RFC 7644, "System for Cross-domain Identity Management: Protocol", September 2015

Errata ID: 7319
Status: Reported
Type: Technical
Publication Format(s) : TEXT
Reported By: James Linnell
Date Reported: 2023-01-25

Section 3.4.2.2 says:

     FILTER    = attrExp / logExp / valuePath / *1"not" "(" FILTER ")"

     valuePath = attrPath "[" valFilter "]"
                 ; FILTER uses sub-attributes of a parent attrPath

     valFilter = attrExp / logExp / *1"not" "(" valFilter ")"

It should say:

     FILTER    = attrExp / logExp / valuePath / *1("not" SP) "(" FILTER ")"

     valuePath = attrPath "[" valFilter "]"
                 ; FILTER uses sub-attributes of a parent attrPath

     valFilter = attrExp / logExp / *1("not" SP) "(" valFilter ")"

Notes:

Note the following example filter listed further down in section 3.4.2.2:

filter=userType ne "Employee" and not (emails co "example.com" or
emails.value co "example.org")

There is a space between the "not" and the opening parenthesis, which is not allowed in the listed ABNF grammar. The corrected text includes a mandatory space between these two tokens.

It may be desired to use `*1("not" *1SP) "("` instead, for backwards compatibility reasons. This would allow for an optional space after a "not" keyword. Or, it may be desired to instead edit the example to remove the space, preserving the original intent of the listed grammar.

Report New Errata