Intro

Applications wishing greater access must request credentials (authDN's), approved by unit head and campus data stewards, granting access to specific user populations and attributes. By default, applications can retrieve 1000 entries per search but that limit can be raised on a per-authDN basis.

Access for authdn's is specified my membership in groups which are defined along two orthogonal axes:

• groups that define which people one has access to
• groups that define which attributes one has access to

• UMCP & USMO employees and affiliates (but not hourly student employees)
• "normal" attributes
• "private" atttribute as allowed by the privacy flags

People Groups

Attribute Groups

"normal" attributes

These attributes are already defined as public access so every authDN automatically has access to them.

"critical" attributes

All attributes not listed above are considered to be critical and applications must be granted access to them. Most of these attribute have been collected into to sub-groups of related attributes for purposes of managing access. There are a few attributes that are not part of any group because:

1. they are application specific (umBSOSLabBalance, umLibraryBarCode)
2. they are especially sensitive with respect to identity theft (umId, umGender, umDateOfBirth)

Note that for the attributes in the address, phone, and email groups, access may already be granted via the default rules for authenticated access (e.g. telephoneNumber is treated asa public attribute for employees).