Update enduser domain and add enduser.authentication.id
#1456
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| # Use this changelog template to create an entry for release notes. | ||
| # | ||
| # If your change doesn't affect end users you should instead start | ||
| # your pull request title with [chore] or use the "Skip Changelog" label. | ||
|
|
||
| # One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix' | ||
| change_type: enhancement | ||
|
|
||
| # The name of the area of concern in the attributes-registry, (e.g. http, cloud, db) | ||
| component: enduser | ||
|
|
||
| # A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`). | ||
| note: introduce new attribute `enduser.authentication.id`, replace `enduser.id` with `enduser.pseudo.id`, and deprecate `enduser.authentication.role`, and `enduser.authentication.scope`. | ||
|
|
||
| # Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists. | ||
| # The values here must be integers. | ||
| issues: [1104] | ||
|
|
||
| # (Optional) One or more lines of additional information to render under the primary note. | ||
| # These lines will be padded with 2 spaces and then inserted directly into the document. | ||
| # Use pipe (|) for multiline entries. | ||
| subtext: | | ||
| The new attribute `enduser.authentication.id` is intended to provide an unique identifier of an authenticated enduser. | ||
| The deprecated attributes `enduser.authentication.role` and `enduser.authentication.scope` are removed from the enduser registry. |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -396,9 +396,13 @@ These attributes may be used for any operation with an authenticated and/or auth | |
|
|
||
| | Attribute | Type | Description | Examples | [Requirement Level](https://opentelemetry.io/docs/specs/semconv/general/attribute-requirement-level/) | Stability | | ||
| |---|---|---|---|---|---| | ||
| | [`enduser.authentication.id`](/docs/attributes-registry/enduser.md) | string | Unique identifier of an authenticated user in the system. [1] | `S-1-5-21-202424912787-2692429404-2351956786-1000` | `Required` |  | | ||
| | [`enduser.id`](/docs/attributes-registry/enduser.md) | string | Deprecated, use `enduser.pseudo.id` instead. | `QdH5CAWJgqVT4rOr0qtumf` | `Recommended` | <br>Replaced by `enduser.pseudo.id` attribute. | | ||
| | [`enduser.pseudo.id`](/docs/attributes-registry/enduser.md) | string | Pseudonymous identifier of an end user. This identifier is unique to the user but does not reveal their actual identity. | `QdH5CAWJgqVT4rOr0qtumf` | `Recommended` |  | | ||
| | [`enduser.role`](/docs/attributes-registry/enduser.md) | string | Actual/assumed role the client is making the request under extracted from token or application security context. | `admin` | `Recommended` | <br>Removed. | | ||
| | [`enduser.scope`](/docs/attributes-registry/enduser.md) | string | Scopes or granted authorities the client currently possesses extracted from token or application security context. The value would come from the scope associated with an [OAuth 2.0 Access Token](https://tools.ietf.org/html/rfc6749#section-3.3) or an attribute value in a [SAML 2.0 Assertion](http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html). | `read:message, write:files` | `Recommended` | <br>Removed. | | ||
|
|
||
| **[1] `enduser.authentication.id`:** The `enduser.authentication.id` attribute is intended to provide an unique identifier of an authenticated enduser. The deprecated attributes `enduser.authentication.role` and `enduser.authentication.scope` are removed from the enduser registry. | ||
|
|
||
| <!-- markdownlint-restore --> | ||
| <!-- prettier-ignore-end --> | ||
|
|
@@ -410,34 +414,7 @@ system. It is expected this information would be propagated unchanged from node- | |
| using the Baggage mechanism. These attributes should not be used to record system-to-system | ||
| authentication attributes. | ||
|
|
||
| `enduser.pseudo.id` attribute can be set by a specific client component, e.g. through a cookie out of the Span's HTTP request headers. Client side application should be able to stamp this attribute on any telemetry item emitted by the application whenever this cookie is available. | ||
|
There was a problem hiding this comment. @lmolkova please let me know your thoughts on this statement. There was a problem hiding this comment. I don't know if my suggestion is factually correct - please adjust it, but I'd phrase it differently - something along the following lines:
I would also put it above the table. I think it should also replace the content of lines 413-415 above
|
||
|
|
||
| ## General thread attributes | ||
|
|
||
|
|
||
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,22 @@ | ||||||
| groups: | ||||||
| - id: identity | ||||||
| type: attribute_group | ||||||
| brief: > | ||||||
| These attributes may be used for any operation with an authenticated and/or authorized enduser. | ||||||
|
There was a problem hiding this comment.
Suggested change
we support unauthenticated users too, correct? There was a problem hiding this comment. yes, |
||||||
| attributes: | ||||||
| - ref: enduser.id | ||||||
| deprecated: Replaced by `enduser.pseudo.id` attribute. | ||||||
| requirement_level: recommended | ||||||
| - ref: enduser.pseudo.id | ||||||
| requirement_level: recommended | ||||||
| - ref: enduser.role | ||||||
|
There was a problem hiding this comment. please remove it from this group - it's listed as deprecated attribute and is not necessary here |
||||||
| deprecated: "Removed." | ||||||
| requirement_level: recommended | ||||||
| - ref: enduser.scope | ||||||
|
There was a problem hiding this comment. same here, please remove the reference |
||||||
| deprecated: "Removed." | ||||||
| requirement_level: recommended | ||||||
| - ref: enduser.authentication.id | ||||||
| requirement_level: required | ||||||
|
There was a problem hiding this comment. I don't think it can be required since it's likely to contain PII |
||||||
| note: > | ||||||
| The `enduser.authentication.id` attribute is intended to provide an unique identifier of an authenticated enduser. | ||||||
| The deprecated attributes `enduser.authentication.role` and `enduser.authentication.scope` are removed from the enduser registry. | ||||||
|
Comment on lines
+18
to
+22
There was a problem hiding this comment. I was thinking that There was a problem hiding this comment. #1456 (comment) renaming There was a problem hiding this comment. can you summarize the reason for using does this mean we will prohibit future "embedding" of There was a problem hiding this comment. we decided to have a sub-namespace called authentication so that we can add other attributes to do with authentication in the future. There was a problem hiding this comment.
I don't see any discussion around it or some motivation to introduce The There was a problem hiding this comment. that was the 1st thing i did on this long-discussed thread. There was a problem hiding this comment. but this PR is based on that PR. There was a problem hiding this comment.
Suggested change
I don't think that's accurate and also there is no need to mention changes in yaml that have no effect on markdown. |
||||||
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -2,23 +2,27 @@ groups: | |||||
| - id: registry.enduser.deprecated | ||||||
| type: attribute_group | ||||||
| display_name: Deprecated End User Attributes | ||||||
| brief: "Describes deprecated end user attributes." | ||||||
|
There was a problem hiding this comment.
Suggested change
|
||||||
| attributes: | ||||||
| - id: enduser.id | ||||||
| type: string | ||||||
| brief: 'Deprecated, use `enduser.pseudo.id` instead.' | ||||||
|
There was a problem hiding this comment. I believe There was a problem hiding this comment. the main reason we came up with There was a problem hiding this comment. the ask is to keep There was a problem hiding this comment. that wasn't what we discussed though. what about the sub-namespace authentication? i thought that is what we want to do so that any other attributes associated with if you want to change it now, that will be different. we would need to re-discuss it. i thought the consensus is to have authentication sub namespace. There was a problem hiding this comment. #1104 (comment) it was from you @lmolkova There was a problem hiding this comment. it's been under the assumption that we use
It seems at least me and @trask are on the same page to use Please make the change and if anyone has objections they will be able to comment and provide reasoning. |
||||||
| stability: experimental | ||||||
| deprecated: "Replaced by `enduser.pseudo.id`." | ||||||
| examples: ['QdH5CAWJgqVT4rOr0qtumf'] | ||||||
|
There was a problem hiding this comment. please bring the old example back |
||||||
| - id: enduser.role | ||||||
| type: string | ||||||
| deprecated: "Removed." | ||||||
| stability: experimental | ||||||
| brief: 'Actual/assumed role the client is making the request under extracted from token or application security context.' | ||||||
| examples: 'admin' | ||||||
| - id: enduser.scope | ||||||
| type: string | ||||||
| deprecated: "Removed." | ||||||
| stability: experimental | ||||||
| brief: > | ||||||
| Scopes or granted authorities the client currently possesses extracted from token | ||||||
|
There was a problem hiding this comment. is there a need to change it? This attribute is deprecated. |
||||||
| or application security context. The value would come from the scope associated | ||||||
| with an [OAuth 2.0 Access Token](https://tools.ietf.org/html/rfc6749#section-3.3) | ||||||
| or an attribute value in a [SAML 2.0 Assertion](http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html). | ||||||
| examples: 'read:message, write:files' | ||||||
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,18 @@ | ||||||
| groups: | ||||||
| - id: registry.enduser | ||||||
| type: attribute_group | ||||||
| display_name: End User Attributes | ||||||
| brief: > | ||||||
| Describes information about the end user, which can be used as a subdomain of browser, client, or user domains. | ||||||
|
There was a problem hiding this comment.
Suggested change
I don't think the other part is correct:
|
||||||
| attributes: | ||||||
| - id: enduser.pseudo.id | ||||||
| type: string | ||||||
| stability: experimental | ||||||
|
There was a problem hiding this comment. we use development now, let's change it here and in other non-deprecated attributes
Suggested change
|
||||||
| brief: > | ||||||
| Pseudonymous identifier of an end user. This identifier is unique to the user but does not reveal their actual identity. | ||||||
| examples: ['QdH5CAWJgqVT4rOr0qtumf'] | ||||||
| - id: enduser.authentication.id | ||||||
| type: string | ||||||
| brief: "Unique identifier of an authenticated user in the system." | ||||||
| examples: [ 'S-1-5-21-202424912787-2692429404-2351956786-1000' ] | ||||||
|
There was a problem hiding this comment. it seems to be an example of windows OS user (SID). Given that this attribute is intended to represent human identity, we should use a realistic example (login? email? guid?) Also, we should add a note that it's likely a PII. I have a proposal on how to capture it (until we have a formal way in #1707) |
||||||
| stability: experimental | ||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I would prefer to keep this table - it actually explains what the
enduser.idis - we don't provide an explanation like this anymore. Is this information still accurate and can it be used to captureenduser.id?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
enduser.idhas been replaced with 'enduser.pseudo.id`. i don't think it makes sense to keep it.