Update enduser domain and add enduser.authentication.id
#1456
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| # Use this changelog template to create an entry for release notes. | ||
| # | ||
| # If your change doesn't affect end users you should instead start | ||
| # your pull request title with [chore] or use the "Skip Changelog" label. | ||
|
|
||
| # One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix' | ||
| change_type: enhancement | ||
|
|
||
| # The name of the area of concern in the attributes-registry, (e.g. http, cloud, db) | ||
| component: enduser | ||
|
|
||
| # A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`). | ||
| note: introduce new attribute `enduser.authentication.id`, replace `enduser.id` with `enduser.anonymous.id`, and deprecate `enduser.authentication.role`, and `enduser.authentication.scope`. | ||
|
|
||
| # Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists. | ||
| # The values here must be integers. | ||
| issues: [1104] | ||
|
|
||
| # (Optional) One or more lines of additional information to render under the primary note. | ||
| # These lines will be padded with 2 spaces and then inserted directly into the document. | ||
| # Use pipe (|) for multiline entries. | ||
| subtext: | | ||
| The new attribute `enduser.authentication.id` is intended to provide an unique identifier of an authenticated enduser. | ||
| The deprecated attributes `enduser.authentication.role` and `enduser.authentication.scope` are removed from the enduser registry. |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| groups: | ||
| - id: identity | ||
| type: attribute_group | ||
| brief: > | ||
| These attributes may be used for any operation with an authenticated and/or authorized enduser. | ||
| attributes: | ||
| - ref: enduser.id | ||
| deprecated: Replaced by `enduser.anonymous.id` attribute. | ||
| requirement_level: recommended | ||
| - ref: enduser.anonymous.id | ||
| requirement_level: recommended | ||
| - ref: enduser.role | ||
| deprecated: "Removed." | ||
| requirement_level: recommended | ||
| - ref: enduser.scope | ||
| deprecated: "Removed." | ||
| requirement_level: recommended | ||
| - ref: enduser.authentication.id | ||
| requirement_level: required | ||
| note: > | ||
| The `enduser.authentication.id` attribute is intended to provide an unique identifier of an authenticated enduser. | ||
| The deprecated attributes `enduser.authentication.role` and `enduser.authentication.scope` are removed from the enduser registry. | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| groups: | ||
| - id: registry.enduser | ||
| type: attribute_group | ||
| display_name: End User Attributes | ||
| brief: > | ||
| Describes information about the end user, which can be used as a subdomain of browser, client, or user domains. | ||
| attributes: | ||
| - id: enduser.id | ||
|
There was a problem hiding this comment. It seems confusing to set https://github.com/open-telemetry/semantic-conventions/pull/1146/files#r1712997369 and https://github.com/open-telemetry/semantic-conventions/pull/1146/files#r1710187141 It'd be more clear if we called this one There was a problem hiding this comment. per earlier discussion, it seemed that There was a problem hiding this comment. do you mean that There was a problem hiding this comment. some examples semantic-conventions/schemas/1.19.0 Line 32 in d5d2b9d nesting is used for There was a problem hiding this comment. @lmolkova @trisch-me Please review and fill in anything that i may have missed.:
There was a problem hiding this comment. I kind of like these three:
There was a problem hiding this comment. I attended Client SIG this morning, There was a problem hiding this comment. what were the cons for There was a problem hiding this comment. we have already discussed and agreed to have |
||
| type: string | ||
| deprecated: Replaced by `enduser.anonymous.id` attribute. | ||
| stability: experimental | ||
| examples: ['QdH5CAWJgqVT4rOr0qtumf'] | ||
| brief: > | ||
| Deprecated, use `enduser.anonymous.id` instead. | ||
| - id: enduser.anonymous.id | ||
| type: string | ||
| stability: experimental | ||
| brief: > | ||
| Identifier of an anonymous end user who interacts with a system. | ||
| This identifier may be unique only through best-effort means and does not imply that the user is authenticated to the system. | ||
|
There was a problem hiding this comment. meeting notes from semantic convention SIG meeting today:
the recommendation for next steps was to discuss this in the Client SIG There was a problem hiding this comment. @heyams were those questions addressed during client sig meeting? There was a problem hiding this comment. yes, we kind of covered it. cc @MSNev There was a problem hiding this comment.
There was a problem hiding this comment. thanks! a couple of followup questions:
There was a problem hiding this comment. I believe we discussed these in the client SIG. I will wait for @MSNev's response. There was a problem hiding this comment.
No, not specifically as this really is just additional context details. There was a problem hiding this comment. I believe having a document covering I'm surprised we don't have any signals to populate these on. Wouldn't we add them on session events? If we're going to just stamp them on all telemetry items, let's document it as an attribute group - this would be the place to describe any additional guidance. This doc has to be updated anyway. I believe it should cover:
|
||
| examples: ['QdH5CAWJgqVT4rOr0qtumf'] | ||
| - id: enduser.role | ||
heyams marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| type: string | ||
| deprecated: "Removed." | ||
| stability: experimental | ||
| brief: 'Actual/assumed role the client is making the request under extracted from token or application security context.' | ||
| examples: 'admin' | ||
| - id: enduser.scope | ||
heyams marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| type: string | ||
| deprecated: "Removed." | ||
| stability: experimental | ||
| brief: > | ||
| Scopes or granted authorities the client currently possesses extracted from token | ||
| or application security context. The value would come from the scope associated | ||
| with an [OAuth 2.0 Access Token](https://tools.ietf.org/html/rfc6749#section-3.3) | ||
| or an attribute value in a [SAML 2.0 Assertion](http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html). | ||
| examples: 'read:message, write:files' | ||
| - id: enduser.authentication.id | ||
| type: string | ||
| brief: "Unique identifier of an authenticated user in the system." | ||
| examples: [ 'S-1-5-21-202424912787-2692429404-2351956786-1000' ] | ||
| stability: experimental | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I was thinking that
enduser.idwould be the normal (authenticated) user id, do I remember that correctly? thanksThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
#1456 (comment)
we decided to use
enduser.authentication.idfor the authenticated user id since the beginning of this discussion.renaming
enduser.idto something specific (likeenduser.pseudo.id) so that user don't put authenticated user id under this attribute.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
can you summarize the reason for using
enduser.authentication.idinstead ofenduser.id?does this mean we will prohibit future "embedding" of
user.idinto theenduser.*namespace? or will we have 3 "id" attributes includingenduser.id?