Chair: Gary Cole
Attendees:
Gary Cole (Oracle)
Marco Fanti (Oracle)
Karsten Huneycutt (UNC-Chapel Hill)
Prateek Mishra (Oracle)
1) Call Roll:
- Gary took roll.
- Quorum *was* achieved (4 of 6 voting members attended)
- Voting status changes: None.
2) Approve minutes from April 23 meeting.
- No one objected to approving the minutes as posted in the calendar-event.
3) SCIM Strategy (Prateek Mishra / Gary Cole)
- Outlook for convergence
- Implications for PSTC
Gary recapped the events since the PSTC restarted: SPMLv3 -> Use-Cases -> RESTPML -> SCIM -> What's Missing? -> Why Do You Need That?
- Movement for a new version of SPML led to an effort to clarify use-cases for enhancements.
- Writing use-cases revealed that V2 already addresses most needs. Some require adjustments, but most require only examples.
- Excitement at SCIM's RESTful style of interaction led to a proposal for RESTPML. Excitement at standard-schema led to a proposal for SIMPLEST.
- Marketing traction and excitement at the simplicity of SCIM led people to ask whether SCIM replaces SPML.
- Some participants analyzed gaps between SPML and SCIM. Most notably, Phil Hunt proposed extending SCIM to support multiple targets.
- Some contributors to SCIM don't understand the need for targeting or other extensions, don't want anything to delay ratification of SCIM 1.0.
Gary believes that this brings us almost full-circle, back to (the need for) Use-Cases:
- Enterprises, App-Vendors and IDM Vendors want to know what's missing and why it's needed. We need to develop the Use-Cases.
- Use-Cases underlay every feature and function in SPMLv2. They were in discussions and in emails, but were not delivered as part of the standard.
- OASIS rules have changed. TCs now may deliver such ancillary documents as Committee Notes.
- Gary asks whether participants agree that developing use-cases is important.
Prateek agrees that use-cases would be valuable:
-- SCIM is currently defined narrowly, very focused and unlikely to change scope without a push.
-- Customers are confused because the name and the marketing seem to indicate that SCIM will meet all their needs.
-- Cloud seen as fundamentally different and easier. Anyone who disagrees "just doesn't get it."
-- Need use-cases to clarify how identity-management will work for enterprises using clouds.
Karsten asks: What is the goal of such use-cases?
- The first use-cases we wrote were to justify possible extensions/corrections to SPMLv2.
- Then we got focused on the RESTful binding for SPML and the SIMPLEST data-model.
Gary replies that the goal of development use-cases for enterprise IDM seems two-fold:
- To justify convergence (i.e., to justify extensions to SCIM) if the IETF WG is interested.
- To justify divergence (i.e., to justify RESTPML or some "wrapper" to SCIM) if the IETF WG is not interested.
Karsten pointed out the need for other work within the scope of existing SPML, e.g.,:
- Formal errata document exists, but is not widely known, is not easy to find, might need some updates.
- Formalized SOAP binding would be valuable to those who deploy the existing standard.
Prateek commented again in support of the need for use-cases:
- Most SPML deployments were within the enterprise (often baked into IDM products).
- Deployments within the enterprise often did not cross formal administrative boundaries.
- Within an enterprise, administrative boundaries can be bent or broken more easily than premise-to-cloud or cloud-to-cloud.
Gary promised to post to the list a draft of use-cases (business-functions, topologies) that explain the scope of SPMLv2:
- Brevity and clarity will be very important; will need help from committee-members.
- Draft may be abstract (in the interest of brevity); will need help to add concrete examples wherever this helps.
4) AOB: None.
|
Bi-weekly PSTC meeting (Conference Call)