IAM in Service Catalog
Document Status: Some components are in limited deployment, and are under review for wider deployment. Others have not yet been implemented. See the Change Log section at the end for substantive change history.
UW Technology is incrementally extending the UW Groups Service to support new modes of group definition, more groups, more campus organizations defining groups, and more uses for groups. A key design component is a naming plan for groups that supports the eventual campus-wide scope of the service. It is desirable to start naming groups using a plausible scheme, even while many other aspects of the system are not yet in place. This document specifies a group naming plan for the UW Groups Service, including syntax and top-level name components.
This plan specifies group names that are in the style of UW NetIDs, email addresses, and web URLs. That is, they are: relatively short; typically meaningful to humans but not full English words; and normally writable as ASCII strings without white space. Such identifiers are intended to fit in easily where these other identifiers typically are found. Note, however, that the names in this plan are not themselves UW NetIDs, email addresses, or URLs/URIs; there are mappings to/from those forms in some cases.
In some important environments group names are in the same namespace as UW NetIDs. To accomodate this, group names (at least the NetID-style group names defined in this document) must be considered to be part of the larger UW NetID namespace. See UW NetID Namespace for more information.
This naming plan does not preclude the implementation of additional naming plans, for example a plan with longer names with a larger character set.
Namespaces, stems, and naming authorities
It is a requirement that groups be able to be created (hence named) by potentially very large numbers of UW community members (100,000 or more). To avoid conflicts, and to avoid the need for an approval process for each proposed group name, a hierarchical naming scheme is used. This is similar to other environments where large-scale distributed naming is needed (e.g. DNS, file systems).
Using the terminology promoted in the Internet2 Grouper project, specific group namespaces are referred to as "stems". A stem is created for the purpose of creating and managing groups (and other stems) based on it, and to control access to these operations. The entity (or entities) responsible for managing a stem is a "naming authority" for that stem. A naming authority may delegate control of namespaces based on its stem to other naming authorities.
Names and URIs
In many cases a group name is used in a context where it is understood to be a group name in the UW infrastructure space (e.g., the "require group foo" context in UW web access control for Apache). A short form is available for these contexts, as described in sections 3 and 4. For more general contexts, a URI form is also defined so that each group has a globally unique name.
Group names are names in the UW NetID namespace. The syntax defined here is a profile of the Base UW NetID syntax.
A group name is a sequence of name components, by convention written left-to-right from highest-level to lowest-level naming authority. Name components are written separated by a delimiter character.
Character set: Name components are limited to lowercase letters [a-z], digits [0-9], dash ("-"), and period (".").
Delimiter: The delimiter between components is underscore ("_").
Note that a particular name may be used both as the name of a group and as a stem on which other group names are based. For example, the name
might both be used as a group (i.e., have a member list and be used in group expression contexts) and as a stem for more group names, for example:
UW Technology (acting as institutional group naming authority) controls the top-level stem space. Top-level stems can be created as needed, based on discussion with stakeholders and establishment of clear definition and requirements. Like any stem, a top-level stem must have a well-defined naming authority to manage it.
Syntax of names under each stem can be further constrained.
4.1. UW NetID stem
A top-level stem:
is established to name groups based on the UW NetID namespace. Under this stem is a stem for each UW NetID, including personal, shared, and admin UW NetIDs, but not temp UW NetIDs or reserved UW NetIDs. For example,
is a stem whose naming authority is the person holding the personal UW NetID "rlbob". Examples of group names based on that stem are:
The stem based on a shared UW NetID has as a naming authority the owners of that shared UW NetID, or their delegates. Capability to manage groups using that stem is handled consistently with management of access to other resources available to that shared UW NetID. For example, the shared UW NetID "cac" has the stem:
Examples of group names based on that stem are:
The syntax of group names under the UW NetID stem is not further constrained.
4.2 UW Affiliation/Organization stem
is established to name groups with memberships based on UW affiliations and UW organizations. For example:
is the group whose members have the affiliation "student". One source of affiliation names is the eduPersonAffiliation attribute defined in the eduPersonspecification. Other affiliation names might be added locally at UW.
Groups named to support UW organizations use short organization identifiers as the component following the uw_ stem. Typically these names are used as stems for the management of potentially many groups within that organization. As a general rule names under this stem will correspond to DNS subdomains under washington.edu that have been delegated for organizational use. For example
could be a group delegated to the UW Computer Science department, corresponding to the cs.washington.edu DNS domain used by that department, and
could be groups under that stem.
This organizational naming plan could be superseded at some point by a more formal and comprehensive UW organization registry that would include allocation of short identifiers for these purposes.
The syntax of group names under the UW Affiliation stem is not further constrained.
4.3 Academic Course stem
is established to name groups with membership based on UW academic courses. For example:
The syntax of groups in the academic course stem is:
uwYear + uwQuarter + "-" + uwCurric + uwCrsNo + uwSectID
See http://www.washington.edu/computing/eds/groups.html#courses for descriptions of the above attribute types.
4.4 Unstructured stem
is established to name groups in an unstructured fashion. Typically names under this stem will be managed by central or departmental support teams rather than end-users. For example,
is a name in the unstructured stem. Names under this stem are not themselves usable as stems.
The syntax of group names under the Unstructured stem is not further constrained.
There may be existing practice where centrally-managed groups are named with names that do not conform to the scheme defined in sections 3 and 4. There may also be cases where applications require group names that do not conform to this plan, but it is still appealing to manage such groups centrally. In these cases exceptions may be granted. Such group names must still conform to the base UW NetID syntax. Groups named with exceptional names should still benefit from participation in group management and use operations. Such names do not participate in the hierarchical naming scheme, however; that is they are not used as stems. For example:
might be exceptional group names.
For use in URI contexts a URI namespace is assigned in UW's URN namespace:
A group URI is formed by appending the short-form group name to that namespace. For example, given the short-form group name:
the URI form is:
Note: Changes affecting the use or deployment of the naming plan are recorded here. Editorial changes or clarifications need not be recorded here.
2008 June 11, RL "Bob" Morgan
2008 May 28, RL "Bob" Morgan: