51 lines
2.1 KiB
Markdown
51 lines
2.1 KiB
Markdown
# Identity Model
|
|
|
|
The identity model answers who the platform subject is, independent of how they
|
|
authenticate and independent of what they may do.
|
|
|
|
## Layers
|
|
|
|
- Identity: a person, service, or other subject known to GovOPlaN.
|
|
- Account link: a reference from that identity to one platform account.
|
|
- Primary account: the account used as the default display/explainability
|
|
anchor when multiple accounts exist.
|
|
|
|
## Boundary With Access
|
|
|
|
Access owns authorization. Identity only tells access which identity is behind
|
|
an account. Access can then evaluate roles, rights, delegation, and policy.
|
|
|
|
## Boundary With Organizations
|
|
|
|
Organization functions live in `govoplan-organizations`.
|
|
Identity-to-function assignments live in `govoplan-idm`. Those assignments may
|
|
reference identity and account IDs, but identity does not own organizational
|
|
structure or assignment workflows.
|
|
|
|
## Boundary With IDM
|
|
|
|
`govoplan-idm` imports, previews, reconciles, and applies external identity
|
|
facts. Once accepted, normalized identity records belong here.
|
|
|
|
## Access Projection Migration
|
|
|
|
`govoplan-access` now prefers `identity.directory` when it needs to resolve the
|
|
identity behind an account or render identity labels in semantic access views.
|
|
If the identity module is not installed, Access falls back to the legacy
|
|
`access_identities` and `access_identity_account_links` projection tables.
|
|
|
|
Rollout plan:
|
|
|
|
- keep the Access projection tables readable until existing installations have
|
|
a backfill path;
|
|
- backfill `identity_identities` and `identity_account_links` from the Access
|
|
projection where Identity is newly installed on an existing deployment;
|
|
- keep Access writes that still create local accounts able to maintain the
|
|
projection during the compatibility window;
|
|
- once deployments use `identity.directory` consistently, retire direct Access
|
|
identity reads and leave the projection tables as migration-only data until a
|
|
release-level retirement plan removes them.
|
|
|
|
The close-out condition is that Access works with canonical Identity installed
|
|
and still works without it through the projection fallback.
|