WP in openDesk [https://project.opendesk.family/notifications/details/1178/activity](https://project.opendesk.family/notifications/details/1178/activity)

Let's use the description of this work package as editor

\---

# **Gap analysis for openDesk regarding Begin of the insertiontechnical identifier inEnd of the insertion User Life Cycle Management**

<br>

## **Intro**

Begin of the insertionThis gap analysis looks at different places where OpenProject currently interacts with a common identifier provided by Nubus and where it should do so in the future.End of the insertion Begin of the deletion ...End of the deletion

Begin of the insertionSince it was agreed to split the topic of [User Lifecycle Management](https://project.opendesk.family/projects/openproject/work_packages/720) into small parts, this gap analysis is only concerned with the provisioning requirements for the technical identifier. The gap analysis might still refer to some coarse target state aside from the focus of this analysis, to clarify expectations. However actions are only derived when the identified gap is **in scope.**End of the insertion Begin of the deletion &lt;br&gt;End of the deletion

## Overview

Begin of the deletion Short explanation

End of the deletion <figure class="table op-uc-figure_align-center op-uc-figure"><table class="op-uc-table"><thead class="op-uc-table--head"><tr class="op-uc-table--row"><th class="op-uc-table--cell op-uc-table--cell_head" style="width:170px;"><p class="op-uc-p">Area</p></th><th class="op-uc-table--cell op-uc-table--cell_head"><p class="op-uc-p">Current State</p></th><th class="op-uc-table--cell op-uc-table--cell_head"><p class="op-uc-p">Desired State</p></th><th class="op-uc-table--cell op-uc-table--cell_head"><p class="op-uc-p">Identified Gap / Action Required</p></th></tr></thead><tbody><tr class="op-uc-table--row"><td class="op-uc-table--cell"><p Begin of the insertionclass="op-uc-p"><strong>Identifier format</strong></p></td><tdEnd of the insertion Begin of the deletion class=&quot;op-uc-p&quot;&gt;&lt;strong&gt;UUID Handling&lt;/strong&gt;&lt;/p&gt;&lt;/td&gt;&lt;tdEnd of the deletion class="op-uc-table--cell"><p class="op-uc-p">OpenProject Begin of the insertionstores identifier in identity URL andEnd of the insertion Begin of the deletion user identification,End of the deletion remote Begin of the insertionidentities, both are PG VARCHAR columns without a size limit. Database encoding is Unicode.</p></td><tdEnd of the insertion Begin of the deletion identities&lt;/p&gt;&lt;/td&gt;&lt;tdEnd of the deletion class="op-uc-table--cell"><p class="op-uc-p"><br></p></td><td class="op-uc-table--cell"><ul class="op-uc-list"><li class="op-uc-list--item"><p class=" Begin of the insertionop-uc-p">no action required</p></li></ul></td></tr><trEnd of the insertion Begin of the deletion op-uc-p&quot;&gt;Save UUID in existing remote identity attribute&lt;/p&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/td&gt;&lt;/tr&gt;&lt;trEnd of the deletion class="op-uc-table--row"><td class="op-uc-table--cell"><p Begin of the insertionclass="op-uc-p"><strong>Identifying users via common identifier</strong></p></td><tdEnd of the insertion Begin of the deletion class=&quot;op-uc-p&quot;&gt;&lt;strong&gt;Groups&lt;/strong&gt;&lt;/p&gt;&lt;/td&gt;&lt;tdEnd of the deletion class="op-uc-table--cell"><p Begin of the insertionclass="op-uc-p">OpenProject identifies users in external IDP based on their identity url which is composed of an identifier for the IDP and the <code class="op-uc-code">sub</code> indicated by ID tokens of the user.</p></td><tdEnd of the insertion Begin of the deletion class=&quot;op-uc-p&quot;&gt;&lt;br&gt;&lt;/p&gt;&lt;/td&gt;&lt;tdEnd of the deletion class="op-uc-table--cell"><p Begin of the insertionclass="op-uc-p">Current state. Expecting to find same identifier as external ID in SCIM provisioning.</p></td><tdEnd of the insertion Begin of the deletion class=&quot;op-uc-p&quot;&gt;&lt;br&gt;&lt;/p&gt;&lt;/td&gt;&lt;tdEnd of the deletion class="op-uc-table--cell"><ul class="op-uc-list"><li class="op-uc-list--item"><p class=" Begin of the insertionop-uc-p">no action required as part of this gap analysis (SCIM out of scope)</p></li></ul></td></tr><trEnd of the insertion Begin of the deletion op-uc-p&quot;&gt;Add remote identities to groups&lt;/p&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/td&gt;&lt;/tr&gt;&lt;trEnd of the deletion class="op-uc-table--row"><td class="op-uc-table--cell"><p Begin of the insertionclass="op-uc-p"><strong>Identifying groups via common identifier</strong></p></td><tdEnd of the insertion Begin of the deletion class=&quot;op-uc-p&quot;&gt;&lt;strong&gt;Lifecycle Management&lt;/strong&gt;&lt;/p&gt;&lt;/td&gt;&lt;tdEnd of the deletion class="op-uc-table--cell"><p Begin of the insertionclass="op-uc-p">OpenProject does not track an immutable, external identifier for generic groups, but synchronizing groupsEnd of the insertion Begin of the deletion class=&quot;op-uc-p&quot;&gt;&amp;nbsp;lifecycle stages (creation, suspension, deletion)&lt;br&gt;e.g. user deletionEnd of the deletion is Begin of the insertionsupported through LDAP using their DN.</p></td><tdEnd of the insertion Begin of the deletion first a deactivation with async deletion&lt;/p&gt;&lt;/td&gt;&lt;tdEnd of the deletion class="op-uc-table--cell"><p Begin of the insertionclass="op-uc-p">OpenProject tracks groups similar to users, based on an identity url.</p></td><tdEnd of the insertion Begin of the deletion class=&quot;op-uc-p&quot;&gt;&lt;br&gt;&lt;/p&gt;&lt;/td&gt;&lt;tdEnd of the deletion class="op-uc-table--cell"><ul class="op-uc-list"><li class="op-uc-list--item"><p class=" Begin of the insertionop-uc-p"><strong>Action:</strong> Groups need to support identity url as well</p></li></ul></td></tr><trEnd of the insertion Begin of the deletion op-uc-p&quot;&gt;maybe that needs changes&lt;/p&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/td&gt;&lt;/tr&gt;&lt;trEnd of the deletion class="op-uc-table--row"><td class="op-uc-table--cell"><p class="op-uc-p"><strong>APIs</strong></p></td><td class="op-uc-table--cell"><p Begin of the insertionclass="op-uc-p">Some OpenProject APIs accept users only as internal IDs (e.g. when filtering workpackages by assignee). An additional API request is needed to determine internal ID of users.</p></td><tdEnd of the insertion Begin of the deletion class=&quot;op-uc-p&quot;&gt;&lt;br&gt;&lt;/p&gt;&lt;/td&gt;&lt;tdEnd of the deletion class="op-uc-table--cell"><p Begin of the insertionclass="op-uc-p">Unclear. Possibly desirable to be able to use common identifier for querying.</p></td><tdEnd of the insertion Begin of the deletion class=&quot;op-uc-p&quot;&gt;&lt;br&gt;&lt;/p&gt;&lt;/td&gt;&lt;tdEnd of the deletion class="op-uc-table--cell"><ul class="op-uc-list"><li class="op-uc-list--item"><p class=" Begin of the insertionop-uc-p">Changes are out of scope for this gap analysis</p></li></ul></td></tr><trEnd of the insertion Begin of the deletion op-uc-p&quot;&gt;API endpoints that &amp;nbsp;are missing or need changes&lt;/p&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/td&gt;&lt;/tr&gt;&lt;trEnd of the deletion class="op-uc-table--row"><td class="op-uc-table--cell"><p Begin of the insertionclass="op-uc-p"><strong>LDAP</strong></p></td><tdEnd of the insertion Begin of the deletion class=&quot;op-uc-p&quot;&gt;&lt;strong&gt;Logging&lt;/strong&gt;&lt;/p&gt;&lt;/td&gt;&lt;tdEnd of the deletion class="op-uc-table--cell"><p Begin of the insertionclass="op-uc-p">Users are synchronized via LDAP without a common identifier (identity url). Upon SSO login they are remapped onto LDAP-provisioned users via their email address.</p></td><tdEnd of the insertion Begin of the deletion class=&quot;op-uc-p&quot;&gt;&lt;br&gt;&lt;/p&gt;&lt;/td&gt;&lt;tdEnd of the deletion class="op-uc-table--cell"><p Begin of the insertionclass="op-uc-p">Provisioning users via SCIM sets the identity url as well, making user remapping unnecessary.</p></td><tdEnd of the insertion Begin of the deletion class=&quot;op-uc-p&quot;&gt;&lt;br&gt;&lt;/p&gt;&lt;/td&gt;&lt;tdEnd of the deletion class="op-uc-table--cell"><ul class="op-uc-list"><li class="op-uc-list--item"><p class=" Begin of the insertionop-uc-p">Changes are out of scope for this gap analysis</p></li></ul></td></tr></tbody></table></figure><br>End of the insertion Begin of the deletion op-uc-p&quot;&gt;Full logging strategy with User context helpers or frameworks used&lt;/p&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;&lt;/figure&gt;End of the deletion

Begin of the deletion &lt;br&gt;

End of the deletion ## Details

Begin of the insertionTBDEnd of the insertion Begin of the deletion ### **Current State**End of the deletion

Begin of the deletion 1. UUID Handling

2. Groups

3. ...


End of the deletion ### Begin of the insertion

End of the insertion Begin of the deletion **Desired state**

1. UUID Handling

2. Groups

3. ...


### **Gap**

1. UUID Handling

2. Groups

3. ...


End of the deletion ## **Summary**

Begin of the insertionOpenProject is fit to deal with a generic, stable identifier for users. Groups are not currently identified through a common identifier, which would need to be established.End of the insertion Begin of the deletion Difficulties, Uncertainties, Blockers, open questions, how we feel about it (Estimated of PDs needed?)End of the deletion