Establish ION-wide policies and capabilities to manage users.
|Actors||Registered User, Anonymous Guest, Integrated Observatory Operator|
|Uses||UC.R1.01 Hello User|
|Is Used By|
|Is Extended By|
|In Acceptance Scenarios||None (add to AS.R2.01C Operate Integrated Observatory Network)|
|Primary Service||Identity and Policy Management Services|
|UC Status||Mapped + Ready|
This information summarizes the Use Case functionality.
Manage users and related information in the primary Integrated Observatory. Manage multiple login identities associated with one Integrated Observatory user ID; authenticate requests to link accounts. Manage multiple profiles for one user ID. Perform user registration using selected profile, and assign associated access privileges.
- Integrated Observatory is managing users in this Release.
Individual is Registered User of the Integrated Observatory with another account (as yet unknown to the Integrated Observatory) at a federated organization (e.g., Google).
- Registered User starts to log in or register using CILogon.
- Either case may result in same outcome behavior.
- Registered User successfully registers under a new external account.
- The certificate from the new account is returned to the Integrated Observatory
- Upon recognizing that certificate is not known, the Integrated Observatory provisionally assumes this is a new user.
- This is the most likely and best default assumption.
- Identification of common account information after ION member profile is entered can lead to following path.
- The Integrated Observatory assigns the user the appropriate default role and presents a new member profile screen.
- This solicits member profile information collection, if following path option is not chosen.
- So far, this is path an Anonymous Guest would follow.
- The Integrated Observatory also presents the user with additional option(s) to link new account to existing account.
- Main option is to link to the existing account ('takes a few minutes').
- Another possibility is to continue working as new user, and link to existing accounts later.
- Registered User asks to link to existing account, specifying the account name.
- The Integrated Observatory generates email to that account, which must be confirmed by clicking on a link in (or entering a code from) that email.
- A list of all account names is not offered for privacy reasons.
- If a reasonably likely account name (or names) can be suggested, this may be acceptable and is a valuable simplification for the user.
- Successful completion of task causes Integrated Observatory to link each account to the other.
- Unsuccessful completion — for example, because previous account is no longer accessible to user — must be mediated by Integrated Observatory Operator, who must confirm identity of the two account holders is in fact the same.
- Integrated Observatory Operator receives any request for mediation when previous credential account can not be accessed.
- Integrated Observatory Operator ascertains relationship of the two accounts, and establishes account linkage if appropriate.
- Can involve Registered User providing personal information only known to holder of previous account; call-back to numbers or email to addresses associated with previous account; or a waiting period while attempts are made to contact holder of previous account.
- <3> Once account linkage is established, Integrated Observatory offers Registered User the option of disabling the previous account registration.
- If user agrees, previous account is flagged so user can no longer use its credentials to log in.
- <3> Integrated Observatory Operator reviews status of all newly linked accounts.
- Requires display of all user accounts that have been linked since last review/given day.
- Suspicious linkages are reviewed by Operator.
- <3> For each actual user, multiple credential accounts can be supported, dereferenced to single user.
- Single user does not necessarily mean only one profile, but that is the most common scenario.
- <3> A Registered User indicates desire to have multiple operational profiles.
- An operational profile can represent different metadata about the user, as well as different ION Roles. ION Roles constrain what users can, and can not do, in the Integrated Observatory system.
- An example scenario is an operator who is also a normal system user. It is important for such a user to take on the administrator role only when performing administrative functions.
- <3> Integrated Observatory presents an interface allowing specification of the new profile.
- In most cases, the principal difference may be the role(s) taken on by the user.
- Requests for different profiles that are merely presenting different information (e.g., a teacher profile vs a researcher profile) typically would not require any approval authority.
- <3> The Integrated Observatory accepts the new specification and, if necessary, routes it for approval to the appropriate role.
- The Integrated Observatory Manager is the initial role with this responsibility.
- <3> The system notifies the user of the results of the request, once the Integrated Observatory Operator takes action on it.
- This is following the form in the Conduct Negotiation use case.
- <2> Once granted a new profile, the user may switch profiles at will, while remaining logged in.
- It may be valuable to associate different profiles to credential accounts eventually, as users demand it.
The Registered User is associated with the new credential account. The user has an additional role in a new profile if it is appropriate, or a response indicating why it is not appropriate.
These comments provide additional context (usually quite technical) for editors of the use case.