Standards » Management Area » UR WG

h1. List of fields considered for the subject identity block of the usage record

The following fields are considered for inclusion in a subject identity block in a usage record. Each resources will have its own specific block. This specific block is reserved to the attributes that describes the record identity. 

----

h2. SubjectIdentityBlock

This is the block property of the Subject identity.

Example

<pre>

<ur:SubjecyIdentityBlock>

  <!— Identity properties go in here -->

</ur:SubjectIdentityBlock>

</pre>

h3. Comments:

Ralph: ok

Mike J: OK, but perhaps need some more detail: what can we expect to see in this block

<IdentityBlock>

  <anonymous/>

  <DN authorisaition="true">string</DN>

  <uid>n</uid>

  <ip authorisation="false">n.n.n.n</ip>

  ...

</IdentityBlock>

</pre>

----

h2. UserIdentity or GlobalUsername

This property  is part of the SubjectIdentityBlock and describes the global identity of the user accountable for the resource consumption. The property should identify the user globally, such that clashes do not happen accidentally, (eg.: it could be an X509 identity)

Example

<pre>

<ur:UserIdentity>/O=Grid/OU=example.org/CN=John Doe

</ur:UserIdentity>

</pre>

h3. Comments:

Ralph: ok - other possible name  GlobalUserId, I would prefer equivalent names local vs global (e.g. LocalUserId - GlobalUserId or LocalUser - GlobalUser)

Mike J: Not sure this is useful outside one specific domain: see example in Identity block comment -- other possibility:

<pre>

<UserIdentity type="IGTFDN" authorised="true" scope="global">/O=Grid/OU=example.org/CN=John Doe</UserIdentity>

<UserIdentity type="LDAPUsername" scope="site">

<UserIdentity type="system" scope="local">

</pre>

etc.

There will be multiple identifiers on the system and in some cases multiple ways to _login_, and those login IDs may be permanently linked or not e.g. leased

----

h2. Group or  GlobalGroup

This property is part of the SubjectIdentityBlock and describes the global group accountable for the resource consumption. The property should identify the group globally, such that clashes do not happen accidentally, (eg.: using a FQDN to construct it. In Grid terms, this would typically be the VO name).

Example

<pre>

<ur:Group>binarydataproject.example.org</ur:Group>

</pre>

h3. Comments:

Ralph: ok - see comment on UserIdentity

Mike J: OK but see comments on useridentity!

----

h2. GroupAttribute or GlobalGroupAttribute

This property is part of the SubjectIdentityBlock and describes supplemental traits of the group property, e.g., sub-groups, role or authority. This makes it possible to account for segments of a group, while still being able to account for the group as a whole.

Example

<pre>

<ur:GroupAttribute ur:attributeType="role">production</ur:GroupAttribute>

<ur:GroupAttribute ur:attributeType="subgroup">analysis</ur:GroupAttribute>

<ur:GroupAttribute ur:attributeType="authority">

/O=Grid/OU=example.org/CN=host/auth.example.org

</ur:GroupAttribute>

</pre>

h3. Comments:

Ralph: ok

Mike J: Not sure about this; In the VOMS case if you have all the FQANs and you know based upon which FQAN that usage was authorized that should be sufficient.

The authority attribute however might be useful for auditing purposes.

---

h2. AuthorityType

This property is part of the IdentityBlock and describes the authority type that identified the user, e.g., CA, shibboleth, etc..

Example

<pre>

<ur:AuthorityType>CA</ur:AuthorityType>

</pre>

h3. Comments:

---

h2. AuthorityID

This property is part of the SubjectIdentityBlock and identifies the authority which issued the user's credentials, e.g., INFN-CA, etc.

Example

<pre>

<ur:AuthorityID>INFN-CA</ur:AuthorityID>

</pre>

h3. Comments:

---

h2. WhereTheUserCameFrom

This property is part of the SubjectIdentityBlock and identifies the machine from which the user accessed the remote resource, e.g., IP address, hostname, etc.

Example

<pre>

<ur:WhereTheUserCameFrom>156.156.156.156</ur:WhereTheUserCameFrom>

</pre>

h3. Comments:

Jon: Not sure where this came from. If still needed, I guess the name could be better.

---

h2. issuer

This property denotes who issued the certification of the user.

h3. Comments:

---

Mike: Suggest a mockup for the wiki: The following is an example straw-man of what I would like to see (it is not agreed nor a summary of the above)

<pre>

<usage>

  <recordIdentity>

    <creationTime>[When the record is cut]</creationTime>

    <recordID>[unique opaque ID]</recordID>

    <recorderID type="DN">[DN of host cutting the record]</recorderID> ||  

    <recorderID type="IP">[IP address of host curring the record]</recorderID>

  </recordIdentity>

  <identity>

    <!-- There may be other examples of the following. One of the following needs to have an attribute defining that it was used for authorisation -->

    <Id individual="true" type="anonymous"/> ||

    <Id  individual="true"type="DN" scope="global|local">[DN]</userId>?

    <Id individual="true"  type="IP" scope="global|local">[IP]</userId>?

    <Id individual="true"  type="UID" scope="site|local">[ID]</userId>?

    <ID individual="false"  type="GID" scope="site|local">[ID]</groupID>?

    <ID  individual="false" type="VOMS">

      <authority type="DN">[VOMS AC Issuer/Server certificate]</authority>

      <method>AC|List|SAML</method>

    </groupID>

    <ID individual="false" type="GID" scope="site|local">[GID]</groupID>

    <ID individual="false" type="IP" scope="local|global">

      <IP mask="255.255.0.0">[IP]</IP>+

    </groupID>

  </identity>

...

</usage>

</pre>

----

h2. ALL OK:

----

h2. LocalUser or  LocalUserId

This is the attribute property of the Usage Record is part of the ~IdentityBlock and identify the local user (eg.: Unix user).

Example

<pre>

<ur:LocalUser>johndoe</ur:LocalUser>

</pre>

h3. Comments:

Ralph: ok

Mike J: OK

----

h2. LocalGroup or LocalGroupId

This is the attribute property of the Usage Record is part of the ~IdentityBlock and identify the local group (eg.: Unix group).

Example

<pre>

<ur:LocalGroup>binarydataproject</ur:LocalGroup>

</pre>

h3. Comments:

Ralph: ok

Mike J: OK

----