Search code examples
scimscim2

Should the schema be altered if the server does not handle all attributes?


If our SCIM server only handles a small subset of the attributes in the core User schema and ignores most other attributes: Should the server return a reduced schema that reflects what is supported on the schemas endpoint? Or should it return the full default core schema definition?

And if the schema is altered to reflect what the server actually supports, should it still be named urn:ietf:params:scim:schemas:core:2.0:User, or does it need to get a different name?


Solution

  • Should the server return a reduced schema that reflects what is supported on the schemas endpoint?

    Yes.

    Or should it return the full default core schema definition?

    No.

    Service providers are free to omit attributes and change attribute characteristics, provided it does not change any other requirements outlined in the RFC nor redefine the attributes. The purpose of the discovery endpoints, including "/Schemas", is to provide service providers the ability to specify their schema definitions.

    And if the schema is altered to reflect what the server actually supports, should it still be named urn:ietf:params:scim:schemas:core:2.0:User, or does it need to get a different name?

    Provided you meet the above criteria, the schema should continue to be named urn:ietf:params:scim:schemas:core:2.0:User. But, you should use custom resources and/or extensions for new attributes/resources not defined in the RFC.

    I agree that the RFC could perhaps be more clear about this, but there are some hints throughout, such as the following from Section 2:

    SCIM's support of schema is attribute based, where each attribute may have different type, mutability, cardinality, or returnability. Validation of documents and messages is always performed by an intended receiver, as specified by the SCIM specifications. Validation is performed by the receiver in the context of a SCIM protocol request (see [RFC7644]). For example, a SCIM service provider, upon receiving a request to replace an existing resource with a replacement JSON object, evaluates each asserted attribute based on its characteristics as defined in the relevant schema (e.g., mutability) and decides which attributes may be replaced or ignored.

    Additional references: