Update enduser domain and add enduser.authentication.id
#1456
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| # Use this changelog template to create an entry for release notes. | ||
| # | ||
| # If your change doesn't affect end users you should instead start | ||
| # your pull request title with [chore] or use the "Skip Changelog" label. | ||
|
|
||
| # One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix' | ||
| change_type: enhancement | ||
|
|
||
| # The name of the area of concern in the attributes-registry, (e.g. http, cloud, db) | ||
| component: enduser | ||
|
|
||
| # A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`). | ||
| note: introduce new attribute `enduser.authentication.id`, replace `enduser.id` with `enduser.anonymous.id`, and deprecate `enduser.authentication.role`, and `enduser.authentication.scope`. | ||
|
|
||
| # Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists. | ||
| # The values here must be integers. | ||
| issues: [1104] | ||
|
|
||
| # (Optional) One or more lines of additional information to render under the primary note. | ||
| # These lines will be padded with 2 spaces and then inserted directly into the document. | ||
| # Use pipe (|) for multiline entries. | ||
| subtext: | | ||
| The new attribute `enduser.authentication.id` is intended to provide an unique identifier of an authenticated enduser. | ||
| The deprecated attributes `enduser.authentication.role` and `enduser.authentication.scope` are removed from the enduser registry. |
| Original file line number | Diff line number | Diff line change | ||
|---|---|---|---|---|
| @@ -0,0 +1,22 @@ | ||||
| groups: | ||||
| - id: identity | ||||
| type: attribute_group | ||||
| brief: > | ||||
| These attributes may be used for any operation with an authenticated and/or authorized enduser. | ||||
| attributes: | ||||
| - ref: enduser.id | ||||
| deprecated: Replaced by `enduser.anonymous.id` attribute. | ||||
| requirement_level: recommended | ||||
| - ref: enduser.anonymous.id | ||||
| requirement_level: recommended | ||||
| - ref: enduser.role | ||||
|
There was a problem hiding this comment. please remove it from this group - it's listed as deprecated attribute and is not necessary here |
||||
| deprecated: "Removed." | ||||
| requirement_level: recommended | ||||
| - ref: enduser.scope | ||||
|
There was a problem hiding this comment. same here, please remove the reference |
||||
| deprecated: "Removed." | ||||
| requirement_level: recommended | ||||
| - ref: enduser.authentication.id | ||||
| requirement_level: required | ||||
|
There was a problem hiding this comment. I don't think it can be required since it's likely to contain PII |
||||
| note: > | ||||
| The `enduser.authentication.id` attribute is intended to provide an unique identifier of an authenticated enduser. | ||||
| The deprecated attributes `enduser.authentication.role` and `enduser.authentication.scope` are removed from the enduser registry. | ||||
|
Comment on lines
+18
to
+22
There was a problem hiding this comment. I was thinking that There was a problem hiding this comment. #1456 (comment) renaming There was a problem hiding this comment. can you summarize the reason for using does this mean we will prohibit future "embedding" of There was a problem hiding this comment. we decided to have a sub-namespace called authentication so that we can add other attributes to do with authentication in the future. There was a problem hiding this comment.
I don't see any discussion around it or some motivation to introduce The There was a problem hiding this comment. that was the 1st thing i did on this long-discussed thread. There was a problem hiding this comment. but this PR is based on that PR. There was a problem hiding this comment.
Suggested change
I don't think that's accurate and also there is no need to mention changes in yaml that have no effect on markdown. |
||||
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,42 @@ | ||||||
| groups: | ||||||
| - id: registry.enduser | ||||||
| type: attribute_group | ||||||
| display_name: End User Attributes | ||||||
| brief: > | ||||||
| Describes information about the end user, which can be used as a subdomain of browser, client, or user domains. | ||||||
|
There was a problem hiding this comment.
Suggested change
I don't think the other part is correct:
|
||||||
| attributes: | ||||||
| - id: enduser.id | ||||||
|
There was a problem hiding this comment. It seems confusing to set https://github.com/open-telemetry/semantic-conventions/pull/1146/files#r1712997369 and https://github.com/open-telemetry/semantic-conventions/pull/1146/files#r1710187141 It'd be more clear if we called this one There was a problem hiding this comment. per earlier discussion, it seemed that There was a problem hiding this comment. do you mean that There was a problem hiding this comment. some examples semantic-conventions/schemas/1.19.0 Line 32 in d5d2b9d nesting is used for There was a problem hiding this comment. @lmolkova @trisch-me Please review and fill in anything that i may have missed.:
There was a problem hiding this comment. I kind of like these three:
There was a problem hiding this comment. I attended Client SIG this morning, There was a problem hiding this comment. what were the cons for There was a problem hiding this comment. we have already discussed and agreed to have |
||||||
| type: string | ||||||
| deprecated: Replaced by `enduser.anonymous.id` attribute. | ||||||
| stability: experimental | ||||||
|
There was a problem hiding this comment. we use development now, let's change it here and in other non-deprecated attributes
Suggested change
|
||||||
| examples: ['QdH5CAWJgqVT4rOr0qtumf'] | ||||||
| brief: > | ||||||
| Deprecated, use `enduser.anonymous.id` instead. | ||||||
| - id: enduser.anonymous.id | ||||||
| type: string | ||||||
| stability: experimental | ||||||
| brief: > | ||||||
| Identifier of an anonymous end user who interacts with a system. | ||||||
| This identifier may be unique only through best-effort means and does not imply that the user is authenticated to the system. | ||||||
|
There was a problem hiding this comment. meeting notes from semantic convention SIG meeting today:
the recommendation for next steps was to discuss this in the Client SIG There was a problem hiding this comment. @heyams were those questions addressed during client sig meeting? There was a problem hiding this comment. yes, we kind of covered it. cc @MSNev There was a problem hiding this comment.
There was a problem hiding this comment. thanks! a couple of followup questions:
There was a problem hiding this comment. I believe we discussed these in the client SIG. I will wait for @MSNev's response. There was a problem hiding this comment.
No, not specifically as this really is just additional context details. There was a problem hiding this comment. I believe having a document covering I'm surprised we don't have any signals to populate these on. Wouldn't we add them on session events? If we're going to just stamp them on all telemetry items, let's document it as an attribute group - this would be the place to describe any additional guidance. This doc has to be updated anyway. I believe it should cover:
|
||||||
| examples: ['QdH5CAWJgqVT4rOr0qtumf'] | ||||||
| - id: enduser.role | ||||||
heyams marked this conversation as resolved.
Show resolved
Hide resolved
|
||||||
| type: string | ||||||
| deprecated: "Removed." | ||||||
| stability: experimental | ||||||
| brief: 'Actual/assumed role the client is making the request under extracted from token or application security context.' | ||||||
| examples: 'admin' | ||||||
| - id: enduser.scope | ||||||
heyams marked this conversation as resolved.
Show resolved
Hide resolved
|
||||||
| type: string | ||||||
| deprecated: "Removed." | ||||||
| stability: experimental | ||||||
| brief: > | ||||||
| Scopes or granted authorities the client currently possesses extracted from token | ||||||
| or application security context. The value would come from the scope associated | ||||||
| with an [OAuth 2.0 Access Token](https://tools.ietf.org/html/rfc6749#section-3.3) | ||||||
| or an attribute value in a [SAML 2.0 Assertion](http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html). | ||||||
| examples: 'read:message, write:files' | ||||||
| - id: enduser.authentication.id | ||||||
| type: string | ||||||
| brief: "Unique identifier of an authenticated user in the system." | ||||||
| examples: [ 'S-1-5-21-202424912787-2692429404-2351956786-1000' ] | ||||||
|
There was a problem hiding this comment. it seems to be an example of windows OS user (SID). Given that this attribute is intended to represent human identity, we should use a realistic example (login? email? guid?) Also, we should add a note that it's likely a PII. I have a proposal on how to capture it (until we have a formal way in #1707) |
||||||
| stability: experimental | ||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
we support unauthenticated users too, correct?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
yes,
enduse.pseudo.idcan be unauthenticated, unauthorized, anonymous, and etc.. as long as it's not authenticated, which is tracked underenduser.authentication.id.