IETF SCIM 126

Vienna 24 July 2026

Chairs Intro

• 5 min Chairs intro and agenda gardening
• 5 min - Paulo - SCIM Use Cases
  https://datatracker.ietf.org/doc/draft-ietf-scim-use-cases-reloaded/
• 15 min - Danny - Protocol Interoperability Profile
  https://datatracker.ietf.org/doc/draft-zollner-scim-interop-profile/
• 10 min - Jen & Danny - SCIM IPSIE Profile
  https://datatracker.ietf.org/doc/draft-schreiber-scim-ipsie-profile/
• 15 min - Danny - GroupMember Resource
  https://datatracker.ietf.org/doc/draft-zollner-scim-group-members/
• 30 min - Danny - AI Agent Resource Extension
  https://datatracker.ietf.org/doc/draft-wzdk-scim-agent-resource/

SCIM 2 Interoperability Profile

Last presented in Schenzen

• SCIM is tough for interoperability because of painful complexity.
  SCIM PATCH is an example

  • Focus is scoping down possible options from infinity to eg: 2
  • Establishes new normative requirements, and may include
    motivation
  • Describes some things that are already normatively required but
    nobody realizes
  • There is a way to indicate compliance with the profile (ie
    metadata)
  • There is additional discussion of Case Sensitivity / Uniqueness
  • Prohibits "Pathless PATCH"
  • Adds rigor around patching multi-valued attributes
  • Rules for requiring pagination
  • adds rigor for endpoints (especially metadata)

• Open questions for the WG

  • is this in scope for the WG? I believe it does
  • • Pam: I believe it is in scope
    • Nancy: Could call in scope, goals: "incorporate
      interoperability feedback". Need more reviews before doing
      an adoption call
    • Danny: we've had 2 reviews, but need more

  • What should be considered before adopting the draft?

    • no commenters

  • Nancy: Asked for reviewers previously

    • Mike Kaiser: happy to review
    • Max Gerber: happy to review
    • Pam Dingle: will review

  • Aaron: do it before November, post to list

IPSIE SCIM 2 Profile

Jen Schreiber

• IPSIE: interoperability profile for secure identity in the
  enterprise
• done in collaboration with OIDF, profiles include provisioning and
  federation
• IPSIE has 3 assurance levels, meant to solve problem of helping
  vendors & implementers adhere to a consistent quality of security
• AL3 is in draft mode
• Shared prerequisites require certain credential formats &
  presentation profiles
• Danny: question to chairs is this in scope
• IPSIE requirements are probably not in scope, Interop profile is in
  scope, not really fair to force them together
• Danny: I prefer that they are not mixed together
• Jeff: usually the certification is not an artifact of IETF it is of
  OIDF, is there any synchronization on that?
• Nancy: why is work done here when usually it is done in the
  certifying working group
• Danny: The SCIM wg is more about the technical implementation. IPSIE
  is in the regulatory ish family. "Business needs requirements is not
  there"
• Pam: no matter what, requirements of SCIM need to be brought to
  IETF. But my question on shared prereq slides, the authentication
  and authorization requirements are not yet set and there could be
  multiple of them. If it's conformance testing, does it have to
  dictate them or it will not be IPSIE compliance?
• Danny: open to any requirement in IPSIE draft is molded to make
  sense; this is a first cut on paper.
• Danny: this is about getting away from static API keys, primarily
• Aaron: I'm hearing this may not be the place to host the profile
• Nancy: for now it may not be in scope or mature enough

Use Cases

Paulo

• Danny provided deep feedback but it still needs to be processed
• Feedback on terminology: this is redundant and doesn't make sense.
  Looking for feedback to talk about going back to original terms of
  resource object and resource attribute.
• The terminology is the most important part.
• Nancy: the use cases draft is supposed to drive the work. We are
  getting apathy. What is the problem. Do we even need to go through
  with publishing
• Justin: use case documents are meant to be a rallying cry and then
  everyone walks away from it. Suggest SCIM wg declares as a document
  that will never be published.
• Nancy: are we done?
• Justin: are we done with everything we never intend to finish? But
  answer for publishing is no.
• Paulo: I struggle every time to have conversations in the market.
  Are you talking about terminology or use cases?
• Justin: use cases. Terminology will be obsolete day after publishing
• Danny: Agree with Justin. If this is a living document,
  orchestration roles terminology added complexity rather than
  sticking with the original terms.
• Nancy: it was still useful, conversation needed to be had
  • Is it time to say thank you and we should move on?

-Poll: Should we move on fromthe use cases draft with no plans to
publish?

• Y: 4 N: 4 no opinion: 6
• Chairs: if there is no opinion, we can talk more but thanks
  profusely for rallying this group to align now

GroupMember Resource

Danny Z

• handful of changes since Schenzen
• solves the "very large group" problem
• by default groupmember is an attribute in a multi-valued array.
  Pagination doesn't work and that is an issue for a million member
  roup
• This spec flattens the relationship to being a first class resource
• group.value and member.value are the primary data in the object
• This makes pagination, filtering and other syntactic manipulation
  scale much more easily
• small schema extension to group object - points the scim client to
  where the members can be found (separate resource or same resource)
• draft is written to be backwards compatible, includes requirement
  for consistency between the two representationsin the two objects
• open questions:
• 1) should there be member-type contstraints - 2) should it be
  adopted

• Nancy: has anyone read the draft?

  • Have not gotten sufficient feedback

• Poll: who has read the Groupmember draft

• Y: 2 N: 11 no opinion: 2

• Volunteers:

  • Pam
  • Jeff
  • Hans-Jörg Happel

• Nancy: Roles draft is adopted - Danny do you want to keep alive

  • Danny yes

AI Agent

Danny

• Two drafts in Montreal, since that time a group have been working to
  converge
• New draft published 6 weeks ago

• AI agents are entering production workflows, need to be managed via
  the same processes already in place for users

  • identity governance, lifecycle processes

• In absence of a standard you get proprietary solutions where
  everyone notates agent status differently

• Intent is for it to define resource type of "agent" and a minimal
  schema

• Flemming:

  • we are all struggling with the what is an agent is tough and
    there are arguments either way and there are going to be changes
    • maybe we need to keep this open

• Danny: roundtrip time is problematic, some agents are very
  ephemeral, it may not match the SCIM delivery model

• Flemming - this is a new resource type, we aren't defining a system
  and there are use case scenarios where things could be viewed
  differently
• Justin: the definition of agent i s going against wimse. That is ok
  but what is important is that the term chosen in SCIM is specific.
  Agent is so semantically saturated that is meaningless. Nothing AI
  specific about what SCIM will do. Focus in SCIM on template is where
  the core bit of it is, but it is a short walk to say it is a running
  process. If we don't define we can look at what we want out of this.
  I don't see that I would ever deploy
• Max: there is a thing that we want to do where we have an ecosystem
  of apps that are talking to each other. My software is trying to do
  things, we should figure out what those things are and design around
  that. If we can pull the agent it will be easier to get through.
• Danny: early this year, as we were bringing the drafts out,
  consensus was that it was so hard to do it would be tough.
• Pam: it doesn't matter what the 'thing' is other than it has to be
  managed by SCIM. SO, we need to tune the definition
• Danny: landing on template vs instance to be represented was more of
  a practicality today to handle the use cases
• Em: I am in favor, when people talk about agents, sometimes agents
  need to be treated on par in a human system. In favor of this as a
  problem solved, don't care about the labels
• -Chris: AD hat on - isn't this autonomy? Is this just a label? Not
  knowing data model, you want something parallel - autonomous entity
  might work, but needs inheritance back
• Pieter: humans are autonomous entities too. What you really need is
  a flag saying "fake user" if you can get metadata & instance
  information but agent will break us into jail
• Danny: don't care about label, agent/toaster/whateer - anything is
  good
• call for adoption: we don't have enough consensus to be adopted

Charter Discussion

• Nancy: have already thanked Paulo and Pam for the use cases draft

  • Roles draft has expired, that must be dealt with
  • New text needed for charter: we can put the interoperability
    profile in scope, but can we tweak what was actually written
  • Given the WG is 2 years old, those drafts have not earned
    interest - suggest we continue the discussion on the work items
    we want to address.
  • Need to address the "autonomous entity"etc account unit - with
    enough rigor to guide the charter.
  • Given we have new out-of-charter drafts, have reached apathy on
    current charter, options are 1) close the charter or 2) pick up
    momentum for new work

• Danny: agree on the apathy for existing charter objects

  • small population of participants is not perfect
  • Nancy: that could work in our favor. We need implementers, if we
    don't have them then we shouldn't spend the energy

• Danny: longterm I would like to move the bigger rocks, but the small
  things are what is urgent

• Nancy: vendors: who is going to move to a SCIM 3
• Pam: for SCIM 3.0 and who would implement and deploy, fair question
  as we wont do it for our health but there may be changes in the way
  we're doing it now
• Nancy: there is appetite for new work, let's take the apathy into
  consideration. There has to be discussion
• Mike K: SCIM has to evolve in the next few years to move into more
  real-time processes. That may open up more use cases & architectures
• Nancy: potential formula for success: when proposals come forward
  that can be the compelling reason
• Chris: sounds like there are interesting potential and with SCIM
  there might be new need for updates but language to go through the
  IESG to the effect of "making changes to incorporate autonomous
  activities and make renovations."
• Chris: collectively are you able to do this or not, you need to
  decide
• Mike: if SCIM has a placeholder, for governance, request, all the
  other flows, that could be a reasonable idea.
• Nancy: there will be interim relationships between oauth, wimse and
  other WGs, if we make those labels and they have to be lifecycle
  managed
• Pam: taking away that we need to talk more with wimse; if agent is
  not ok, is workload a better term? we can discuss on the list
• George: listening to the talk would be good to collect deployment
  patterns. How SCIM gets used may affect how services are also
  deployed
• Nancy: Closing out-
• PARTY STARTS IN THE WG MEEETING ROOM SO MUCH ENTHUSIASMSMSMSMS