From 4b389b6b4e2afc214af64e2a04a5730bdac5e323 Mon Sep 17 00:00:00 2001 From: John Coffey Date: Sat, 19 Sep 2026 08:56:53 -0700 Subject: [PATCH] SCIM decisions: build before per-domain directories, with the OIDC authority test deferred; build to the spec without the profile drafts or vendor docs (SCIM-61, open questions 12 and 13) --- docs/spec/features/scim.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/docs/spec/features/scim.md b/docs/spec/features/scim.md index 91b162a..ffa4b7b 100644 --- a/docs/spec/features/scim.md +++ b/docs/spec/features/scim.md @@ -590,6 +590,11 @@ Each requirement has an ID, and tests name the IDs they check. - **SCIM-61.** The rule follows whichever directory serves the domain. Until per-domain directories (`Domain.directoryId`) are rebuilt, that's the default directory. + **Decision** (2026-09-19): SCIM is built before per-domain directories + (feature 9). Acceptance test 5 (`oidc.rs`) binds an OIDC directory to one + domain, so it stays ignored until feature 9 is built, and runs unchanged + then. Until then SCIM-58 to SCIM-60 are tested against the default + directory. ## Interfaces @@ -829,6 +834,12 @@ removed suites (`auth`, `bulk`, `discovery`, `groups`, `limits`, `query`, OAuth mode would want it. Decide with `contract.md`'s OAuth work. 11. **Tenant quota status** (SCIM-20) and the rate-limit accounting of `/Bulk` (SCIM-14) are our Decisions. +**Decision** (2026-09-19) on 12 and 13: SCIM is built to this spec without +reading the profile drafts or the vendors' documentation, since each point +they'd inform already has a Decision here. Both stay open, to check after +the build; the replayed Okta, Keycloak and Entra payloads in `driver.py` +cover the clients meanwhile. + 12. **The interop and IPSIE profiles.** Upstream's docs say it follows draft-zollner-scim-interop-profile (except unknown-attribute rejection) and the IPSIE profile's lifecycle rules. Neither draft was read for this