<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> </head> <body text="#000000" bgcolor="#FFFFFF"> <div class="moz-cite-prefix">On 15/04/2019 13:31, ripedenis--- via db-wg wrote:</div> <div class="moz-cite-prefix"><br> </div> <div class="moz-cite-prefix">I have recently encountered issues in this area as well. I would like to see the standard "non-billing" users to not only be allowed for the main resources but also for all sub-groups that appear under the LIR. Currently, a user added as a regular LIR user does <b>not </b>have access to all RIPE NCC services:<br> </div> <div class="moz-cite-prefix"><br> </div> <div class="moz-cite-prefix">Currently in the LIR there are 3 level of users:<br> - Admin - The Administrator will have full access to RIPE NCC services plus the right to manage other LIR contacts<br> o Regular - The Operator will have full access to RIPE NCC services<br> o Billing - The Billing user will have access to RIPE NCC billing information only<br> <br> </div> <div class="moz-cite-prefix">Only by adding that user as SSO under the mnt-ner will the user have access to all LIR sub-groups.</div> <div class="moz-cite-prefix"><br> </div> <div class="moz-cite-prefix">Also, now that RPKI is picking up steam, I would like to see an additional level of user known as RPKI - which means the user can have access to all RIPE NCC RPKI services, including creating ROAs and anything else related to RPKI.</div> <div class="moz-cite-prefix"><br> </div> <div class="moz-cite-prefix">Regards,</div> <div class="moz-cite-prefix">Hank<br> </div> <blockquote type="cite" cite="mid:424380570.5779550.1555324270531@mail.yahoo.com"> <meta http-equiv="content-type" content="text/html; charset=UTF-8"> <div class="yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;"> <div><span> <div>Colleagues</div> <div><br> </div> <div>I think we have now agreed on these problem and solution definitions:</div> <div><br> </div> <div>Problem Definition</div> <div><br> </div> <div>LIRs would like a mechanism to easily add/remove users to centralised SSO authentication groups for maintaining objects in the RIPE Database.</div> <div><br> </div> <div><br> </div> <div>Solution Definition</div> <div><br> </div> <div>Stage 1</div> <div><br> </div> <div>-Non billing Users listed in an LIR´s portal account will be contained in a default authentication group</div> <div><br> </div> <div>-Non billing users added or removed through the portal UI will be automatically adjusted in this group</div> <div><br> </div> <div>-This authentication group can be referenced in MNTNER objects by a new authentication method</div> <div><br> </div> <div>-These authentication groups for LIRs will be stored in a way that updates to the RIPE Database is not dependent on the availability of the portal service</div> <div><br> </div> <div><br> </div> <div>Stage 2</div> <div><br> </div> <div>-Non billing Users listed in an LIR´s portal account can be added to and removed from user defined SSO authentication groups</div> <div><br> </div> <div>-Each User can be a member of any number of named groups</div> <div><br> </div> <div>-The authentication groups can be configured using the portal UI</div> <div><br> </div> <div>-These groups can be referenced in MNTNER objects by the new authentication method</div> <div><br> </div> <div><br> </div> <div>The chairs will now ask the RIPE NCC to work from these definitions in preparing their implementation plan.</div> <div><br> </div> <div>cheers</div> <div>denis</div> <div><br> </div> <div>co-chair DB-WG</div> </span><br> </div> </div> </blockquote> <p><br> </p> </body> </html>