Device Schema Extensions to the System for Cross-Domain Identity Management (SCIM) Model
Extracted elements (28)
SCIM was chosen over NETCONF/RESTCONF for device provisioning because NETCONF and RESTCONF focus on configuration rather than provisioning, SCIM is designed for inter-domain provisioning over HTTP (supporting user-based, OAuth, and certificate authentication), and SCIM's data model is more targeted to provisioning as articulated in RFC 7643. End devices are not intended to be directly configured, leaving SCIM as the best standard option.
The Ethernet MAB extension enables a legacy, weak authentication mechanism based on MAC address. It is not likely to work properly with MAC address randomization, which is an important compatibility constraint for deployments using MAC randomization features.
All extensions to the device schema MUST be registered via IANA as described in Section 9.2. The 'required' value for all schemaExtensions entries is set to false.
If certificateInfo is provided by the client and accepted by the server, the server MUST return that multivalued attribute in its response. If the server accepts a certificate and also produces a clientToken, control and telemetry servers MUST validate both.
If rootCA is not present in certificateInfo, a set of trust anchors MUST be configured out of band. If the server returns neither certificateInfo nor a clientToken, then external authentication such as OAuth 2.0 MUST be pre-arranged.
In SCIM Groups, the 'type' subattribute of the 'members' attribute MUST be set to 'Device' for devices and 'EndpointApp' for endpoint applications.
The BLE separateBroadcastAddress attribute MUST NOT be set when an IRK is provided. Non-resolvable private addresses are not supported by this specification.
The SCIM server MUST know how to process the FDO ownership voucher, either directly or by forwarding it to an owner process as defined in the FDO specification.
When subjectName is a dnsName in a subjectAlternateName, servers validating such certificates SHALL reject connections when the name of the peer as resolved by a DNS reverse lookup does not match the dnsName in the certificate.
A new ResourceType 'Device' is defined with schema URI urn:ietf:params:scim:schemas:core:2.0:Device. It comprises a core device schema plus optional extension schemas. The core schema provides a minimal resource representation, with extensions selected based on device capability.
Four BLE pairing method extensions are defined as nested schemas: pairingNull (no attributes, for devices without pairing), pairingJustWorks (key=null, immutable), pairingPassKey (6-digit integer key matching ^[0-9]{6}$), and pairingOOB (key string from NFC/OOB, randomNumber integer nonce, optional confirmationNumber). Multiple pairing methods may be listed in pairingMethods.
The BLE extension (urn:ietf:params:scim:schemas:extension:ble:2.0:Device) adds attributes for BLE device provisioning: deviceMacAddress (required, 48-bit public MAC), isRandom (boolean for random vs. public address), irk (Identity Resolving Key, write-only, never returned), versionSupport (required, multivalued), mobility (boolean for AP roaming), and pairingMethods (required, multivalued, references pairing method extension URIs).
The certificateInfo complex attribute in EndpointApp contains rootCA (base64-encoded trust anchor certificate, optional) and subjectName (distinguished name or dnsName from subjectAlternateName per RFC 5280). It is used for X.509-based client authentication in place of clientToken.
The Endpoint Applications extension (urn:ietf:params:scim:schemas:extension:endpointAppsExt:2.0:Device) links non-IP devices to enterprise gateway endpoints. It provides deviceControlEnterpriseEndpoint (required, read-only URL), telemetryEnterpriseEndpoint (optional, read-only URL), and a multivalued applications list of UUID references to EndpointApp resources.
The EndpointApp resource type (schema URI urn:ietf:params:scim:schemas:core:2.0:EndpointApp) represents client applications that control or receive telemetry from devices. Key attributes include applicationType (deviceControl or telemetry, required, immutable), applicationName (required), clientToken (up to 500 characters, read-only, generated if no certificateInfo), and the complex certificateInfo attribute.
The Ethernet MAB extension (urn:ietf:params:scim:schemas:extension:ethernet-mab:2.0:Device) has a single required attribute, deviceMacAddress, representing the Ethernet MAC address to be provisioned for MAC Authentication Bypass. The format matches the BLE deviceMacAddress pattern.
The FIDO Device Onboard extension (urn:ietf:params:scim:schemas:extension:fido-device-onboard:2.0:Device) has a single required attribute, fdoVoucher, which is a PEM-encoded ownership voucher formatted per the FDO 1.1 specification. The attribute is write-only and never returned.
The SCIM Core Device Schema defines four attributes: displayName (optional string), active (required boolean indicating operational status), mudUrl (optional URL to the MUD file per RFC 8520), and groups (optional read-only complex object for group membership). Only 'active' is required.
The Wi-Fi Easy Connect (DPP) extension (urn:ietf:params:scim:schemas:extension:dpp:2.0:Device) provisions DPP-capable devices with attributes: dppVersion (required integer), bootstrapKey (required ECDH public key, write-only, never returned), deviceMacAddress (optional), serialNumber (optional), bootstrappingMethod (optional, e.g., [QR, NFC]), and classChannel (optional, class/channel pairs).
The Zigbee extension (urn:ietf:params:scim:schemas:extension:zigbee:2.0:Device) adds deviceEui64Address (required, 64-bit EUI-64 address as string) and versionSupport (required, multivalued array of supported Zigbee versions). Both attributes are mutable and returned by default.
IANA has added two entries to the 'SCIM Schema URIs for Data Resources' registry: urn:ietf:params:scim:schemas:core:2.0:Device (Core Device Schema) and urn:ietf:params:scim:schemas:core:2.0:EndpointApp (Endpoint Application). Additionally, ten extension URIs were added to the 'SCIM Server-Related Schema URIs' registry covering BLE, Ethernet MAB, FIDO Device Onboard, DPP, endpointAppsExt, Zigbee, and four BLE pairing method extensions.
An authenticated attacker could add unauthorized devices to the network, including devices with known vulnerabilities or IP-based devices acting as bots. Network administrators SHOULD establish access-control policies following the principle of least privilege, and SHOULD layer additional policies regarding what devices are permitted.
Deletion of a SCIM device object is only a signal of intent; the server may or may not revoke network access. It is RECOMMENDED that SCIM delete operations trigger a workflow in accordance with local network policy. Read and update operations SHOULD be restricted to clients that created the objects or those they explicitly authorize.
If BLE passkeys or other credentials are provisioned via SCIM, the SCIM server administrator may gain full device access. If the SCIM client administrator does not wish the network to have complete device access, the device itself MUST support finer-grained access control and additional authentication mechanisms at higher application layers.
SCIM logs may reveal which devices are on a network. Due to the sensitive nature of SCIM operations, logs SHOULD be encrypted both on disk and in transit.
The SCIM database is essentially equivalent to a network's AAA database because provisioning operations permit device access to a network. It must be carefully managed as such, and each SCIM client MUST be appropriately authenticated.
Device MAC addresses across BLE, DPP, and Ethernet MAB extensions are stored as strings matching the ECMA regular expression ^[0-9A-Fa-f]{2}(:[0-9A-Fa-f]{2}){5}$, representing a 48-bit colon-separated hexadecimal value. The BLE IRK is a string that is write-only and never returned.
The DPP bootstrapKey field contains a base64-encoded ECDH public key. The base64-encoded lengths are 80 characters for P-256, 96 for P-384, and 120 for P-521. The field is write-only and never returned by the server.