COmanage Users List

[Bas Zoetekouw <>]

Hi everyone,

In our of our pilots a usecase has come up of which we're not sure what
the best way is to implement this in COmanage.  We are hoping you might
have encountered similar usecases and I'd be very glad to hear your
thoughts.

We are implementing COmanage for a large research university; they want
to use COmanage to empower their researchers to manage their own team
(i.e., handle their own IdM-stuff).  The university offers
compute-facilities to a number of research groups, and they would like
to use COmanage to manage authorizations for this service.

The general access is granted on a research group level, and as these
are mapped onto COUs in COmanage, this is easy to handle.  However,
within a typical research group, a number of users are granted
additional privileges.  For example, they are allowed to use specific
compute nodes, are allocated more storage, or are allowed to use
specific GPU resources.

We are struggling how to best express these additional
roles/authorizations in the COU.  We can think of a number of options:

- use groups to express the roles; doesn't seem to map quite right, as
the groups are CO-wide and the roles are COU-specific.  Will probably
also lead to namespace clashes between authorization groups of different
COUs.
 - use the existing :admins or :owner roles in  COU; doesn't seem quite
right as these give additional permissions in COmanage, and the people
who need these roles to manage the COUs in COmanage are typically not
the people who need access to the additional resources
 - use COPersonRole Affiliation to express roles;  that would require
extending the allowed values for Affiliations, which doesn't feel quite
right.
 - use a sub-COU to express specific roles;  this seems like a bit of
overkill, in particular because it would require defining specific
enrollment flows for the sub-COU.
 - voPersonAffiliation might be a solution, but that is currently still
only a proposal.

Please let me know what you think..  I am particularly interested in the
way in which this issues might have been addressed in other COmanage
installations.

Greetings,
Bas.
SURFnet.