" : "readWrite", + "returned" : "default" + } + ], + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + + + + + +Hunt, et al. Standards Track [Page 54] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "phoneNumbers", + "type" : "complex", + "multiValued" : true, + "description" : "Phone numbers for the User. The value +SHOULD be canonicalized by the service provider according to the +format specified in RFC 3966, e.g., 'tel:+1-201-555-0123'. +Canonical type values of 'work', 'home', 'mobile', 'fax', 'pager', +and 'other'.", + "required" : false, + "subAttributes" : [ + { + "name" : "value", + "type" : "string", + "multiValued" : false, + "description" : "Phone number of the User.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "display", + "type" : "string", + "multiValued" : false, + "description" : "A human-readable name, primarily used +for display purposes. READ-ONLY.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + + + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 55] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "type", + "type" : "string", + "multiValued" : false, + "description" : "A label indicating the attribute's +function, e.g., 'work', 'home', 'mobile'.", + "required" : false, + "caseExact" : false, + "canonicalValues" : [ + "work", + "home", + "mobile", + "fax", + "pager", + "other" + ], + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "primary", + "type" : "boolean", + "multiValued" : false, + "description" : "A Boolean value indicating the 'primary' +or preferred attribute value for this attribute, e.g., the preferred +phone number or primary phone number. The primary attribute value +'true' MUST appear no more than once.", + "required" : false, + "mutability" : "readWrite", + "returned" : "default" + } + ], + "mutability" : "readWrite", + "returned" : "default" + }, + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 56] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "ims", + "type" : "complex", + "multiValued" : true, + "description" : "Instant messaging addresses for the User.", + "required" : false, + "subAttributes" : [ + { + "name" : "value", + "type" : "string", + "multiValued" : false, + "description" : "Instant messaging address for the User.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "display", + "type" : "string", + "multiValued" : false, + "description" : "A human-readable name, primarily used +for display purposes. READ-ONLY.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + + + + + + + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 57] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "type", + "type" : "string", + "multiValued" : false, + "description" : "A label indicating the attribute's +function, e.g., 'aim', 'gtalk', 'xmpp'.", + "required" : false, + "caseExact" : false, + "canonicalValues" : [ + "aim", + "gtalk", + "icq", + "xmpp", + "msn", + "skype", + "qq", + "yahoo" + ], + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "primary", + "type" : "boolean", + "multiValued" : false, + "description" : "A Boolean value indicating the 'primary' +or preferred attribute value for this attribute, e.g., the preferred +messenger or primary messenger. The primary attribute value 'true' +MUST appear no more than once.", + "required" : false, + "mutability" : "readWrite", + "returned" : "default" + } + ], + "mutability" : "readWrite", + "returned" : "default" + }, + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 58] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "photos", + "type" : "complex", + "multiValued" : true, + "description" : "URLs of photos of the User.", + "required" : false, + "subAttributes" : [ + { + "name" : "value", + "type" : "reference", + "referenceTypes" : ["external"], + "multiValued" : false, + "description" : "URL of a photo of the User.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "display", + "type" : "string", + "multiValued" : false, + "description" : "A human-readable name, primarily used +for display purposes. READ-ONLY.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + + + + + + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 59] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "type", + "type" : "string", + "multiValued" : false, + "description" : "A label indicating the attribute's +function, i.e., 'photo' or 'thumbnail'.", + "required" : false, + "caseExact" : false, + "canonicalValues" : [ + "photo", + "thumbnail" + ], + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "primary", + "type" : "boolean", + "multiValued" : false, + "description" : "A Boolean value indicating the 'primary' +or preferred attribute value for this attribute, e.g., the preferred +photo or thumbnail. The primary attribute value 'true' MUST appear +no more than once.", + "required" : false, + "mutability" : "readWrite", + "returned" : "default" + } + ], + "mutability" : "readWrite", + "returned" : "default" + }, + + + + + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 60] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "addresses", + "type" : "complex", + "multiValued" : true, + "description" : "A physical mailing address for this User. +Canonical type values of 'work', 'home', and 'other'. This attribute +is a complex type with the following sub-attributes.", + "required" : false, + "subAttributes" : [ + { + "name" : "formatted", + "type" : "string", + "multiValued" : false, + "description" : "The full mailing address, formatted for +display or use with a mailing label. This attribute MAY contain +newlines.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "streetAddress", + "type" : "string", + "multiValued" : false, + "description" : "The full street address component, +which may include house number, street name, P.O. box, and multi-line +extended street address information. This attribute MAY contain +newlines.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "locality", + "type" : "string", + "multiValued" : false, + "description" : "The city or locality component.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + + + + +Hunt, et al. Standards Track [Page 61] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "region", + "type" : "string", + "multiValued" : false, + "description" : "The state or region component.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "postalCode", + "type" : "string", + "multiValued" : false, + "description" : "The zip code or postal code component.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "country", + "type" : "string", + "multiValued" : false, + "description" : "The country name component.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + + + + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 62] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "type", + "type" : "string", + "multiValued" : false, + "description" : "A label indicating the attribute's +function, e.g., 'work' or 'home'.", + "required" : false, + "caseExact" : false, + "canonicalValues" : [ + "work", + "home", + "other" + ], + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + } + ], + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "groups", + "type" : "complex", + "multiValued" : true, + "description" : "A list of groups to which the user belongs, +either through direct membership, through nested groups, or +dynamically calculated.", + "required" : false, + "subAttributes" : [ + { + "name" : "value", + "type" : "string", + "multiValued" : false, + "description" : "The identifier of the User's group.", + "required" : false, + "caseExact" : false, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + }, + + + + + + + + + +Hunt, et al. Standards Track [Page 63] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "$ref", + "type" : "reference", + "referenceTypes" : [ + "User", + "Group" + ], + "multiValued" : false, + "description" : "The URI of the corresponding 'Group' +resource to which the user belongs.", + "required" : false, + "caseExact" : false, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "display", + "type" : "string", + "multiValued" : false, + "description" : "A human-readable name, primarily used +for display purposes. READ-ONLY.", + "required" : false, + "caseExact" : false, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "type", + "type" : "string", + "multiValued" : false, + "description" : "A label indicating the attribute's +function, e.g., 'direct' or 'indirect'.", + "required" : false, + "caseExact" : false, + "canonicalValues" : [ + "direct", + "indirect" + ], + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + } + ], + "mutability" : "readOnly", + "returned" : "default" + }, + + + +Hunt, et al. Standards Track [Page 64] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "entitlements", + "type" : "complex", + "multiValued" : true, + "description" : "A list of entitlements for the User that +represent a thing the User has.", + "required" : false, + "subAttributes" : [ + { + "name" : "value", + "type" : "string", + "multiValued" : false, + "description" : "The value of an entitlement.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "display", + "type" : "string", + "multiValued" : false, + "description" : "A human-readable name, primarily used +for display purposes. READ-ONLY.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "type", + "type" : "string", + "multiValued" : false, + "description" : "A label indicating the attribute's +function.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + + + + + + + + +Hunt, et al. Standards Track [Page 65] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "primary", + "type" : "boolean", + "multiValued" : false, + "description" : "A Boolean value indicating the 'primary' +or preferred attribute value for this attribute. The primary +attribute value 'true' MUST appear no more than once.", + "required" : false, + "mutability" : "readWrite", + "returned" : "default" + } + ], + "mutability" : "readWrite", + "returned" : "default" + }, + { + "name" : "roles", + "type" : "complex", + "multiValued" : true, + "description" : "A list of roles for the User that +collectively represent who the User is, e.g., 'Student', 'Faculty'.", + "required" : false, + "subAttributes" : [ + { + "name" : "value", + "type" : "string", + "multiValued" : false, + "description" : "The value of a role.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "display", + "type" : "string", + "multiValued" : false, + "description" : "A human-readable name, primarily used +for display purposes. READ-ONLY.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + + + + + +Hunt, et al. Standards Track [Page 66] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "type", + "type" : "string", + "multiValued" : false, + "description" : "A label indicating the attribute's +function.", + "required" : false, + "caseExact" : false, + "canonicalValues" : [], + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "primary", + "type" : "boolean", + "multiValued" : false, + "description" : "A Boolean value indicating the 'primary' +or preferred attribute value for this attribute. The primary +attribute value 'true' MUST appear no more than once.", + "required" : false, + "mutability" : "readWrite", + "returned" : "default" + } + ], + "mutability" : "readWrite", + "returned" : "default" + }, + { + "name" : "x509Certificates", + "type" : "complex", + "multiValued" : true, + "description" : "A list of certificates issued to the User.", + "required" : false, + "caseExact" : false, + "subAttributes" : [ + { + "name" : "value", + "type" : "binary", + "multiValued" : false, + "description" : "The value of an X.509 certificate.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + + + + +Hunt, et al. Standards Track [Page 67] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "display", + "type" : "string", + "multiValued" : false, + "description" : "A human-readable name, primarily used +for display purposes. READ-ONLY.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "type", + "type" : "string", + "multiValued" : false, + "description" : "A label indicating the attribute's +function.", + "required" : false, + "caseExact" : false, + "canonicalValues" : [], + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "primary", + "type" : "boolean", + "multiValued" : false, + "description" : "A Boolean value indicating the 'primary' +or preferred attribute value for this attribute. The primary +attribute value 'true' MUST appear no more than once.", + "required" : false, + "mutability" : "readWrite", + "returned" : "default" + } + ], + "mutability" : "readWrite", + "returned" : "default" + } + ], + "meta" : { + "resourceType" : "Schema", + "location" : + "/v2/Schemas/urn:ietf:params:scim:schemas:core:2.0:User" + } + }, + + + + +Hunt, et al. Standards Track [Page 68] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "id" : "urn:ietf:params:scim:schemas:core:2.0:Group", + "name" : "Group", + "description" : "Group", + "attributes" : [ + { + "name" : "displayName", + "type" : "string", + "multiValued" : false, + "description" : "A human-readable name for the Group. +REQUIRED.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "members", + "type" : "complex", + "multiValued" : true, + "description" : "A list of members of the Group.", + "required" : false, + "subAttributes" : [ + { + "name" : "value", + "type" : "string", + "multiValued" : false, + "description" : "Identifier of the member of this Group.", + "required" : false, + "caseExact" : false, + "mutability" : "immutable", + "returned" : "default", + "uniqueness" : "none" + }, + + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 69] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "$ref", + "type" : "reference", + "referenceTypes" : [ + "User", + "Group" + ], + "multiValued" : false, + "description" : "The URI corresponding to a SCIM resource +that is a member of this Group.", + "required" : false, + "caseExact" : false, + "mutability" : "immutable", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "type", + "type" : "string", + "multiValued" : false, + "description" : "A label indicating the type of resource, +e.g., 'User' or 'Group'.", + "required" : false, + "caseExact" : false, + "canonicalValues" : [ + "User", + "Group" + ], + "mutability" : "immutable", + "returned" : "default", + "uniqueness" : "none" + } + ], + "mutability" : "readWrite", + "returned" : "default" + } + ], + "meta" : { + "resourceType" : "Schema", + "location" : + "/v2/Schemas/urn:ietf:params:scim:schemas:core:2.0:Group" + } + }, + + + + + + + + +Hunt, et al. Standards Track [Page 70] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "id" : "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User", + "name" : "EnterpriseUser", + "description" : "Enterprise User", + "attributes" : [ + { + "name" : "employeeNumber", + "type" : "string", + "multiValued" : false, + "description" : "Numeric or alphanumeric identifier assigned +to a person, typically based on order of hire or association with an +organization.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "costCenter", + "type" : "string", + "multiValued" : false, + "description" : "Identifies the name of a cost center.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "organization", + "type" : "string", + "multiValued" : false, + "description" : "Identifies the name of an organization.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + + + + + + + + + + + +Hunt, et al. Standards Track [Page 71] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "division", + "type" : "string", + "multiValued" : false, + "description" : "Identifies the name of a division.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "department", + "type" : "string", + "multiValued" : false, + "description" : "Identifies the name of a department.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "manager", + "type" : "complex", + "multiValued" : false, + "description" : "The User's manager. A complex type that +optionally allows service providers to represent organizational +hierarchy by referencing the 'id' attribute of another User.", + "required" : false, + "subAttributes" : [ + { + "name" : "value", + "type" : "string", + "multiValued" : false, + "description" : "The id of the SCIM resource representing +the User's manager. REQUIRED.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + + + + + + + + +Hunt, et al. Standards Track [Page 72] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "$ref", + "type" : "reference", + "referenceTypes" : [ + "User" + ], + "multiValued" : false, + "description" : "The URI of the SCIM resource +representing the User's manager. REQUIRED.", + "required" : false, + "caseExact" : false, + "mutability" : "readWrite", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "displayName", + "type" : "string", + "multiValued" : false, + "description" : "The displayName of the User's manager. +OPTIONAL and READ-ONLY.", + "required" : false, + "caseExact" : false, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + } + ], + "mutability" : "readWrite", + "returned" : "default" + } + ], + "meta" : { + "resourceType" : "Schema", + "location" : +"/v2/Schemas/urn:ietf:params:scim:schemas:extension:enterprise:2.0:User" + } + } +] + + Figure 9: Example JSON Representation for Resource Schema + + + + + + + + + + +Hunt, et al. Standards Track [Page 73] + +RFC 7643 SCIM Core Schema September 2015 + + +8.7.2. Service Provider Schema Representation + + The following is a representation of the SCIM schema for the fixed + service provider schemas: ServiceProviderConfig, ResourceType, and + Schema. + +[ + { + "id" : + "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig", + "name" : "Service Provider Configuration", + "description" : "Schema for representing the service provider's + configuration", + "attributes" : [ + { + "name" : "documentationUri", + "type" : "reference", + "referenceTypes" : ["external"], + "multiValued" : false, + "description" : "An HTTP-addressable URL pointing to the + service provider's human-consumable help documentation.", + "required" : false, + "caseExact" : false, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + }, + + + + + + + + + + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 74] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "patch", + "type" : "complex", + "multiValued" : false, + "description" : "A complex type that specifies PATCH + configuration options.", + "required" : true, + "returned" : "default", + "mutability" : "readOnly", + "subAttributes" : [ + { + "name" : "supported", + "type" : "boolean", + "multiValued" : false, + "description" : "A Boolean value specifying whether or not + the operation is supported.", + "required" : true, + "mutability" : "readOnly", + "returned" : "default" + } + ] + }, + { + "name" : "bulk", + "type" : "complex", + "multiValued" : false, + "description" : "A complex type that specifies bulk + configuration options.", + "required" : true, + "returned" : "default", + "mutability" : "readOnly", + "subAttributes" : [ + { + "name" : "supported", + "type" : "boolean", + "multiValued" : false, + "description" : "A Boolean value specifying whether or not + the operation is supported.", + "required" : true, + "mutability" : "readOnly", + "returned" : "default" + }, + + + + + + + + + +Hunt, et al. Standards Track [Page 75] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "maxOperations", + "type" : "integer", + "multiValued" : false, + "description" : "An integer value specifying the maximum + number of operations.", + "required" : true, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "maxPayloadSize", + "type" : "integer", + "multiValued" : false, + "description" : "An integer value specifying the maximum + payload size in bytes.", + "required" : true, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + } + ] + }, + { + "name" : "filter", + "type" : "complex", + "multiValued" : false, + "description" : "A complex type that specifies + FILTER options.", + "required" : true, + "returned" : "default", + "mutability" : "readOnly", + "subAttributes" : [ + { + "name" : "supported", + "type" : "boolean", + "multiValued" : false, + "description" : "A Boolean value specifying whether or not + the operation is supported.", + "required" : true, + "mutability" : "readOnly", + "returned" : "default" + }, + + + + + + + +Hunt, et al. Standards Track [Page 76] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "maxResults", + "type" : "integer", + "multiValued" : false, + "description" : "An integer value specifying the maximum + number of resources returned in a response.", + "required" : true, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + } + ] + }, + { + "name" : "changePassword", + "type" : "complex", + "multiValued" : false, + "description" : "A complex type that specifies configuration + options related to changing a password.", + "required" : true, + "returned" : "default", + "mutability" : "readOnly", + "subAttributes" : [ + { + "name" : "supported", + "type" : "boolean", + "multiValued" : false, + "description" : "A Boolean value specifying whether or not + the operation is supported.", + "required" : true, + "mutability" : "readOnly", + "returned" : "default" + } + ] + }, + + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 77] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "sort", + "type" : "complex", + "multiValued" : false, + "description" : "A complex type that specifies sort result + options.", + "required" : true, + "returned" : "default", + "mutability" : "readOnly", + "subAttributes" : [ + { + "name" : "supported", + "type" : "boolean", + "multiValued" : false, + "description" : "A Boolean value specifying whether or not + the operation is supported.", + "required" : true, + "mutability" : "readOnly", + "returned" : "default" + } + ] + }, + { + "name" : "authenticationSchemes", + "type" : "complex", + "multiValued" : true, + "description" : "A complex type that specifies supported + authentication scheme properties.", + "required" : true, + "returned" : "default", + "mutability" : "readOnly", + "subAttributes" : [ + { + "name" : "name", + "type" : "string", + "multiValued" : false, + "description" : "The common authentication scheme name, + e.g., HTTP Basic.", + "required" : true, + "caseExact" : false, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + }, + + + + + + + +Hunt, et al. Standards Track [Page 78] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "description", + "type" : "string", + "multiValued" : false, + "description" : "A description of the authentication + scheme.", + "required" : true, + "caseExact" : false, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "specUri", + "type" : "reference", + "referenceTypes" : ["external"], + "multiValued" : false, + "description" : "An HTTP-addressable URL pointing to the + authentication scheme's specification.", + "required" : false, + "caseExact" : false, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "documentationUri", + "type" : "reference", + "referenceTypes" : ["external"], + "multiValued" : false, + "description" : "An HTTP-addressable URL pointing to the + authentication scheme's usage documentation.", + "required" : false, + "caseExact" : false, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + } + ] + } + ] + }, + + + + + + + + + +Hunt, et al. Standards Track [Page 79] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "id" : "urn:ietf:params:scim:schemas:core:2.0:ResourceType", + "name" : "ResourceType", + "description" : "Specifies the schema that describes a SCIM + resource type", + "attributes" : [ + { + "name" : "id", + "type" : "string", + "multiValued" : false, + "description" : "The resource type's server unique id. + May be the same as the 'name' attribute.", + "required" : false, + "caseExact" : false, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "name", + "type" : "string", + "multiValued" : false, + "description" : "The resource type name. When applicable, + service providers MUST specify the name, e.g., 'User'.", + "required" : true, + "caseExact" : false, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "description", + "type" : "string", + "multiValued" : false, + "description" : "The resource type's human-readable + description. When applicable, service providers MUST + specify the description.", + "required" : false, + "caseExact" : false, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + }, + + + + + + + + +Hunt, et al. Standards Track [Page 80] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "endpoint", + "type" : "reference", + "referenceTypes" : ["uri"], + "multiValued" : false, + "description" : "The resource type's HTTP-addressable + endpoint relative to the Base URL, e.g., '/Users'.", + "required" : true, + "caseExact" : false, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "schema", + "type" : "reference", + "referenceTypes" : ["uri"], + "multiValued" : false, + "description" : "The resource type's primary/base schema + URI.", + "required" : true, + "caseExact" : true, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "schemaExtensions", + "type" : "complex", + "multiValued" : false, + "description" : "A list of URIs of the resource type's schema + extensions.", + "required" : true, + "mutability" : "readOnly", + "returned" : "default", + "subAttributes" : [ + { + "name" : "schema", + "type" : "reference", + "referenceTypes" : ["uri"], + "multiValued" : false, + "description" : "The URI of a schema extension.", + "required" : true, + "caseExact" : true, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + }, + + + +Hunt, et al. Standards Track [Page 81] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "required", + "type" : "boolean", + "multiValued" : false, + "description" : "A Boolean value that specifies whether + or not the schema extension is required for the + resource type. If true, a resource of this type MUST + include this schema extension and also include any + attributes declared as required in this schema extension. + If false, a resource of this type MAY omit this schema + extension.", + "required" : true, + "mutability" : "readOnly", + "returned" : "default" + } + ] + } + ] + }, + { + "id" : "urn:ietf:params:scim:schemas:core:2.0:Schema", + "name" : "Schema", + "description" : "Specifies the schema that describes a + SCIM schema", + "attributes" : [ + { + "name" : "id", + "type" : "string", + "multiValued" : false, + "description" : "The unique URI of the schema. + When applicable, service providers MUST specify the URI.", + "required" : true, + "caseExact" : false, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + }, + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 82] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "name", + "type" : "string", + "multiValued" : false, + "description" : "The schema's human-readable name. When + applicable, service providers MUST specify the name, + e.g., 'User'.", + "required" : true, + "caseExact" : false, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "description", + "type" : "string", + "multiValued" : false, + "description" : "The schema's human-readable name. When + applicable, service providers MUST specify the name, + e.g., 'User'.", + "required" : false, + "caseExact" : false, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "attributes", + "type" : "complex", + "multiValued" : true, + "description" : "A complex attribute that includes the + attributes of a schema.", + "required" : true, + "mutability" : "readOnly", + "returned" : "default", + "subAttributes" : [ + { + "name" : "name", + "type" : "string", + "multiValued" : false, + "description" : "The attribute's name.", + "required" : true, + "caseExact" : true, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + }, + + + + +Hunt, et al. Standards Track [Page 83] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "type", + "type" : "string", + "multiValued" : false, + "description" : "The attribute's data type. + Valid values include 'string', 'complex', 'boolean', + 'decimal', 'integer', 'dateTime', 'reference'.", + "required" : true, + "canonicalValues" : [ + "string", + "complex", + "boolean", + "decimal", + "integer", + "dateTime", + "reference" + ], + "caseExact" : false, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "multiValued", + "type" : "boolean", + "multiValued" : false, + "description" : "A Boolean value indicating an + attribute's plurality.", + "required" : true, + "mutability" : "readOnly", + "returned" : "default" + }, + { + "name" : "description", + "type" : "string", + "multiValued" : false, + "description" : "A human-readable description of the + attribute.", + "required" : false, + "caseExact" : true, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + }, + + + + + + + +Hunt, et al. Standards Track [Page 84] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "required", + "type" : "boolean", + "multiValued" : false, + "description" : "A boolean value indicating whether or + not the attribute is required.", + "required" : false, + "mutability" : "readOnly", + "returned" : "default" + }, + { + "name" : "canonicalValues", + "type" : "string", + "multiValued" : true, + "description" : "A collection of canonical values. When + applicable, service providers MUST specify the + canonical types, e.g., 'work', 'home'.", + "required" : false, + "caseExact" : true, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "caseExact", + "type" : "boolean", + "multiValued" : false, + "description" : "A Boolean value indicating whether or + not a string attribute is case sensitive.", + "required" : false, + "mutability" : "readOnly", + "returned" : "default" + }, + + + + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 85] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "mutability", + "type" : "string", + "multiValued" : false, + "description" : "Indicates whether or not an attribute + is modifiable.", + "required" : false, + "caseExact" : true, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none", + "canonicalValues" : [ + "readOnly", + "readWrite", + "immutable", + "writeOnly" + ] + }, + { + "name" : "returned", + "type" : "string", + "multiValued" : false, + "description" : "Indicates when an attribute is returned + in a response (e.g., to a query).", + "required" : false, + "caseExact" : true, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none", + "canonicalValues" : [ + "always", + "never", + "default", + "request" + ] + }, + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 86] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "uniqueness", + "type" : "string", + "multiValued" : false, + "description" : "Indicates how unique a value must be.", + "required" : false, + "caseExact" : true, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none", + "canonicalValues" : [ + "none", + "server", + "global" + ] + }, + { + "name" : "referenceTypes", + "type" : "string", + "multiValued" : true, + "description" : "Used only with an attribute of type + 'reference'. Specifies a SCIM resourceType that a + reference attribute MAY refer to, e.g., 'User'.", + "required" : false, + "caseExact" : true, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + }, + + + + + + + + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 87] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "subAttributes", + "type" : "complex", + "multiValued" : true, + "description" : "Used to define the sub-attributes of a + complex attribute.", + "required" : false, + "mutability" : "readOnly", + "returned" : "default", + "subAttributes" : [ + { + "name" : "name", + "type" : "string", + "multiValued" : false, + "description" : "The attribute's name.", + "required" : true, + "caseExact" : true, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "type", + "type" : "string", + "multiValued" : false, + "description" : "The attribute's data type. + Valid values include 'string', 'complex', 'boolean', + 'decimal', 'integer', 'dateTime', 'reference'.", + "required" : true, + "caseExact" : false, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none", + "canonicalValues" : [ + "string", + "complex", + "boolean", + "decimal", + "integer", + "dateTime", + "reference" + ] + }, + + + + + + + + +Hunt, et al. Standards Track [Page 88] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "multiValued", + "type" : "boolean", + "multiValued" : false, + "description" : "A Boolean value indicating an + attribute's plurality.", + "required" : true, + "mutability" : "readOnly", + "returned" : "default" + }, + { + "name" : "description", + "type" : "string", + "multiValued" : false, + "description" : "A human-readable description of the + attribute.", + "required" : false, + "caseExact" : true, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + }, + { + "name" : "required", + "type" : "boolean", + "multiValued" : false, + "description" : "A boolean value indicating whether or + not the attribute is required.", + "required" : false, + "mutability" : "readOnly", + "returned" : "default" + }, + { + "name" : "canonicalValues", + "type" : "string", + "multiValued" : true, + "description" : "A collection of canonical values. When + applicable, service providers MUST specify the + canonical types, e.g., 'work', 'home'.", + "required" : false, + "caseExact" : true, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + }, + + + + + + +Hunt, et al. Standards Track [Page 89] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "caseExact", + "type" : "boolean", + "multiValued" : false, + "description" : "A Boolean value indicating whether or + not a string attribute is case sensitive.", + "required" : false, + "mutability" : "readOnly", + "returned" : "default" + }, + { + "name" : "mutability", + "type" : "string", + "multiValued" : false, + "description" : "Indicates whether or not an + attribute is modifiable.", + "required" : false, + "caseExact" : true, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none", + "canonicalValues" : [ + "readOnly", + "readWrite", + "immutable", + "writeOnly" + ] + }, + { + "name" : "returned", + "type" : "string", + "multiValued" : false, + "description" : "Indicates when an attribute is + returned in a response (e.g., to a query).", + "required" : false, + "caseExact" : true, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none", + "canonicalValues" : [ + "always", + "never", + "default", + "request" + ] + }, + + + + + +Hunt, et al. Standards Track [Page 90] + +RFC 7643 SCIM Core Schema September 2015 + + + { + "name" : "uniqueness", + "type" : "string", + "multiValued" : false, + "description" : "Indicates how unique a value must be.", + "required" : false, + "caseExact" : true, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none", + "canonicalValues" : [ + "none", + "server", + "global" + ] + }, + { + "name" : "referenceTypes", + "type" : "string", + "multiValued" : false, + "description" : "Used only with an attribute of type + 'reference'. Specifies a SCIM resourceType that a + reference attribute MAY refer to, e.g., 'User'.", + "required" : false, + "caseExact" : true, + "mutability" : "readOnly", + "returned" : "default", + "uniqueness" : "none" + } + ] + } + ] + } + ] + } +] + + Figure 10: Representation of Fixed Service Provider Endpoint Schemas + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 91] + +RFC 7643 SCIM Core Schema September 2015 + + +9. Security Considerations + +9.1. Protocol + + SCIM data is intended to be exchanged using the SCIM protocol. It is + important when handling data to implement the security considerations + outlined in Section 7 of [RFC7644]. + +9.2. Passwords and Other Sensitive Security Data + + Passwords and other attributes related to security credentials are of + an extremely sensitive nature and require special handling when + transmitted or stored. While the SCIM protocol uses cleartext + passwords for value assignment and equality-testing purposes, + password values MUST NOT be stored in cleartext form. + + Administrators should undertake industry best practices to protect + the storage of credentials and in particular SHOULD follow + recommendations outlined in Section 5.1.4.1 of [RFC6819]. These + requirements include, but are not limited to, the following: + + o Provide injection attack countermeasures (e.g., by validating all + inputs and parameters); + + o Credentials should not be stored in cleartext form; + + o Store credentials using an encrypted protection mechanism (e.g., + hashing); and + + o Where possible, avoid passwords as the sole form of + authentication, and consider using credentials that are based on + asymmetric cryptography. + +9.3. Privacy + + The SCIM core schema defines attributes that are sensitive and may be + considered personally identifying information (PII). These privacy + considerations should be considered for extensions as well as the + schema defined in this specification. + + For the purposes of this specification, PII is defined as any + attribute that may be used as a unique key to identify a person + (e.g., "User"). Since other information may be used in combination + to identify an individual, all attributes in SCIM are considered + "sensitive" personal information. Consult regional jurisdictions to + see if there are special considerations for the handling of personal + information (e.g., PII). + + + + +Hunt, et al. Standards Track [Page 92] + +RFC 7643 SCIM Core Schema September 2015 + + + Information should be shared on an as-needed basis. A SCIM client + should limit information to what it believes a service provider + requires, and a SCIM service provider should only accept information + it needs. Clients and service providers should take into + consideration that personal information is being conveyed across + technical (e.g., protocol and applications), administrative (e.g., + organizational, corporate), and jurisdictional boundaries. In + particular, information security and privacy must be considered. + + Security service level agreements for the handling of these + attributes are beyond the scope of this document but are to be + carefully considered by implementers and deploying organizations. + + Please see the Privacy Considerations section of [RFC7644] for more + protocol-specific considerations regarding the handling of SCIM + information. + + SCIM defines attributes such as "id", "externalId", and SCIM resource + URIs, which cause new PII to be generated; this information is + important to the way that the SCIM protocol identifies and locates + resources. Where possible, it is suggested that service providers + take the following remediations: + + o Where possible, assign and bind identifiers to specific tenants + and/or clients. When multiple tenants are able to reference the + same resource, they should do so via separate identifiers (id or + externalId). This ensures that separate domains linked to the + same information cannot perform identifier correlation. + + o In the case of "externalId", if multiple values are supported, use + access control to restrict access to the client domain that + assigned the "externalId" value. + + o Ensure that access to data is appropriately restricted to + authorized parties with a "need to know". + + o When persisted, ensure that the appropriate protection mechanisms + are in place to restrict access by unauthorized parties, including + administrators or parties with access to backup data. + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 93] + +RFC 7643 SCIM Core Schema September 2015 + + +10. IANA Considerations + +10.1. Registration of SCIM URN Sub-namespace and SCIM Registry + + IANA has added an entry to the "IETF URN Sub-namespace for Registered + Protocol Parameter Identifiers" registry and created a sub-namespace + for the Registered Parameter Identifier as per [RFC3553]: + "urn:ietf:params:scim". + + To manage this sub-namespace, IANA has created the "System for + Cross-domain Identity Management (SCIM) Schema URIs" registry, which + is used to manage entries within the "urn:ietf:params:scim" + namespace. The registry description is as follows: + + o Registry name: SCIM + + o Specification: this document (RFC 7643) + + o Repository: See Section 10.2 + + o Index value: See Section 10.2 + +10.2. URN Sub-namespace for SCIM + + SCIM schemas and SCIM messages utilize URIs to identify the schema in + use or other relevant context. This section creates and registers an + IETF URN Sub-namespace for use in the SCIM specifications and future + extensions. + + + + + + + + + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 94] + +RFC 7643 SCIM Core Schema September 2015 + + +10.2.1. Specification Template + + Namespace ID: + + The Namespace ID "scim" has been assigned. + + Registration Information: + + Version: 1 + + Date: 2015-06-22 + + Declared registrant of the namespace: + + Registering organization + The Internet Engineering Task Force + + Designated contact + A designated expert will monitor the SCIM public mailing list, + "scim@ietf.org". + + Declaration of Syntactic Structure: + + The Namespace Specific String (NSS) of all URNs that use the + "scim" Namespace ID shall have the following structure: + + urn:ietf:params:scim:{type}:{name}{:other} + + The keywords have the following meaning: + + type + The entity type, which is either "schemas" or "api". + + name + A required US-ASCII string that conforms to the URN syntax + requirements (see [RFC2141]) and defines a major namespace of a + schema used within SCIM (e.g., "core", which is reserved for + SCIM specifications). The value MAY also be an industry name + or organization name. + + other + Any US-ASCII string that conforms to the URN syntax + requirements (see [RFC2141]) and defines the sub-namespace + (which MAY be further broken down in namespaces delimited by + colons) as needed to uniquely identify a schema. + + + + + + +Hunt, et al. Standards Track [Page 95] + +RFC 7643 SCIM Core Schema September 2015 + + + Relevant Ancillary Documentation: + + None + + Identifier Uniqueness Considerations: + + The designated contact shall be responsible for reviewing and + enforcing uniqueness. + + Identifier Persistence Considerations: + + Once a name has been allocated, it MUST NOT be reallocated for a + different purpose. The rules provided for assignments of values + within a sub-namespace MUST be constructed so that the meanings of + values cannot change. This registration mechanism is not + appropriate for naming values whose meanings may change over time. + + As the SCIM specifications are updated and the SCIM protocol + version is adjusted, a new registration will be made when + significant changes are made -- for example, + "urn:ietf:params:scim:schemas:core:1.0 (externally defined, not + previously registered)" and + "urn:ietf:params:scim:schemas:core:2.0". + + Process of Identifier Assignment: + + Identifiers with namespace type "schema" (e.g., + "urn:ietf:params:scim:schemas") are assigned after the review of + the assigned contact via the SCIM public mailing list, + "scim@ietf.org", as documented in Section 10.3. + + Namespaces with type "api" (e.g., "urn:ietf:params:scim:api") and + "param" (e.g., "urn:ietf:params:scim:param") are reserved for + IETF-approved SCIM specifications. + + Process of Identifier Resolution: + + The namespace is not currently listed with a Resolution Discovery + System (RDS), but nothing about the namespace prohibits the future + definition of appropriate resolution methods or listing with an + RDS. + + Rules for Lexical Equivalence: + + No special considerations; the rules for lexical equivalence + specified in [RFC2141] apply. + + + + + +Hunt, et al. Standards Track [Page 96] + +RFC 7643 SCIM Core Schema September 2015 + + + Conformance with URN Syntax: + + No special considerations. + + Validation Mechanism: + + None specified. + + Scope: + + Global. + +10.3. Registering SCIM Schemas + + This section defines the process for registering new SCIM schemas + with IANA in the "System for Cross-domain Identity Management (SCIM) + Schema URIs" registry (see Section 10.1). A schema URI is used as a + value in the "schemas" attribute (Section 3) for the purpose of + distinguishing extensions used in a SCIM resource. + +10.3.1. Registration Procedure + + The IETF has created a mailing list, scim@ietf.org, which can be used + for public discussion of SCIM schema proposals prior to registration. + Use of the mailing list is strongly encouraged. The IESG has + appointed a designated expert [RFC5226] who will monitor the + scim@ietf.org mailing list and review registrations. + + Registration of new "core" schemas (e.g., in the namespace + "urn:ietf:params:scim:schemas:core") and "API" schemas (e.g., in the + namespace "urn:ietf:params:scim:api") MUST be reviewed by the + designated expert and published in an RFC. An RFC is REQUIRED for + the registration of new value data types that modify existing + properties. An RFC is also REQUIRED for registration of SCIM schema + URIs that modify SCIM schema previously documented in an existing + RFC. URNs within "urn:ietf:params:scim" but outside the above + namespaces MAY be registered with a simple review (e.g., check for + spam) by the designated expert on a first-come-first-served basis. + + The registration procedure begins when a completed registration + template, defined in the sections below, is sent to scim@ietf.org and + iana@iana.org. Within two weeks, the designated expert is expected + to tell IANA and the submitter of the registration whether the + registration is approved, approved with minor changes, or rejected + with cause. When a registration is rejected with cause, it can be + resubmitted if the concerns listed in the cause are addressed. + + + + + +Hunt, et al. Standards Track [Page 97] + +RFC 7643 SCIM Core Schema September 2015 + + + Decisions made by the designated expert can be appealed to the IESG + Applications Area Director, then to the IESG. They follow the normal + appeals procedure for IESG decisions. + + Once the registration procedure concludes successfully, IANA creates + or modifies the corresponding record in the SCIM schema registry. + The completed registration template is discarded. + + An RFC specifying one or more new schema URIs MUST include the + completed registration templates, which MAY be expanded with + additional information. These completed templates are intended to go + in the body of the document, not in the IANA Considerations section. + The RFC SHOULD include any attributes defined. + +10.3.2. Schema Registration Template + + A SCIM schema URI is defined by completing the following template: + + Schema URI: A unique URI for the SCIM schema extension. + + Schema Name: A descriptive name of the schema extension (e.g., + "Generic Device"). + + Intended or Associated Resource Type: A value defining the resource + type (e.g., "Device"). + + Purpose: A description of the purpose of the extension and/or its + intended use. + + Single-value Attributes: A list and description of single-valued + attributes defined, including complex attributes. + + Multi-valued Attributes: A list and description of multi-valued + attributes defined, including complex attributes. + + + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 98] + +RFC 7643 SCIM Core Schema September 2015 + + +10.4. Initial SCIM Schema Registry + + The IANA has populated the "System for Cross-domain Identity + Management (SCIM) Schema URIs" registry with the following registries + for SCIM schema URIs, with pointers to appropriate reference + documents. Note: The schema URIs listed below are broken into two + lines for readability. + + +-----------------------------------+-----------------+-------------+ + | Schema URI | Name | Reference | + +-----------------------------------+-----------------+-------------+ + | urn:ietf:params:scim:schemas: | User Resource | See Section | + | core:2.0:User | | 4.1 | + | | | | + | urn:ietf:params:scim:schemas: | Enterprise User | See Section | + | extension:enterprise:2.0:User | Extension | 4.3 | + | | | | + | urn:ietf:params:scim:schemas: | Group Resource | See Section | + | core:2.0:Group | | 4.2 | + +-----------------------------------+-----------------+-------------+ + + SCIM Schema URIs for Data Resources + + +-----------------------------------+-------------------+-----------+ + | Schema URI | Name | Reference | + +-----------------------------------+-------------------+-----------+ + | urn:ietf:params:scim:schemas: | Service Provider | See | + | core:2.0:ServiceProviderConfig | Configuration | Section 5 | + | | Schema | | + | | | | + | urn:ietf:params:scim:schemas: | Resource Type | See | + | core:2.0:ResourceType | Configuration | Section 6 | + | | | | + | urn:ietf:params:scim:schemas: | Schema | See | + | core:2.0:Schema | Definitions | Section 7 | + | | Schema | | + +-----------------------------------+-------------------+-----------+ + + SCIM Server-Related Schema URIs + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 99] + +RFC 7643 SCIM Core Schema September 2015 + + +11. References + +11.1. Normative References + + [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate + Requirement Levels", BCP 14, RFC 2119, + DOI 10.17487/RFC2119, March 1997, + <http://www.rfc-editor.org/info/rfc2119>. + + [RFC2141] Moats, R., "URN Syntax", RFC 2141, DOI 10.17487/RFC2141, + May 1997, <http://www.rfc-editor.org/info/rfc2141>. + + [RFC3553] Mealling, M., Masinter, L., Hardie, T., and G. Klyne, + "An IETF URN Sub-namespace for Registered Protocol + Parameters", BCP 73, RFC 3553, DOI 10.17487/RFC3553, + June 2003, <http://www.rfc-editor.org/info/rfc3553>. + + [RFC3629] Yergeau, F., "UTF-8, a transformation format of + ISO 10646", STD 63, RFC 3629, DOI 10.17487/RFC3629, + November 2003, <http://www.rfc-editor.org/info/rfc3629>. + + [RFC3966] Schulzrinne, H., "The tel URI for Telephone Numbers", + RFC 3966, DOI 10.17487/RFC3966, December 2004, + <http://www.rfc-editor.org/info/rfc3966>. + + [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform + Resource Identifier (URI): Generic Syntax", STD 66, + RFC 3986, DOI 10.17487/RFC3986, January 2005, + <http://www.rfc-editor.org/info/rfc3986>. + + [RFC4647] Phillips, A. and M. Davis, "Matching of Language Tags", + BCP 47, RFC 4647, DOI 10.17487/RFC4647, September 2006, + <http://www.rfc-editor.org/info/rfc4647>. + + [RFC4648] Josefsson, S., "The Base16, Base32, and Base64 Data + Encodings", RFC 4648, DOI 10.17487/RFC4648, October 2006, + <http://www.rfc-editor.org/info/rfc4648>. + + [RFC5234] Crocker, D., Ed., and P. Overell, "Augmented BNF for + Syntax Specifications: ABNF", STD 68, RFC 5234, + DOI 10.17487/ RFC5234, January 2008, + <http://www.rfc-editor.org/info/rfc5234>. + + [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., + Housley, R., and W. Polk, "Internet X.509 Public Key + Infrastructure Certificate and Certificate Revocation List + (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008, + <http://www.rfc-editor.org/info/rfc5280>. + + + +Hunt, et al. Standards Track [Page 100] + +RFC 7643 SCIM Core Schema September 2015 + + + [RFC5321] Klensin, J., "Simple Mail Transfer Protocol", RFC 5321, + DOI 10.17487/RFC5321, October 2008, + <http://www.rfc-editor.org/info/rfc5321>. + + [RFC5646] Phillips, A., Ed., and M. Davis, Ed., "Tags for + Identifying Languages", BCP 47, RFC 5646, + DOI 10.17487/RFC5646, September 2009, + <http://www.rfc-editor.org/info/rfc5646>. + + [RFC6557] Lear, E. and P. Eggert, "Procedures for Maintaining the + Time Zone Database", BCP 175, RFC 6557, + DOI 10.17487/RFC6557, February 2012, + <http://www.rfc-editor.org/info/rfc6557>. + + [RFC7159] Bray, T., Ed., "The JavaScript Object Notation (JSON) Data + Interchange Format", RFC 7159, DOI 10.17487/RFC7159, + March 2014, <http://www.rfc-editor.org/info/rfc7159>. + + [RFC7231] Fielding, R., Ed., and J. Reschke, Ed., "Hypertext + Transfer Protocol (HTTP/1.1): Semantics and Content", + RFC 7231, DOI 10.17487/RFC7231, June 2014, + <http://www.rfc-editor.org/info/rfc7231>. + + [RFC7232] Fielding, R., Ed., and J. Reschke, Ed., "Hypertext + Transfer Protocol (HTTP/1.1): Conditional Requests", + RFC 7232, DOI 10.17487/RFC7232, June 2014, + <http://www.rfc-editor.org/info/rfc7232>. + + [RFC7644] Hunt, P., Ed., Grizzle, K., Ansari, M., Wahlstroem, E., + and C. Mortimore, "System for Cross-domain Identity + Management: Protocol", RFC 7644, DOI 10.17487/RFC7644, + September 2015, <http://www.rfc-editor.org/info/rfc7644>. + +11.2. Informative References + + [ISO3166] International Organization for Standardization, "Codes for + the representation of names of countries and their + subdivisions - Part 1: Country codes", ISO 3166-1:2013, + November 2013, <http://www.iso.org>. + + [Olson-TZ] Internet Assigned Numbers Authority, "IANA Time Zone + Database", <https://www.iana.org/time-zones>. + + [PortableContacts] + Smarr, J., "Portable Contacts 1.0 Draft C - Schema Only", + August 2008, + <http://www.portablecontacts.net/draft-spec.html>. + + + + +Hunt, et al. Standards Track [Page 101] + +RFC 7643 SCIM Core Schema September 2015 + + + [RFC2277] Alvestrand, H., "IETF Policy on Character Sets and + Languages", BCP 18, RFC 2277, DOI 10.17487/RFC2277, + January 1998, <http://www.rfc-editor.org/info/rfc2277>. + + [RFC4512] Zeilenga, K., Ed., "Lightweight Directory Access Protocol + (LDAP): Directory Information Models", RFC 4512, + DOI 10.17487/RFC4512, June 2006, + <http://www.rfc-editor.org/info/rfc4512>. + + [RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an + IANA Considerations Section in RFCs", BCP 26, RFC 5226, + DOI 10.17487/RFC5226, May 2008, + <http://www.rfc-editor.org/info/rfc5226>. + + [RFC6350] Perreault, S., "vCard Format Specification", RFC 6350, + DOI 10.17487/RFC6350, August 2011, + <http://www.rfc-editor.org/info/rfc6350>. + + [RFC6749] Hardt, D., Ed., "The OAuth 2.0 Authorization Framework", + RFC 6749, DOI 10.17487/RFC6749, October 2012, + <http://www.rfc-editor.org/info/rfc6749>. + + [RFC6819] Lodderstedt, T., Ed., McGloin, M., and P. Hunt, "OAuth 2.0 + Threat Model and Security Considerations", RFC 6819, + DOI 10.17487/RFC6819, January 2013, + <http://www.rfc-editor.org/info/rfc6819>. + + [XML-Schema] + Peterson, D., Gao, S., Malhotra, A., Sperberg-McQueen, C., + and H. Thompson, "XML Schema Definition Language (XSD) 1.1 + Part 2: Datatypes", April 2012, + <http://www.w3.org/TR/xmlschema11-2/>. + + + + + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 102] + +RFC 7643 SCIM Core Schema September 2015 + + +Acknowledgements + + The editor would like to acknowledge the contribution and work of the + editors of draft versions of this document: + + Chuck Mortimore, Salesforce + + Patrick Harding, Ping + + Paul Madsen, Ping + + Trey Drake, UnboundID + + The SCIM Community would like to thank the following people for the + work they've done in the research, formulation, drafting, editing, + and support of this specification. + + Morteza Ansari (morteza.ansari@cisco.com) + + Sidharth Choudhury (schoudhury@salesforce.com) + + Samuel Erdtman (samuel@erdtman.se) + + Kelly Grizzle (kelly.grizzle@sailpoint.com) + + Chris Phillips (cjphillips@gmail.com) + + Erik Wahlstroem (erik.wahlstrom@nexusgroup.com) + + Phil Hunt (phil.hunt@yahoo.com) + + Special thanks to Joseph Smarr, whose excellent work on the Portable + Contacts Specification [PortableContacts] provided a basis for the + SCIM schema structure and text. + + + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 103] + +RFC 7643 SCIM Core Schema September 2015 + + +Authors' Addresses + + Phil Hunt (editor) + Oracle Corporation + + Email: phil.hunt@yahoo.com + + + Kelly Grizzle + SailPoint + + Email: kelly.grizzle@sailpoint.com + + + Erik Wahlstroem + Nexus Technology + + Email: erik.wahlstrom@nexusgroup.com + + + Chuck Mortimore + Salesforce.com + + Email: cmortimore@salesforce.com + + + + + + + + + + + + + + + + + + + + + + + + + + + +Hunt, et al. Standards Track [Page 104] + |