scim

Handle empty values according to SCIM RFC


According to the RFC: https://datatracker.ietf.org/doc/html/rfc7644#section-3.3

Attributes whose mutability is "readWrite" and that are omitted from the request body MAY be assumed to be not asserted by the client.

I take it that "ommited" and "not asserted" are not the same thing. But the term "asserted" is only use in the same context, without definition.

If "non asserted" is different than "ommited", does it mean "explicitly specify an empty value" ?

(The next paragraph also shows that it is different than explicitly specifying a "null" value)


Solution

  • The condition is attributes that:

    Omitted from the request body means that it is not present in the request body.

    For attributes that meet those conditions, they may be assumed to be not asserted by the client. That is to say - the client is not sending any information or instructions on the state of that attribute. The opposite, as is seen in many SCIM service provider implementations of PUT update, is that the omission of a readWrite attribute from the request body is seen an assertion about that attribute - meaning, the lack of the attribute's presence states that it should be removed/nulled out.