rfc9944v2.txt   rfc9944.txt 
skipping to change at line 110 skipping to change at line 110
10.2. Informative References 10.2. Informative References
Appendix A. JSON Schema Representation Appendix A. JSON Schema Representation
A.1. Resource Schema A.1. Resource Schema
A.2. Core Device Schema A.2. Core Device Schema
A.3. EndpointApp Schema A.3. EndpointApp Schema
A.4. BLE Extension Schema A.4. BLE Extension Schema
A.5. DPP Extension Schema A.5. DPP Extension Schema
A.6. Ethernet MAB Extension Schema A.6. Ethernet MAB Extension Schema
A.7. FDO Extension Schema A.7. FDO Extension Schema
A.8. Zigbee Extension Schema A.8. Zigbee Extension Schema
A.9. EndpointAppsExt Extension Schema A.9. endpointAppsExt Extension Schema
Appendix B. OpenAPI Representation Appendix B. OpenAPI Representation
B.1. Core Device Schema OpenAPI Representation B.1. Core Device Schema OpenAPI Representation
B.2. EndpointApp Schema OpenAPI Representation B.2. EndpointApp Schema OpenAPI Representation
B.3. BLE Extension Schema OpenAPI Representation B.3. BLE Extension Schema OpenAPI Representation
B.4. DPP Extension Schema OpenAPI Representation B.4. DPP Extension Schema OpenAPI Representation
B.5. Ethernet MAB Extension Schema OpenAPI Representation B.5. Ethernet MAB Extension Schema OpenAPI Representation
B.6. FDO Extension Schema OpenAPI Representation B.6. FDO Extension Schema OpenAPI Representation
B.7. Zigbee Extension Schema OpenAPI Representation B.7. Zigbee Extension Schema OpenAPI Representation
B.8. EndpointAppsExt Extension Schema OpenAPI Representation B.8. endpointAppsExt Extension Schema OpenAPI Representation
Appendix C. FIDO Device Onboarding Example Flow Appendix C. FIDO Device Onboarding Example Flow
Acknowledgments Acknowledgments
Authors' Addresses Authors' Addresses
1. Introduction 1. Introduction
The Internet of Things presents a management challenge in many The Internet of Things presents a management challenge in many
dimensions. One of them is the ability to onboard and manage a large dimensions. One of them is the ability to onboard and manage a large
number of devices. There are many models for bootstrapping trust number of devices. There are many models for bootstrapping trust
between devices and network deployments. Indeed, it is expected that between devices and network deployments. Indeed, it is expected that
skipping to change at line 278 skipping to change at line 278
OpenAPI versions do not have a means to express case sensitivity, and OpenAPI versions do not have a means to express case sensitivity, and
thus attributes that are not case sensitive must be manually thus attributes that are not case sensitive must be manually
validated. validated.
Several additional schemas specify specific onboarding mechanisms, Several additional schemas specify specific onboarding mechanisms,
such as Bluetooth Low Energy (BLE) [BLE54], Wi-Fi Easy Connect such as Bluetooth Low Energy (BLE) [BLE54], Wi-Fi Easy Connect
[DPP2], and FIDO Device Onboard [FDO11]. [DPP2], and FIDO Device Onboard [FDO11].
1.4. Schema Representation 1.4. Schema Representation
Attributes defined in the device core schema and extensions comprise Attributes defined in the device core schema (see Section 2.2 of
characteristics and SCIM datatypes defined in Sections 2.2 and 2.3 of [RFC7643]) and extensions comprise characteristics and the SCIM
[RFC7643]. This specification does not define new characteristics datatypes (defined in Section 2.3 of [RFC7643]). This specification
and datatypes for the SCIM attributes. does not define new characteristics and datatypes for the SCIM
attributes.
1.5. Terminology 1.5. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in "OPTIONAL" in this document are to be interpreted as described in
BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here. capitals, as shown here.
The reader is also expected to be familiar with the narrative schema The reader is also expected to be familiar with the narrative schema
language used in [RFC7643]. language used in [RFC7643].
2. ResourceType Device 2. ResourceType Device
A new resource type 'Device' is specified. The "ResourceType" schema A new resource type Device is specified. The "ResourceType" schema
specifies the metadata about a resource type (see Section 6 of specifies the metadata about a resource type (see Section 6 of
[RFC7643]). It comprises a core device schema and several extension [RFC7643]). It comprises a core device schema and several extension
schemas. This schema provides a minimal resource representation, schemas. This schema provides a minimal resource representation,
whereas extension schemas extend it depending on the device's whereas extension schemas extend it depending on the device's
capability. capability.
2.1. Common Attributes 2.1. Common Attributes
The Device schema contains three common attributes as defined in The device schema contains three common attributes as defined in
Section 3.1 of [RFC7643]. No semantic or syntax changes are made Section 3.1 of [RFC7643]. No semantic or syntax changes are made
here, but the attributes are listed merely for completeness. here, but the attributes are listed merely for completeness.
id: A required and unique attribute of the core device schema (see id: A required and unique attribute of the core device schema (see
Section 3.1 of [RFC7643]). Section 3.1 of [RFC7643]).
externalId: An optional attribute (see Section 3.1 of [RFC7643]). externalId: An optional attribute (see Section 3.1 of [RFC7643]).
meta: A required and complex attribute (see Section 3.1 of meta: A required and complex attribute (see Section 3.1 of
[RFC7643]). [RFC7643]).
3. SCIM Core Device Schema 3. SCIM Core Device Schema
The core device schema provides the minimal representation of a The core device schema provides the minimal representation of a
resource "Device". It contains only those attributes that any device resource Device. It contains only those attributes that any device
may need, and only one attribute is required. It is identified using may need, and only one attribute is required. It is identified using
the schema URI: the schema URI:
urn:ietf:params:scim:schemas:core:2.0:Device urn:ietf:params:scim:schemas:core:2.0:Device
The following attributes are defined in the core device schema. The following attributes are defined in the core device schema.
3.1. Singular Attributes 3.1. Singular Attributes
displayName: A string that provides a human-readable name for a displayName: A string that provides a human-readable name for a
device. It is intended to be displayed to end users and should be device. It is intended to be displayed to end users and should be
suitable for that purpose. The attribute is not required and is suitable for that purpose. The attribute is not required and is
not case sensitive. It may be modified and SHOULD be returned by not case sensitive. It may be modified and SHOULD be returned by
default. No uniqueness constraints are imposed on this attribute. default. No uniqueness constraints are imposed on this attribute.
active: A mutable boolean that is required. If set to TRUE, it active: A mutable boolean that is required. If set to true, it
means that this device is intended to be operational. Attempts to means that this device is intended to be operational. Attempts to
control or access a device where this value is set to FALSE may control or access a device where this value is set to false may
fail. For example, when used in conjunction with Non-IP Device fail. For example, when used in conjunction with Non-Internet-
Control (NIPC) [NIPC], commands such as connect, disconnect, and Connected Physical Components (NIPC) [NIPC], commands (such as
subscribe that control application sends to the controller for the connect, disconnect, and subscribe) that control application sends
devices any command will be rejected by the controller. to the controller for devices will be rejected by the controller.
mudUrl: A string that represents the URL to the Manufacturer Usage mudUrl: A string that represents the URL to the Manufacturer Usage
Description (MUD) file associated with this device. This Description (MUD) file associated with this device. This
attribute is optional and mutable. The mudUrl value is case attribute is optional, mutable, and returned by default. When
sensitive and not unique. When present, this attribute may be present, this attribute may be used as described in [RFC8520].
used as described in [RFC8520]. This attribute is case sensitive The mudUrl value is case sensitive and not unique.
and returned by default.
groups: An optional read-only complex object that indicates group groups: An optional read-only complex object that indicates group
membership. Its form is precisely the same as that defined in membership. Its form is precisely the same as that defined in
Section 4.1.2 of [RFC7643]. Section 4.1.2 of [RFC7643].
+=============+=======+=====+=======+=========+========+========+ +=============+=======+=====+=======+=========+========+========+
| Attribute | Multi | Req | Case | Mutable | Return | Unique | | Attribute | Multi | Req | Case | Mutable | Return | Unique |
| | Value | | Exact | | | | | | Value | | Exact | | | |
+=============+=======+=====+=======+=========+========+========+ +=============+=======+=====+=======+=========+========+========+
| displayName | F | F | F | RW | Def | None | | displayName | F | F | F | RW | Def | None |
skipping to change at line 402 skipping to change at line 402
} }
} }
<CODE ENDS> <CODE ENDS>
Figure 3: Core Device Example Entries Figure 3: Core Device Example Entries
4. Groups 4. Groups
Device and EndpointApp groups are created using the SCIM groups as Device and EndpointApp groups are created using the SCIM groups as
defined in Section 4.2 of [RFC7643]. If set, the "type" subattribute defined in Section 4.2 of [RFC7643]. If set, the "type" subattribute
of the "members" attribute MUST be set to "Device" for devices and of the "members" attribute MUST be set to Device for devices and
"EndpointApp" for endpoint applications. EndpointApp for endpoint applications.
5. Resource Type EndpointApp 5. Resource Type EndpointApp
This section defines the 'EndpointApp' resource type. The This section defines the EndpointApp resource type. The
"ResourceType" schema specifies the metadata about a resource type "ResourceType" schema specifies the metadata about a resource type
(see Section 6 of [RFC7643]). The resource "EndpointApp" represents (see Section 6 of [RFC7643]). The resource EndpointApp represents
client applications that can control and/or receive data from the client applications that can control and/or receive data from the
devices. devices.
6. SCIM EndpointApp Schema 6. SCIM EndpointApp Schema
The EndpointApp schema is used to authorize control or telemetry The EndpointApp schema is used to authorize control or telemetry
services for clients. The schema identifies the application and how services for clients. The schema identifies the application and how
clients are to authenticate to the various services. clients are to authenticate to the various services.
The schema for "EndpointApp" is identified using the schema URI: The schema for EndpointApp is identified using the schema URI:
urn:ietf:params:scim:schemas:core:2.0:EndpointApp urn:ietf:params:scim:schemas:core:2.0:EndpointApp
The following attributes are defined in this schema. The following attributes are defined in this schema.
6.1. Common Attributes 6.1. Common Attributes
Like Section 2.1, the EndpointApp schema contains the three common Like Section 2.1, the EndpointApp schema contains the three common
attributes specified in Section 3.1 of [RFC7643]. attributes specified in Section 3.1 of [RFC7643].
6.2. Singular Attributes 6.2. Singular Attributes
applicationType: A string that represents the type of application. applicationType: A string that represents the type of application.
It will only contain two values: 'deviceControl' or 'telemetry'. It will only contain two values: deviceControl or telemetry.
deviceControl is the application that sends commands to control deviceControl is the application that sends commands to control
the device. telemetry is the application that receives data from the device. telemetry is the application that receives data from
the device. The attribute is required and is not case sensitive. the device. The attribute is required and is not case sensitive.
The attribute is readOnly and should be returned by default. No The attribute is readOnly and should be returned by default. No
uniqueness constraints are imposed on this attribute. uniqueness constraints are imposed on this attribute.
applicationName: A string that represents a human-readable name for applicationName: A string that represents a human-readable name for
the application. This attribute is required and mutable. The the application. This attribute is required and mutable. The
attribute should be returned by default and there is no uniqueness attribute should be returned by default and there is no uniqueness
constraint on the attribute. constraint on the attribute.
skipping to change at line 467 skipping to change at line 467
6.3. Complex Attributes 6.3. Complex Attributes
6.3.1. certificateInfo 6.3.1. certificateInfo
certificateInfo is a complex attribute that contains an X.509 certificateInfo is a complex attribute that contains an X.509
certificate's subject name and root Certificate Authority (CA) certificate's subject name and root Certificate Authority (CA)
information associated with application clients that will connect for information associated with application clients that will connect for
purposes of device control or telemetry. purposes of device control or telemetry.
rootCA: A base64-encoded string as described in Section 4 of rootCA: A base64-encoded string as described in Section 4 of
[RFC4648] a trust anchor certificate. This trust anchor is [RFC4648]. It is a trust anchor certificate applicable for
applicable for certificates used for client application access. certificates used for client application access. The object is
The object is not required, singular, case sensitive, and read/ not required. It is singular, case sensitive, and read/write. If
write. If not present, a set of trust anchors MUST be configured not present, a set of trust anchors MUST be configured out of
out of band. band.
subjectName: When present, a string that contains one of two names: subjectName: When present, a string that contains one of two names:
* a distinguished name that will be present in the certificate * a distinguished name that will be present in the certificate
subject field, as described in Section 4.1.2.4 of [RFC5280] or subject field, as described in Section 4.1.2.4 of [RFC5280] or
* a dnsName as part of a subjectAlternateName, as described in * a dnsName as part of a subjectAlternateName, as described in
Section 4.2.1.6 of [RFC5280]. Section 4.2.1.6 of [RFC5280].
In the latter case, servers validating such certificates SHALL In the latter case, servers validating such certificates SHALL
reject connections when the name of the peer as resolved by a DNS reject connections when the name of the peer as resolved by a DNS
reverse lookup does not match the dnsName in the certificate. If reverse lookup does not match the dnsName in the certificate. If
multiple dnsNames are present, it is left to server multiple dnsNames are present, it is left to server
implementations to address any authorization conflicts associated implementations to address any authorization conflicts associated
with those names. This attribute is not required, mutable, with those names. This attribute is not required, mutable,
singular, and NOT case sensitive. singular, and not case sensitive.
+=================+=======+===+=======+=========+========+========+ +=================+=======+===+=======+=========+========+========+
| Attribute | Multi |Req| Case | Mutable | Return | Unique | | Attribute | Multi |Req| Case | Mutable | Return | Unique |
| | Value | | Exact | | | | | | Value | | Exact | | | |
+=================+=======+===+=======+=========+========+========+ +=================+=======+===+=======+=========+========+========+
| applicationType | F |T | F | R | Def | None | | applicationType | F |T | F | R | Def | None |
+-----------------+-------+---+-------+---------+--------+--------+ +-----------------+-------+---+-------+---------+--------+--------+
| applicationName | F |T | F | RW | Def | None | | applicationName | F |T | F | RW | Def | None |
+-----------------+-------+---+-------+---------+--------+--------+ +-----------------+-------+---+-------+---------+--------+--------+
| clientToken | F |F | T | R | N | None | | clientToken | F |F | T | R | N | None |
skipping to change at line 513 skipping to change at line 513
| subjectName | F |T | T | RW | Def | None | | subjectName | F |T | T | RW | Def | None |
+-----------------+-------+---+-------+---------+--------+--------+ +-----------------+-------+---+-------+---------+--------+--------+
Table 2: Characteristics of EndpointApp Schema Attributes Table 2: Characteristics of EndpointApp Schema Attributes
Legend: Legend:
Req: Required Req: Required
T: True T: True
F: False F: False
R: ReadOnly RO: ReadOnly
RW: ReadWrite RW: ReadWrite
Manuf: Manufacturer
N: No N: No
Def: Default Def: Default
Note that either clientToken or certificateInfo is used for the Note that either clientToken or certificateInfo is used for the
authentication of the application. If certificateInfo is NOT present authentication of the application. If certificateInfo is not present
when an endpointApp object is created, then the server SHOULD return when an EndpointApp object is created, then the server SHOULD return
a clientToken. Otherwise, if the server accepts the certificateInfo a clientToken. Otherwise, if the server accepts the certificateInfo
object for authentication, it SHOULD NOT return a clientToken. If object for authentication, it SHOULD NOT return a clientToken. If
the server accepts and produces a clientToken, then control and the server accepts and produces a clientToken, then control and
telemetry servers MUST validate both. The SCIM client will know that telemetry servers MUST validate both. The SCIM client will know that
this is the case based on the SCIM object that is returned. this is the case based on the SCIM object that is returned.
certificateInfo is preferred in situations where client functions are certificateInfo is preferred in situations where client functions are
federated such that different clients may connect for different federated such that different clients may connect for different
purposes. purposes.
skipping to change at line 557 skipping to change at line 556
"location": "https://example.com/v2/EndpointApps/e9e30dba-f08f-\ "location": "https://example.com/v2/EndpointApps/e9e30dba-f08f-\
4109-8486-d5c6a3316212" 4109-8486-d5c6a3316212"
} }
} }
<CODE ENDS> <CODE ENDS>
Figure 4: Endpoint App Example Figure 4: Endpoint App Example
7. SCIM Device Extensions 7. SCIM Device Extensions
SCIM provides various extension schemas, their attributes, JSON SCIM provides various extension schemas and their attributes, along
representation, and example object. The core schema is extended with with JSON representations and example objects. The core schema is
a new resource type, Device. No schemaExtensions list is specified extended with a new resource type, Device. No schemaExtensions list
in that definition. Instead, IANA registry entries have been is specified in that definition. Instead, IANA registry entries have
created, where all values for "required" are set to false. All been created, where all values for "required" are set to false. All
extensions to the Device schema MUST be registered via IANA, as extensions to the device schema MUST be registered via IANA, as
described in Section 9.2. The schemas below demonstrate how this described in Section 9.2. The schemas below demonstrate how this
model is to work. All the SCIM server-related schema URIs are valid model is to work. All the SCIM server-related schema URIs are valid
only with Device resource types. only with Device resource types.
7.1. Bluetooth Low Energy (BLE) Extension 7.1. Bluetooth Low Energy (BLE) Extension
This schema extends the device schema to represent the devices This schema extends the device schema to represent the devices
supporting BLE. The extension is identified using the following supporting BLE. The extension is identified using the following
schema URI: schema URI:
skipping to change at line 587 skipping to change at line 586
7.1.1. Singular Attributes 7.1.1. Singular Attributes
deviceMacAddress: A string value that represents a public MAC deviceMacAddress: A string value that represents a public MAC
address assigned by the manufacturer. It is a unique 48-bit address assigned by the manufacturer. It is a unique 48-bit
value. It is required, case insensitive, mutable, and returned by value. It is required, case insensitive, mutable, and returned by
default. The ECMA regular expression pattern [ECMA] is the default. The ECMA regular expression pattern [ECMA] is the
following: following:
^[0-9A-Fa-f]{2}(:[0-9A-Fa-f]{2}){5}$ ^[0-9A-Fa-f]{2}(:[0-9A-Fa-f]{2}){5}$
isRandom: A boolean flag taken from [BLE54]. If FALSE, the device isRandom: A boolean flag. If false, the device is using a public
is using a public MAC address. If TRUE, the device uses a random MAC address. If true, the device uses a random address. If an
address. If an Identifying Resolving Key (IRK) is present, the Identifying Resolving Key (IRK) is present, the address represents
address represents a resolvable private address. Otherwise, the a resolvable private address. Otherwise, the address is assumed
address is assumed to be a random static address. Non-resolvable to be a random static address. Non-resolvable private addresses
private addresses are not supported by this specification. This are not supported by this specification. This attribute is not
attribute is not required. It is mutable and is returned by required. It is mutable and is returned by default. The default
default. The default value is FALSE. value is false. See Volume 6, Part B, Section 1.3 of [BLE54] for
more information about different address types.
separateBroadcastAddress: When present, this string represents an separateBroadcastAddress: When present, this string represents an
address used for broadcasts/advertisements. This value MUST NOT address used for broadcasts/advertisements. This value MUST NOT
be set when an IRK is provided. Its form is the same as be set when an IRK is provided. Its form is the same as
deviceMacAddress. It is not required, multivalued, mutable, and deviceMacAddress. It is not required, multivalued, mutable, and
returned by default. returned by default.
irk: A string value that specifies the IRK, which is unique to each irk: A string value that specifies the IRK, which is unique to each
device. It is used to resolve a private random address. It device. It is used to resolve a private random address. It
should only be provisioned when isRandom is TRUE. It is mutable should only be provisioned when isRandom is true. It is mutable
and never returned. For more information about the use of the and never returned. For more information about the use of the
IRK, see Volume 1, Part A, Section 5.4.5 of [BLE54]. IRK, see Volume 1, Part A, Section 5.4.5 of [BLE54].
mobility: A boolean attribute to enable BLE device mobility. If set mobility: A boolean attribute to enable BLE device mobility. If set
to TRUE, the device could be expected to move within a network of to true, the device could be expected to move within a network of
APs. For example, if a BLE device is connected with AP-1 and Access Points (APs). For example, if a BLE device is connected
moves out of range but comes in range of AP-2, it will be with AP-1 and moves out of range but comes in range of AP-2, it
disconnected with AP-1 and connected with AP-2. It is returned by will be disconnected with AP-1 and connected with AP-2. It is
default and mutable. returned by default and mutable.
7.1.2. Multivalued Attributes 7.1.2. Multivalued Attributes
versionSupport: A multivalued set of strings that specifies the BLE versionSupport: A multivalued set of strings that specifies the BLE
versions supported by the device in the form of an array, for versions supported by the device in the form of an array, for
example, ["4.1", "4.2", "5.0", "5.1", "5.2", "5.3", "5.4"]. It is example, ["4.1", "4.2", "5.0", "5.1", "5.2", "5.3", "5.4"]. It is
required, mutable, and returned by default. required, mutable, and returned by default.
pairingMethods: A multivalued set of strings that specifies pairing pairingMethods: A multivalued set of strings that specifies pairing
methods associated with the BLE device. The pairing methods may methods associated with the BLE device. The pairing methods may
skipping to change at line 639 skipping to change at line 639
is required, case sensitive, mutable, and returned by default. is required, case sensitive, mutable, and returned by default.
7.1.3. BLE Pairing Method Extensions 7.1.3. BLE Pairing Method Extensions
The details on pairing methods and their associated attributes are in The details on pairing methods and their associated attributes are in
Volume 1, Part A, Section 5.2.4 of [BLE54]. This memo defines Volume 1, Part A, Section 5.2.4 of [BLE54]. This memo defines
extensions for four pairing methods that are nested inside the BLE extensions for four pairing methods that are nested inside the BLE
extension schema. Each extension contains the common attributes in extension schema. Each extension contains the common attributes in
Section 6.1. These extensions are as follows: Section 6.1. These extensions are as follows:
i. The pairingNull extension is identified using the following pairingNull extension: Identified using the following schema URI:
schema URI:
urn:ietf:params:scim:schemas:extension:pairingNull:2.0:Device urn:ietf:params:scim:schemas:extension:pairingNull:2.0:Device
pairingNull does not have any attribute. It allows pairing for pairingNull does not have any attribute. It allows pairing for
BLE devices that do not require a pairing method. BLE devices that do not require a pairing method.
ii. The pairingJustWorks extension is identified using the pairingJustWorks extension: Identified using the following schema
following schema URI: URI:
urn:ietf:params:scim:schemas:extension:pairingJustWorks:2.0:Device urn:ietf:params:scim:schemas:extension:pairingJustWorks:2.0:Device
The Just Works pairing method does not require a key to pair The Just Works pairing method does not require a key to pair
devices. For completeness, the key attribute is included and devices. For completeness, the key attribute is included and is
is set to 'null'. The key attribute is required, immutable, set to 'null'. The key attribute is required, immutable, and
and returned by default. returned by default.
iii. The pairingPassKey extension is identified using the following pairingPassKey extension: Identified using the following schema URI:
schema URI:
urn:ietf:params:scim:schemas:extension:pairingPassKey:2.0:Device urn:ietf:params:scim:schemas:extension:pairingPassKey:2.0:Device
The passkey pairing method requires a 6-digit key to pair The passkey pairing method requires a 6-digit key to pair devices.
devices. This extension has one singular integer attribute, This extension has one singular integer attribute, "key", which is
"key", which is required, mutable, and returned by default. required, mutable, and returned by default. The key pattern is as
The key pattern is as follows: follows:
^[0-9]{6}$ ^[0-9]{6}$
iv. The pairingOOB extension is identified using the following pairingOOB extension: Identified using the following schema URI:
schema URI:
urn:ietf:params:scim:schemas:extension:pairingOOB:2.0:Device urn:ietf:params:scim:schemas:extension:pairingOOB:2.0:Device
The out-of-band (OOB) pairing method includes three singular The out-of-band (OOB) pairing method includes three singular
attributes: key, randomNumber, and confirmationNumber. attributes: key, randomNumber, and confirmationNumber.
key: A string value that is required and received from out-of- key:
band sources such as Near Field Communication (NFC). It is A string value that is required and received from out-of-band
case sensitive, mutable, and returned by default. sources such as Near Field Communication (NFC). It is case
sensitive, mutable, and returned by default.
randomNumber: An integer that represents a nonce added to the randomNumber:
key. It is a required attribute. It is mutable and An integer that represents a nonce added to the key. It is a
returned by default. required attribute. It is mutable and returned by default.
confirmationNumber: An integer that some solutions require in confirmationNumber:
a RESTful message exchange. It is not required. It is An integer that some solutions require in a RESTful message
mutable and returned by default if it exists. exchange (where RESTful refers to the Representational State
Transfer (REST) architecture). It is not required. It is
mutable and returned by default if it exists.
+==================+=======+===+=======+=========+========+========+ +==================+=======+===+=======+=========+========+========+
| Attribute | Multi |Req| Case | Mutable | Return | Unique | | Attribute | Multi |Req| Case | Mutable | Return | Unique |
| | Value | | Exact | | | | | | Value | | Exact | | | |
+==================+=======+===+=======+=========+========+========+ +==================+=======+===+=======+=========+========+========+
| deviceMacAddress | F |T | F | RW | Def | Manuf | | deviceMacAddress | F |T | F | RW | Def | Manuf |
+------------------+-------+---+-------+---------+--------+--------+ +------------------+-------+---+-------+---------+--------+--------+
| isRandom | F |T | F | RW | Def | None | | isRandom | F |T | F | RW | Def | None |
+------------------+-------+---+-------+---------+--------+--------+ +------------------+-------+---+-------+---------+--------+--------+
| sepBroadcastAdd | T |F | F | RW | Def | None | | sepBroadcastAdd | T |F | F | RW | Def | None |
skipping to change at line 717 skipping to change at line 717
Table 3: Characteristics of BLE Extension Schema Attributes Table 3: Characteristics of BLE Extension Schema Attributes
Legend: Legend:
sepBroadcastAdd: separateBroadcastAddress sepBroadcastAdd: separateBroadcastAddress
Req: Required Req: Required
T: True T: True
F: False F: False
RW: ReadWrite RW: ReadWrite
WO: Write Only WO: WriteOnly
Def: Default Def: Default
Nev: Never Nev: Never
Manuf: Manufacturer Manuf: Manufacturer
<CODE BEGINS> <CODE BEGINS>
{ {
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device", "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device",
"urn:ietf:params:scim:schemas:extension:ble:2.0:Device"], "urn:ietf:params:scim:schemas:extension:ble:2.0:Device"],
"id": "e9e30dba-f08f-4109-8486-d5c6a3316111", "id": "e9e30dba-f08f-4109-8486-d5c6a3316111",
skipping to change at line 845 skipping to change at line 845
"location": "https://example.com/v2/Devices/e9e30dba-f08f-4109-\ "location": "https://example.com/v2/Devices/e9e30dba-f08f-4109-\
8486-d5c6a3316111" 8486-d5c6a3316111"
} }
} }
<CODE ENDS> <CODE ENDS>
Figure 7: BLE Pairing with Both Passkey and OOB Figure 7: BLE Pairing with Both Passkey and OOB
7.2. Wi-Fi Easy Connect Extension 7.2. Wi-Fi Easy Connect Extension
A schema that extends the device schema to enable Wi-Fi Easy Connect This section describes a schema that extends the device schema to
(otherwise known as Device Provisioning Protocol (DPP)). Throughout enable Wi-Fi Easy Connect (otherwise known as Device Provisioning
this specification, we use the term "DPP". The extension is Protocol (DPP)). Throughout this specification, we use the term
identified using the following schema URI: "DPP". The extension is identified using the following schema URI:
urn:ietf:params:scim:schemas:extension:dpp:2.0:Device urn:ietf:params:scim:schemas:extension:dpp:2.0:Device
The attributes in this extension are adopted from [DPP2]. The The attributes in this extension are adopted from [DPP2]. The
attributes are as follows. attributes are as follows.
7.2.1. Singular Attributes 7.2.1. Singular Attributes
dppVersion: An integer that represents the version of DPP the device dppVersion: An integer that represents the version of DPP the device
supports. This attribute is required, case insensitive, mutable, supports. This attribute is required, case insensitive, mutable,
skipping to change at line 913 skipping to change at line 913
+---------------------+-----+---+-----+---------+--------+--------+ +---------------------+-----+---+-----+---------+--------+--------+
Table 4: Characteristics of DPP Extension Schema Attributes Table 4: Characteristics of DPP Extension Schema Attributes
Legend: Legend:
Req: Required Req: Required
T: True T: True
F: False F: False
RW: ReadWrite RW: ReadWrite
WO: Write Only WO: WriteOnly
Def: Default Def: Default
Nev: Never Nev: Never
Manuf: Manufacturer Manuf: Manufacturer
<CODE BEGINS> <CODE BEGINS>
{ {
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device", "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device",
"urn:ietf:params:scim:schemas:extension:dpp:2.0:\ "urn:ietf:params:scim:schemas:extension:dpp:2.0:\
Device"], Device"],
skipping to change at line 1081 skipping to change at line 1081
"location": "https://example.com/v2/Devices/e9e30dba-f08f-4109-\ "location": "https://example.com/v2/Devices/e9e30dba-f08f-4109-\
8486-d5c6a3316111" 8486-d5c6a3316111"
} }
} }
<CODE ENDS> <CODE ENDS>
Figure 10: FDO Example Figure 10: FDO Example
7.5. Zigbee Extension 7.5. Zigbee Extension
A schema that extends the device schema to enable the provisioning of This section describes a schema that extends the device schema to
Zigbee devices [Zigbee]. The extension is identified using the enable the provisioning of Zigbee devices [Zigbee]. The extension is
following schema URI: identified using the following schema URI:
urn:ietf:params:scim:schemas:extension:zigbee:2.0:Device urn:ietf:params:scim:schemas:extension:zigbee:2.0:Device
It has one singular attribute and one multivalued attribute. The It has one singular attribute and one multivalued attribute. The
attributes are as follows. attributes are as follows.
7.5.1. Singular Attribute 7.5.1. Singular Attribute
deviceEui64Address: A 64-bit Extended Unique Identifier (EUI-64) deviceEui64Address: A 64-bit Extended Unique Identifier (EUI-64)
device address stored as string. This attribute is required, case device address stored as string. This attribute is required, case
skipping to change at line 1151 skipping to change at line 1151
8486-d5c6a3316111" 8486-d5c6a3316111"
} }
} }
<CODE ENDS> <CODE ENDS>
Figure 11: Zigbee Example Figure 11: Zigbee Example
7.6. The Endpoint Applications Extension Schema 7.6. The Endpoint Applications Extension Schema
Sometimes non-IP devices such as those using BLE or Zigbee require an Sometimes non-IP devices such as those using BLE or Zigbee require an
application gateway interface to manage them. SCIM clients MUST NOT application gateway interface to manage them.
specify this to describe native IP-based devices.
endpointAppsExt provides the list of applications that connect to an endpointAppsExt provides the list of applications that connect to an
enterprise gateway. endpointAppsExt has one multivalued attribute and enterprise gateway. endpointAppsExt has one multivalued attribute and
two singular attributes. The extension is identified using the two singular attributes. The extension is identified using the
following schema URI: following schema URI:
urn:ietf:params:scim:schemas:extension:endpointAppsExt:2.0:Device urn:ietf:params:scim:schemas:extension:endpointAppsExt:2.0:Device
7.6.1. Singular Attributes 7.6.1. Singular Attributes
skipping to change at line 1192 skipping to change at line 1191
7.6.2. Multivalued Attribute 7.6.2. Multivalued Attribute
applications: A multivalued attribute of one or more complex applications: A multivalued attribute of one or more complex
attributes that represent a list of endpoint applications, i.e., attributes that represent a list of endpoint applications, i.e.,
deviceControl and telemetry. Each entry in the list comprises two deviceControl and telemetry. Each entry in the list comprises two
attributes including "value" and "$ref". attributes including "value" and "$ref".
value: A string containing the identifier of the endpoint value: A string containing the identifier of the endpoint
application formatted as a Universally Unique Identifier (UUID). application formatted as a Universally Unique Identifier (UUID).
It is the same as the common attribute "$id" of the resource It is the same as the common attribute "$id" of the resource
"endpointApp". It is read/write, required, case insensitive, and EndpointApp. It is read/write, required, case insensitive, and
returned by default. returned by default.
$ref: A reference to the respective endpointApp resource object $ref: A reference to the respective EndointApp resource object
stored in the SCIM server. It is readOnly, required, case stored in the SCIM server. It is readOnly, required, case
sensitive, and returned by default. sensitive, and returned by default.
+====================+=====+===+=======+=========+========+========+ +====================+=====+===+=======+=========+========+========+
| Attribute |Multi|Req| Case | Mutable | Return | Unique | | Attribute |Multi|Req| Case | Mutable | Return | Unique |
| |Value| | Exact | | | | | |Value| | Exact | | | |
+====================+=====+===+=======+=========+========+========+ +====================+=====+===+=======+=========+========+========+
| devContEntEndpoint |F |T | T | R | Def | Ent | | devContEntEndpoint |F |T | T | R | Def | Ent |
+--------------------+-----+---+-------+---------+--------+--------+ +--------------------+-----+---+-------+---------+--------+--------+
| telEntEndpoint |F |F | T | R | Def | Ent | | telEntEndpoint |F |F | T | R | Def | Ent |
+--------------------+-----+---+-------+---------+--------+--------+ +--------------------+-----+---+-------+---------+--------+--------+
| applications |T |T | F | RW | Def | None | | applications |T |T | F | RW | Def | None |
+--------------------+-----+---+-------+---------+--------+--------+ +--------------------+-----+---+-------+---------+--------+--------+
| value |F |T | F | RW | Def | None | | value |F |T | F | RW | Def | None |
+--------------------+-----+---+-------+---------+--------+--------+ +--------------------+-----+---+-------+---------+--------+--------+
| $ref |F |T | F | R | Def | None | | $ref |F |T | F | R | Def | None |
+--------------------+-----+---+-------+---------+--------+--------+ +--------------------+-----+---+-------+---------+--------+--------+
Table 8: Characteristics of EndpointAppsExt Extension Schema Table 8: Characteristics of endpointAppsExt Extension Schema
Attributes Attributes
Legend: Legend:
devContEntEndpoint: deviceControlEnterpriseEndpoint devContEntEndpoint: deviceControlEnterpriseEndpoint
telEntEndpoint: telemetryEnterpriseEndpoint telEntEndpoint: telemetryEnterpriseEndpoint
Req: Required Req: Required
T: True T: True
F: False F: False
R: ReadOnly RO: ReadOnly
RW: ReadWrite RW: ReadWrite
Ent: Enterprise Ent: Enterprise
Def: Default Def: Default
<CODE BEGINS> <CODE BEGINS>
{ {
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device", "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device",
"urn:ietf:params:scim:schemas:extension:ble:2.0:Device", "urn:ietf:params:scim:schemas:extension:ble:2.0:Device",
"urn:ietf:params:scim:schemas:extension:endpointAppsExt:2.0:\ "urn:ietf:params:scim:schemas:extension:endpointAppsExt:2.0:\
Device"], Device"],
skipping to change at line 1369 skipping to change at line 1368
SCIM logs. Due to the sensitive nature of SCIM operations, logs SCIM logs. Due to the sensitive nature of SCIM operations, logs
SHOULD be encrypted both on the disk and in transit. SHOULD be encrypted both on the disk and in transit.
9. IANA Considerations 9. IANA Considerations
9.1. New Schemas 9.1. New Schemas
IANA has added the following additions to the "SCIM Schema URIs for IANA has added the following additions to the "SCIM Schema URIs for
Data Resources" registry: Data Resources" registry:
+====================================+=============+===========+ Schema URI: urn:ietf:params:scim:schemas:core:2.0:Device
| Schema URI | Name | Reference | Name: Core Device Schema
+====================================+=============+===========+ Reference: RFC 9944, Section 3
| urn:ietf:params:scim:schemas:core: | Core Device | RFC 9944, |
| 2.0:Device | Schema | Section 3 |
+------------------------------------+-------------+-----------+
| urn:ietf:params:scim:schemas:core: | Endpoint | RFC 9944, |
| 2.0:EndpointApp | Application | Section 6 |
+------------------------------------+-------------+-----------+
Table 9 Schema URI: urn:ietf:params:scim:schemas:core:2.0:EndpointApp
Name: Endpoint Application
Reference: RFC 9944, Section 6
9.2. Device Schema Extensions 9.2. Device Schema Extensions
IANA has created the following extensions in the "SCIM Server-Related IANA has created the following extensions in the "SCIM Server-Related
Schema URIs" registry as described in Section 7: Schema URIs" registry as described in Section 7:
+================================+=============+========+=========+ Schema URI: urn:ietf:params:scim:schemas:extension:ble:2.0:Device
| Schema URI | Description |Resource|Reference| Description: BLE Extension
| | |Type | | Resource Type: Device
+================================+=============+========+=========+ Reference: RFC 9944, Section 7.1
| urn:ietf:params:scim: | BLE |Device |RFC 9944,|
| schemas:extension: | Extension | |Section |
| ble:2.0:Device | | |7.1 |
+--------------------------------+-------------+--------+---------+
| urn:ietf:params:scim: | Ethernet |Device |RFC 9944,|
| schemas:extension: ethernet- | MAB | |Section |
| mab:2.0:Device | | |7.3 |
+--------------------------------+-------------+--------+---------+
| urn:ietf:params:scim: | FIDO Device |Device |RFC 9944,|
| schemas:extension: fido- | Onboard | |Section |
| device-onboard:2.0:Device | | |7.4 |
+--------------------------------+-------------+--------+---------+
| urn:ietf:params:scim: | Wi-Fi Easy |Device |RFC 9944,|
| schemas:extension: | Connect | |Section |
| dpp:2.0:Device | | |7.2 |
+--------------------------------+-------------+--------+---------+
| urn:ietf:params:scim: | Application |Device |RFC 9944,|
| schemas:extension: | Endpoint | |Section |
| endpointAppsExt:2.0:Device | Extension | |7.1.3 |
+--------------------------------+-------------+--------+---------+
| urn:ietf:params:scim: | Just Works |Device |RFC 9944,|
| schemas:extension: | Auth BLE | |Section |
| pairingJustWorks:2.0:Device | | |7.1.3 |
+--------------------------------+-------------+--------+---------+
| urn:ietf:params:scim: | Out-of-Band |Device |RFC 9944,|
| schemas:extension: | Pairing for | |Section |
| pairingOOB:2.0:Device | BLE | |7.1.3 |
+--------------------------------+-------------+--------+---------+
| urn:ietf:params:scim: | Passkey |Device |RFC 9944,|
| schemas:extension: | Pairing for | |Section |
| pairingPassKey:2.0:Device | BLE | |7.1.3 |
+--------------------------------+-------------+--------+---------+
Table 10 Schema URI:
urn:ietf:params:scim:schemas:extension:ethernet-mab:2.0:Device
Description: Ethernet MAB
Resource Type: Device
Reference: RFC 9944, Section 7.3
Schema URI:
urn:ietf:params:scim:schemas:extension:fido-device-
onboard:2.0:Device
Description: FIDO Device Onboard
Resource Type: Device
Reference: RFC 9944, Section 7.4
Schema URI: urn:ietf:params:scim:schemas:extension:dpp:2.0:Device
Description: Wi-Fi Easy Connect
Resource Type: Device
Reference: RFC 9944, Section 7.2
Schema URI:
urn:ietf:params:scim:schemas:extension:endpointAppsExt:2.0:Device
Description: Application Endpoint Extension
Resource Type: Device
Reference: RFC 9944, Section 7.1.3
Schema URI:
urn:ietf:params:scim:schemas:extension:pairingJustWorks:2.0:Device
Description: Just Works Auth BLE
Resource Type: Device
Reference: RFC 9944, Section 7.1.3
Schema URI:
urn:ietf:params:scim:schemas:extension:pairingOOB:2.0:Device
Description: Out-of-Band Pairing for BLE
Resource Type: Device
Reference: RFC 9944, Section 7.1.3
Schema URI:
urn:ietf:params:scim:schemas:extension:pairingPassKey:2.0:Device
Description: Passkey Pairing for BLE
Resource Type: Device
Reference: RFC 9944, Section 7.1.3
10. References 10. References
10.1. Normative References 10.1. Normative References
[BLE54] Bluetooth SIG, "Bluetooth Core Specification", Version [BLE54] Bluetooth SIG, "Bluetooth Core Specification", Version
5.4, 2023, <https://www.bluetooth.org/DocMan/handlers/ 5.4, 2023, <https://www.bluetooth.org/DocMan/handlers/
DownloadDoc.ashx?doc_id=587177>. DownloadDoc.ashx?doc_id=587177>.
[DPP2] Wi-Fi Alliance, "Wi-Fi Easy Connect Specification", [DPP2] Wi-Fi Alliance, "Wi-Fi Easy Connect Specification",
Version 2.0, 2020. Version 3.0, 2020, <https://www.wi-fi.org/system/files/Wi-
Fi_Easy_Connect_Specification_v3.0.pdf>.
[ECMA] ECMA International, "ECMAScript(R) 2025 Language [ECMA] ECMA International, "ECMAScript(R) 2025 Language
Specification", ECMA-262, 16th Edition, June 2025, Specification", ECMA-262, 16th Edition, June 2025,
<https://ecma-international.org/publications-and- <https://ecma-international.org/publications-and-
standards/standards/ecma-262/>. standards/standards/ecma-262/>.
[FDO11] FIDO Alliance, "FIDO Device Onboard Specification 1.1", [FDO11] FIDO Alliance, "FIDO Device Onboard Specification 1.1",
Proposed Standard, April 2022, Proposed Standard, April 2022,
<https://fidoalliance.org/specs/FDO/FIDO-Device-Onboard- <https://fidoalliance.org/specs/FDO/FIDO-Device-Onboard-
PS-v1.1-20220419/FIDO-Device-Onboard-PS- PS-v1.1-20220419/FIDO-Device-Onboard-PS-
skipping to change at line 1588 skipping to change at line 1592
"required": false, "required": false,
"caseExact": false, "caseExact": false,
"mutability": "readWrite", "mutability": "readWrite",
"returned": "default", "returned": "default",
"uniqueness": "none" "uniqueness": "none"
}, },
{ {
"name": "active", "name": "active",
"type": "boolean", "type": "boolean",
"description": "A mutable boolean value indicating the device \ "description": "A mutable boolean value indicating the device \
administrative status. If set TRUE, the commands (such as connect, \ administrative status. If true, the commands (such as connect, \
disconnect, subscribe) that control app sends to the controller for \ disconnect, subscribe) that control app sends to the controller for \
the devices will be processed by the controller. If set FALSE, any \ the devices will be processed by the controller. If false, any \
command coming from the control app for the device will be \ command coming from the control app for the device will be \
rejected by the controller.", rejected by the controller.",
"multiValued": false, "multiValued": false,
"required": true, "required": true,
"caseExact": false, "caseExact": false,
"mutability": "readWrite", "mutability": "readWrite",
"returned": "default", "returned": "default",
"uniqueness": "none" "uniqueness": "none"
}, },
{ {
skipping to change at line 1624 skipping to change at line 1628
"multiValued": true, "multiValued": true,
"description": "A list of groups to which the device belongs, \ "description": "A list of groups to which the device belongs, \
either through direct membership, through nested groups, or \ either through direct membership, through nested groups, or \
dynamically calculated.", dynamically calculated.",
"required": false, "required": false,
"subAttributes": [ "subAttributes": [
{ {
"name": "value", "name": "value",
"type": "string", "type": "string",
"multiValued": false, "multiValued": false,
"description": "The identifier of the Device's group.", "description": "The identifier of the device's group.",
"required": false, "required": false,
"caseExact": false, "caseExact": false,
"mutability": "readOnly", "mutability": "readOnly",
"returned": "default", "returned": "default",
"uniqueness": "none" "uniqueness": "none"
}, },
{ {
"name": "$ref", "name": "$ref",
"type": "reference", "type": "reference",
"referenceTypes": [ "referenceTypes": [
skipping to change at line 1698 skipping to change at line 1702
<CODE BEGINS> <CODE BEGINS>
{ {
"id": "urn:ietf:params:scim:schemas:core:2.0:EndpointApp", "id": "urn:ietf:params:scim:schemas:core:2.0:EndpointApp",
"name": "EndpointApp", "name": "EndpointApp",
"description": "Endpoint application and their credentials.", "description": "Endpoint application and their credentials.",
"attributes" : [ "attributes" : [
{ {
"name": "applicationType", "name": "applicationType",
"type": "string", "type": "string",
"description": "This attribute will only contain two values: '\ "description": "This attribute will only contain two values: \
deviceControl' or 'telemetry'.", deviceControl or telemetry.",
"multiValued": false, "multiValued": false,
"required": true, "required": true,
"caseExact": false, "caseExact": false,
"mutability": "readOnly", "mutability": "readOnly",
"returned": "default", "returned": "default",
"uniqueness": "none" "uniqueness": "none"
}, },
{ {
"name": "applicationName", "name": "applicationName",
"type": "string", "type": "string",
skipping to change at line 1735 skipping to change at line 1739
"required": false, "required": false,
"caseExact": false, "caseExact": false,
"mutability": "readWrite", "mutability": "readWrite",
"returned": "default", "returned": "default",
"uniqueness": "none", "uniqueness": "none",
"subAttributes" : [ "subAttributes" : [
{ {
"name" : "rootCA", "name" : "rootCA",
"type" : "string", "type" : "string",
"description" : "The base64 encoding of the DER encoding \ "description" : "The base64 encoding of the DER encoding \
of the CA certificate.", of the CA certificate.",
"multiValued" : false, "multiValued" : false,
"required" : false, "required" : false,
"caseExact" : true, "caseExact" : true,
"mutability" : "readWrite", "mutability" : "readWrite",
"returned" : "default", "returned" : "default",
"uniqueness" : "none" "uniqueness" : "none"
}, },
{ {
"name" : "subjectName", "name" : "subjectName",
"type" : "string", "type" : "string",
"description" : "A Common Name (CN) of the form of CN = \ "description" : "A Common Name (CN) of the form of CN = \
dnsName.", dnsName.",
"multiValued" : false, "multiValued" : false,
"required" : true, "required" : true,
"caseExact" : true, "caseExact" : true,
"mutability" : "readWrite", "mutability" : "readWrite",
"returned" : "default", "returned" : "default",
"uniqueness" : "none" "uniqueness" : "none"
} }
] ]
}, },
{ {
skipping to change at line 1886 skipping to change at line 1890
"required": true, "required": true,
"caseExact": false, "caseExact": false,
"mutability": "readWrite", "mutability": "readWrite",
"returned": "default", "returned": "default",
"uniqueness": "Manufacturer" "uniqueness": "Manufacturer"
}, },
{ {
"name": "isRandom", "name": "isRandom",
"type": "boolean", "type": "boolean",
"description": "The isRandom flag is taken from the BLE \ "description": "The isRandom flag is taken from the BLE \
core specifications 5.3. If TRUE, device is using a random address\ core specifications 5.3. If true, device is using a random address\
. Default value is false.", . Default value is false.",
"multiValued": false, "multiValued": false,
"required": false, "required": false,
"caseExact": false, "caseExact": false,
"mutability": "readWrite", "mutability": "readWrite",
"returned": "default", "returned": "default",
"uniqueness": "none" "uniqueness": "none"
}, },
{ {
"name": "separateBroadcastAddress", "name": "separateBroadcastAddress",
skipping to change at line 1911 skipping to change at line 1915
"multiValued": true, "multiValued": true,
"required": false, "required": false,
"caseExact": false, "caseExact": false,
"mutability": "readWrite", "mutability": "readWrite",
"returned": "default", "returned": "default",
"uniqueness": "none" "uniqueness": "none"
}, },
{ {
"name": "irk", "name": "irk",
"type": "string", "type": "string",
"description": "Identity Resolving Key (IRK), which is unique \ "description": "Identity Resolving Key (IRK), which is \
for every device. It is used to resolve a random address. This value \ unique for every device. It is used to resolve a random address. \
MUST NOT be set when separateBroadcastAddress is set.", This value MUST NOT be set when separateBroadcastAddress is set.",
"multiValued": false, "multiValued": false,
"required": false, "required": false,
"caseExact": false, "caseExact": false,
"mutability": "readWrite", "mutability": "readWrite",
"returned": "default", "returned": "default",
"uniqueness": "Manufacturer" "uniqueness": "Manufacturer"
}, },
{ {
"name": "mobility", "name": "mobility",
"type": "bool", "type": "bool",
"description": "If set to True, the BLE device will \ "description": "If set to true, the BLE device will \
automatically connect to the closest AP. For example, if a BLE \ automatically connect to the closest AP. For example, if a BLE \
device is connected with AP-1 and moves out of range but comes in \ device is connected with AP-1 and moves out of range but comes in \
range of AP-2, it will be disconnected with AP-1 and \ range of AP-2, it will be disconnected with AP-1 and \
connected with AP-2.", connected with AP-2.",
"multiValued": false, "multiValued": false,
"required": false, "required": false,
"caseExact": false, "caseExact": false,
"mutability": "readWrite", "mutability": "readWrite",
"returned": "default", "returned": "default",
"uniqueness": "none" "uniqueness": "none"
skipping to change at line 2074 skipping to change at line 2078
} }
] ]
<CODE ENDS> <CODE ENDS>
A.5. DPP Extension Schema A.5. DPP Extension Schema
<CODE BEGINS> <CODE BEGINS>
{ {
"id": "urn:ietf:params:scim:schemas:extension:dpp:2.0:Device", "id": "urn:ietf:params:scim:schemas:extension:dpp:2.0:Device",
"name": "dppExtension", "name": "dppExtension",
"description": "Device extension schema for Wi-Fi Easy Connect \ "description": "Device extension schema for Wi-Fi Easy \
/ Device Provisioning Protocol (DPP).", Connect / Device Provisioning Protocol (DPP).",
"attributes" : [ "attributes" : [
{ {
"name": "dppVersion", "name": "dppVersion",
"type": "integer", "type": "integer",
"description": "Version of DPP this device supports.", "description": "Version of DPP this device supports.",
"multiValued": false, "multiValued": false,
"required": true, "required": true,
"caseExact": false, "caseExact": false,
"mutability": "readWrite", "mutability": "readWrite",
"returned": "default", "returned": "default",
skipping to change at line 2246 skipping to change at line 2250
"required": true, "required": true,
"caseExact": false, "caseExact": false,
"mutability": "readWrite", "mutability": "readWrite",
"returned": "default", "returned": "default",
"uniqueness": "none" "uniqueness": "none"
}, },
{ {
"name": "deviceEui64Address", "name": "deviceEui64Address",
"type": "string", "type": "string",
"pattern": "^[0-9A-Fa-f]{2}(:[0-9A-Fa-f]{2}){7}$", "pattern": "^[0-9A-Fa-f]{2}(:[0-9A-Fa-f]{2}){7}$",
"description": "The 64-bit Extended Unique Identifier (EUI-64) \ "description": "The 64-bit Extended Unique Identifier \
device address.", (EUI-64) device address.",
"multiValued": false, "multiValued": false,
"required": true, "required": true,
"caseExact": false, "caseExact": false,
"mutability": "readWrite", "mutability": "readWrite",
"returned": "default", "returned": "default",
"uniqueness": "none" "uniqueness": "none"
} }
], ],
"meta" : { "meta" : {
"resourceType" : "Schema", "resourceType" : "Schema",
"location" : "/v2/Schemas/urn:ietf:params:scim:schemas:extension\ "location" : "/v2/Schemas/urn:ietf:params:scim:schemas:extension\
:zigbee:2.0:Device" :zigbee:2.0:Device"
} }
} }
<CODE ENDS> <CODE ENDS>
A.9. EndpointAppsExt Extension Schema A.9. endpointAppsExt Extension Schema
<CODE BEGINS> <CODE BEGINS>
{ {
"id": "urn:ietf:params:scim:schemas:extension:endpointAppsExt:2.0:\ "id": "urn:ietf:params:scim:schemas:extension:endpointAppsExt:2.0:\
Device", Device",
"name": "endpointAppsExt", "name": "endpointAppsExt",
"description": "Extension for partner endpoint applications that \ "description": "Extension for partner endpoint applications that \
can onboard, control, and communicate with the device.", can onboard, control, and communicate with the device.",
"attributes" : [ "attributes" : [
{ {
skipping to change at line 2290 skipping to change at line 2294
"multiValued": true, "multiValued": true,
"required": true, "required": true,
"caseExact": false, "caseExact": false,
"mutability": "readWrite", "mutability": "readWrite",
"returned": "default", "returned": "default",
"uniqueness": "none", "uniqueness": "none",
"subAttributes" : [ "subAttributes" : [
{ {
"name" : "value", "name" : "value",
"type" : "string", "type" : "string",
"description" : "The identifier of the endpointApp.", "description" : "The identifier of the EndpointApp.",
"multiValued" : false, "multiValued" : false,
"required" : true, "required" : true,
"caseExact" : false, "caseExact" : false,
"mutability" : "readWrite", "mutability" : "readWrite",
"returned" : "default", "returned" : "default",
"uniqueness" : "none" "uniqueness" : "none"
}, },
{ {
"name" : "$ref", "name" : "$ref",
"type" : "reference", "type" : "reference",
"referenceTypes" : "EndpointApps", "referenceTypes" : "EndpointApps",
"description" : "The URI of the corresponding 'EndpointApp\ "description" : "The URI of the corresponding EndpointApp\
' resource that will control or obtain data from the device.", resource that will control or obtain data from the device.",
"multiValued" : false, "multiValued" : false,
"required" : false, "required" : false,
"caseExact" : true, "caseExact" : true,
"mutability" : "readOnly", "mutability" : "readOnly",
"returned" : "default", "returned" : "default",
"uniqueness" : "none" "uniqueness" : "none"
} }
] ]
}, },
{ {
skipping to change at line 2399 skipping to change at line 2403
displayName: displayName:
type: string type: string
description: "Human-readable name of the device, suitable description: "Human-readable name of the device, suitable
for displaying to end users, for example, for displaying to end users, for example,
'BLE Heart Monitor' etc." 'BLE Heart Monitor' etc."
readOnly: false readOnly: false
writeOnly: false writeOnly: false
active: active:
type: boolean type: boolean
description: A mutable boolean value indicating the device description: A mutable boolean value indicating the device
administrative status. If set TRUE, the administrative status. If true, the
commands (such as connect, disconnect, commands (such as connect, disconnect,
subscribe) that control app sends to the subscribe) that control app sends to the
controller for the devices will be processed controller for the devices will be processed
by the controller. If set FALSE, any command by the controller. If false, any command
coming from the control app for the device coming from the control app for the device
will be rejected by the controller. will be rejected by the controller.
readOnly: false readOnly: false
writeOnly: false writeOnly: false
mudUrl: mudUrl:
type: string type: string
format: uri format: uri
description: A URL to MUD file of the device (RFC 8520). description: A URL to MUD file of the device (RFC 8520).
It is added for future use. Current usage is It is added for future use. Current usage is
not defined yet. not defined yet.
skipping to change at line 2490 skipping to change at line 2494
version: version:
type: string type: string
description: The version of the resource. description: The version of the resource.
readOnly: true readOnly: true
writeOnly: false writeOnly: false
additionalProperties: false additionalProperties: false
<CODE ENDS> <CODE ENDS>
B.2. EndpointApp Schema OpenAPI Representation B.2. EndpointApp Schema OpenAPI Representation
OpenAPI representation of endpointApp schema is as follows: OpenAPI representation of EndpointApp schema is as follows:
<CODE BEGINS> <CODE BEGINS>
openapi: 3.1.0 openapi: 3.1.0
info: info:
title: SCIM Endpoint App Schema title: SCIM Endpoint App Schema
version: 1.0.0 version: 1.0.0
components: components:
schemas: schemas:
Group: Group:
skipping to change at line 2532 skipping to change at line 2536
readOnly: true readOnly: true
writeOnly: true writeOnly: true
EndpointApp: EndpointApp:
title: EndpointApp title: EndpointApp
description: Endpoint application resource. description: Endpoint application resource.
type: object type: object
properties: properties:
applicationType: applicationType:
type: string type: string
description: This attribute will only contain two values: description: This attribute will only contain two values:
'deviceControl' or 'telemetry'. deviceControl or telemetry.
readOnly: false readOnly: false
writeOnly: false writeOnly: false
applicationName: applicationName:
type: string type: string
description: Human-readable name of the application. description: Human-readable name of the application.
readOnly: false readOnly: false
writeOnly: false writeOnly: false
groups: groups:
type: array type: array
description: List of groups to which the endpointApp description: List of groups to which the EndpointApp
belongs. belongs.
items: items:
$ref: '#/components/schemas/Group' $ref: '#/components/schemas/Group'
required: required:
- applicationType - applicationType
- applicationName - applicationName
additionalProperties: true additionalProperties: true
oneOf: oneOf:
skipping to change at line 2663 skipping to change at line 2667
<CODE BEGINS> <CODE BEGINS>
openapi: 3.1.0 openapi: 3.1.0
info: info:
title: SCIM Bluetooth Extension Schema title: SCIM Bluetooth Extension Schema
version: 1.0.0 version: 1.0.0
components: components:
schemas: schemas:
BleDevice: BleDevice:
type: object type: object
description: BLE Device schema. description: BLE device schema.
properties: properties:
schemas: schemas:
type: array type: array
items: items:
type: string type: string
enum: enum:
- urn:ietf:params:scim:schemas:extension:ble:2.0 - urn:ietf:params:scim:schemas:extension:ble:2.0
:Device :Device
urn:ietf:params:scim:schemas:extension:ble:2.0:Device: urn:ietf:params:scim:schemas:extension:ble:2.0:Device:
$ref: '#/components/schemas/BleDeviceExtension' $ref: '#/components/schemas/BleDeviceExtension'
skipping to change at line 2700 skipping to change at line 2704
description: It is the public MAC address assigned by the description: It is the public MAC address assigned by the
manufacturer. It is a unique 48-bit value. The manufacturer. It is a unique 48-bit value. The
regex pattern is regex pattern is
^[0-9A-Fa-f]{2}(:[0-9A-Fa-f]{2}){5}. ^[0-9A-Fa-f]{2}(:[0-9A-Fa-f]{2}){5}.
readOnly: false readOnly: false
writeOnly: false writeOnly: false
isRandom: isRandom:
type: boolean type: boolean
description: AddressType flag is taken from the BLE core description: AddressType flag is taken from the BLE core
specifications 5.3. If FALSE, the device is specifications 5.3. If false, the device is
using a public MAC address. If TRUE, device using a public MAC address. If true, device
is using a random address. is using a random address.
readOnly: false readOnly: false
writeOnly: false writeOnly: false
separateBroadcastAddress: separateBroadcastAddress:
type: string type: string
description: "When present, this address is used for description: "When present, this address is used for
broadcasts/advertisements. This value broadcasts/advertisements. This value
MUST NOT be set when an IRK is provided. MUST NOT be set when an IRK is provided.
Its form is the same as deviceMacAddress." Its form is the same as deviceMacAddress."
skipping to change at line 2724 skipping to change at line 2728
irk: irk:
type: string type: string
description: Identity Resolving Key (IRK), which is unique description: Identity Resolving Key (IRK), which is unique
for every device. It is used to resolve a for every device. It is used to resolve a
random address. random address.
readOnly: false readOnly: false
writeOnly: true writeOnly: true
mobility: mobility:
type: boolean type: boolean
description: If set to True, the BLE device will description: If set to true, the BLE device will
automatically connect to the closest AP. For automatically connect to the closest AP. For
example, if a BLE device is connected with example, if a BLE device is connected with
AP-1 and moves out of range but comes in AP-1 and moves out of range but comes in
range of AP-2, it will be disconnected with range of AP-2, it will be disconnected with
AP-1 and connected with AP-2. AP-1 and connected with AP-2.
readOnly: false readOnly: false
writeOnly: false writeOnly: false
pairingMethods: pairingMethods:
type: array type: array
items: items:
skipping to change at line 2996 skipping to change at line 3000
<CODE BEGINS> <CODE BEGINS>
openapi: 3.1.0 openapi: 3.1.0
info: info:
title: SCIM Zigbee Extension Schema title: SCIM Zigbee Extension Schema
version: 1.0.0 version: 1.0.0
components: components:
schemas: schemas:
ZigbeeDevice: ZigbeeDevice:
type: object type: object
description: Zigbee Device schema. description: Zigbee device schema.
properties: properties:
schemas: schemas:
type: array type: array
items: items:
type: string type: string
enum: enum:
- urn:ietf:params:scim:schemas:extension:zigbee:2.0 - urn:ietf:params:scim:schemas:extension:zigbee:2.0
:Device :Device
urn:ietf:params:scim:schemas:extension:zigbee:2.0:Device: urn:ietf:params:scim:schemas:extension:zigbee:2.0:Device:
$ref: '#/components/schemas/ZigbeeDeviceExtension' $ref: '#/components/schemas/ZigbeeDeviceExtension'
skipping to change at line 3032 skipping to change at line 3036
device address. The regex pattern is device address. The regex pattern is
^[0-9A-Fa-f]{16}$. ^[0-9A-Fa-f]{16}$.
readOnly: false readOnly: false
writeOnly: false writeOnly: false
required: required:
- versionSupport - versionSupport
- deviceEui64Address - deviceEui64Address
description: Device extension schema for Zigbee. description: Device extension schema for Zigbee.
<CODE ENDS> <CODE ENDS>
B.8. EndpointAppsExt Extension Schema OpenAPI Representation B.8. endpointAppsExt Extension Schema OpenAPI Representation
OpenAPI representation of endpoint Apps extension schema is as OpenAPI representation of endpointAppsExt extension schema is as
follows: follows:
<CODE BEGINS> <CODE BEGINS>
openapi: 3.1.0 openapi: 3.1.0
info: info:
title: SCIM Endpoint Extension Schema title: SCIM Endpoint Extension Schema
version: 1.0.0 version: 1.0.0
components: components:
schemas: schemas:
skipping to change at line 3078 skipping to change at line 3082
required: required:
- applications - applications
- deviceControlEnterpriseEndpoint - deviceControlEnterpriseEndpoint
applications: applications:
type: array type: array
items: items:
value: value:
type: string type: string
description: The identifier of the endpointApp. description: The identifier of the EndpointApp.
readOnly: false readOnly: false
writeOnly: false writeOnly: false
ref: ref:
type: string type: string
format: uri format: uri
description: The URI of the corresponding 'EndpointApp' description: The URI of the corresponding EndpointApp
resource that will control or obtain data resource that will control or obtain data
from the device. from the device.
readOnly: true readOnly: true
writeOnly: false writeOnly: false
required: required:
- value - value
- ref - ref
<CODE ENDS> <CODE ENDS>
Appendix C. FIDO Device Onboarding Example Flow Appendix C. FIDO Device Onboarding Example Flow
skipping to change at line 3139 skipping to change at line 3143
| | | | | | | |
| | 6 200 "ok" | | | 6 200 "ok" |
| |<-------------------------------| | |<-------------------------------|
| | | | | | | |
| 7 200 "ok" | | | | 7 200 "ok" | | |
|<---------------------| | | |<---------------------| | |
| | | | | | | |
| | | | | | | |
After this flow is complete, the device can then first provisionally After this flow is complete, the device can then first provisionally
onboard and then later receive a trust anchor through FDO's TO2 onboard and then later receive a trust anchor through FDO's Transfer
process. This is shown below. Ownership Protocol 2 (TO2) process. This is shown below.
,-------. ,------. ,-------. ,------.
|Owner | ,---. |Access| ,------. |Owner | ,---. |Access| ,------.
|Service| |AAA| |Point | |Device| |Service| |AAA| |Point | |Device|
`---+---' `-+-' `---+--' `---+--' `---+---' `-+-' `---+--' `---+--'
| | | ,------------------!. | | | ,------------------!.
| | | |Device configured |_\ | | | |Device configured |_\
| | | |with well-known | | | | |with well-known |
| | | |RCOI and for trust | | | | |RCOI and for trust |
| | | |on first use | | | | |on first use |
 End of changes. 80 change blocks. 
187 lines changed or deleted 191 lines changed or added

This html diff was produced by rfcdiff 1.48.