Re: [regrep] Users and Organizations

[Chiusano Joseph <chiusano_joseph@bah.com>]

Nikola,

I think you're definitely onto something here.  To verify my
interpretation, I've expanded your thoughts below with bullet points and
rough diagrams, and placed recommendations at end:

MAIN CONCEPTS:
-------------
- Resource � has �owner� attribute

- It is the ID attribute of the User instance within the registry that
represents the owner of the resource

So we have:

      owns
User ------> Resource

- A user may have an Organization attribute that references the
Organization instance with which the user is affiliated

- So we have (using term �employs� very loosely, just for illustrative
purposes):

            employs        owns
Organization ------> User ------> Resource

There are also 2 pre-defined assocationTypes:

- SubmitterOf � defines that the source Organization is the submitter of
the target RegistryObject [Submitting Organization, or SO]

- ResponsibleFor � defines that the source Organization is responsible
for the ongoing maintenance of the target RegistryObject [Responsible
Organization, or RO]

QUESTIONS WERE:
--------------
Questions were (see "CRUX OF ISSUE" for bottom line):

- It is possible to submit a registry object that has an owner that is
affiliated with an organization that is different then the one(s) which
is (are) the source object in "SubmitterOf" association?

For example:

- User XYZ is employed by Organization 1 (SO)
- User XYZ submits a Registry Object ABC
- Along with the submit is included a �SubmitterOf� association that
defines that Organization 1 is the submitter of (SO) Registry Object ABC

- So we have relations:

              submits
Organization 1 ------> Registry Object ABC

AND
               employs          owns
Organization 1 ------> User XYZ------> Registry Object ABC

CRUX OF ISSUE:

At this point, should User XYZ �own� registry object ABC? 

My opinion: Perhaps not, because User XYZ is employed by the Submitting
Organization (SO), not the Responsible Organization (RO)

Suppose the above example were instead (note added �ResponsibleFor�
association in bullet 4):

- User XYZ is employed by Organization 1 (SO)
- User XYZ submits a Registry Object ABC
- Along with the submit is included a �SubmitterOf� association that
defines that Organization 1 is the submitter of Registry Object ABC
- Along with the submit is also included a �ResponsibleFor� association
that defines that Organization 1 is responsible for (RO) Registry Object
ABC

So we have relations:

              submits
Organization 1 ------> Registry Object ABC

AND
          responsible for
Organization 1 ------> Registry Object ABC

AND
              employs           owns
Organization 1 ------> User XYZ------> Registry Object ABC

At this point, User XYZ should (in my opinion) �own� registry object ABC
because User XYZ is employed by the Responsible Organization (RO) (and
additionally by the Submitting Organization (SO), as they are one and
the same)

RECOMMENDATIONS:
---------------
So to your question of �Do users need to be able to affiliate themselves
with more then 1 organization?� � I think the issue is perhaps not with
user/organization affiliation, but rather with what �type� of
organization is allowed to own a registry object, through a User
instance.  In other words, I believe we may want to consider
�tightening� this functionality to ensure that only a Responsible
Organization may own a registry object (through a user), not a
Submitting Organization. We could require that a registry object have a
Responsible Organization (i.e. ResponsibleFor association) when it is
submitted, ensuring that the registry object is not �Ownerless�.  

Or, we could leave this to a �registry policy� [plug for v4 feature]
that is configurable by registry administrators.  I think we should
consider introducing registry policies (i.e. additional to access
control policies) in V4.

I think we should allow users to be affiliated with more than one
organization.  Example is a user that works for a government contractor
(Organization A), and is submitting objects on behalf of a government
agency (Organization B) as part of a contract with that agency. 
Organization A would be the Submitting Organization, while Organization
B would be the Responsible Organization.  In this case, the user would
�own� the resource because they are �representing� the Responsible
Organization (Organization B).

That's all! Please let me know if I've misunderstood anything.

Joe

Nikola wrote:
> 
> Currently (ebRIM 2.34) "The owner attribute of a Resource carries the value
> of id attribute of the User instance within the registry that represents the
> owner of the resource". At the same time a user "may have an organization
> attribute that references the Organization instance with which the user is
> affiliated". There are also two pre-defined association types "SubmitterOf -
> Defines that the source Organization is the submitter of the target
> RegistryObject." and "ResponsibleFor - Defines that the source Organization
> is responsible for the ongoing maintainence of the target RegistryObject.".
> 
> It is possible to submit a registry object that has an owner that is
> affiliated with an organization that is different then the one(s) which is
> (are) the source object in "SubmitterOf" association. Same applies to
> "ResponsibleFor".
> 
> Do users need to be able to affiliate themselves with more then 1
> organization? Do we need to clarify semantics of affiliation, ownership,
> maintenance, ... of registry objects somewhere in the specs or what is in
> there now is enough? Are above aspects covered by "Access Control" mechanism
> and if yes do we need them as such.
> 
> Regards,
> Nikola
> 
> ----------------------------------------------------------------
> To subscribe or unsubscribe from this elist use the subscription
> manager: <http://lists.oasis-open.org/ob/adm.pl>

Attachment: Chiusano_Joseph.vcf
Description: Card for Joseph Chiusano