RFC 7644, "System for Cross-domain Identity Management: Protocol", September 2015

Errata ID: 7322
Status: Reported
Type: Technical
Publication Format(s) : TEXT
Reported By: James Linnell
Date Reported: 2023-01-26

Section 3.4.2.2 says:

    valFilter = attrExp / logExp / *1"not" "(" valFilter ")"

It should say:

    valFilter = attrExp / valLogExp / *1"not" "(" valFilter ")"

    valLogExp = valFilter SP ("and" / "or") SP valFilter

Notes:

This is a correction to Errata 4690 for this RFC. Errata 4690 introduced the following `valLogExp`:

valLogExp = attrExp SP ("and" / "or") SP attrExp

However, this fails to allow the following filter expression:

emails[type eq "work" or (type eq "home" and value ew "@example.com")]

because 4690's `valLogExp`'s recursion into `attrExp` would not allow for the parenthetical expression. The fixed `valLogExp` correctly recurs back into `valFilter` to allow for an `attrExp`, or a joined `logExp`, or a parenthtical.

While this example is not in the list of other exceptions in Section 3.4.2.2, the original use of `logExp` and the recurred `FILTER` would suggest that this example is within the original intent of the document.

Report New Errata