Skip to content
Permalink
2b1a4137ed
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

iam-knowledge-bits/thoughts.adoc

Go to file
 
 
Cannot retrieve contributors at this time
34 lines (24 sloc) 1.9 KB
Raw Blame

thoughts.adoc

Proposed event-driven approach to person registry identifier assignment

Each SoR record fires an event when it detects a person previously unknown to the SoR. The event label is something like 'noticedNewPerson' and the message will include the {Sorid} and an SoR-generated unique identifier for that person.

MVService: create subscriber to 'noticedNewPerson'; Its only function is to generate a new internal identifier, link it to the Sorid-assigned unique identifier and persist that info.

Hypothetical Precondition

A person was just now added to a System of Record, midPoint has not yet processed this, so has no record of their existence

Process A: A Grouper admin wants to manage groups for the new person . Grouper admin types something they know about the person (a name or email or other identifier) into Grouper .. Case 1: Subject lookup—​not found. What happens then? .. Case 2: Person is found in subject source. What identifier is used when adding them as a member to a group? …​ What manages getting subjects into the subject source …​ How does midPoint associate this group member with a know user?

"Solutions and tradeoffs"

  1. Have Grouper subject source be provisioned by midPoint;

    1. Consequences: Grouper subject search will fail until new person appears in subject source

  2. Have ID Match always return an identifier for the queried person

    1. works for cases where ID Match can definitively match a known identity or definitively be recognized as new, and return the identifier in either case

    2. If the result is multiple candidate matches that require human resolution, Id Match does not immediately return an identifier

    3. Fix: Have ID Match assign a new identifier to the person in question and return immediately while starting the identity resolution workflow

      1. Consequence: If a match with an existing user is eventually found, an identifier correction needs to take place