@soaproot Well, the size of SGMC doesn't matter here. It's just about the arrangement of authenticated and authorized customer entities they offer in their online service.
@soaproot This is technically RBAC, sure, but the trouble is that RBAC sort-of-kind-of implies assigning a user to (one or more) roles within one over-arching organization. Like, you're employed by Soulless Global MegaCorp Inc, and when you log on to the corporate network, you have certain access permisions due to having certain roles within SGMC, Inc.
PAMT is a little bit different because there isn't one authority granting the roles. The user is associated with different organizations, each of whom has their *own* organizational account within the service provider (whether that org account has its own dedicated login account or not doesn't matter), and each of those orgs might assign that user a role within their org's "area" or "domain" (or whatever you want to call it) within that service provider.
I feel like if I say "RBAC" to someone who is entirely familiar with RBAC, they're not necessarily going to think of PAMT. It's sufficiently different to need its own label.
@lightweight Ah, you've just been having better luck than we had, okay. I'm glad! I just wish I knew how to replicate your success. The suggestion to test with mail-tester.com (made in your follow-up reply) is helpful -- thank you.
@bignose Sure, that describes the feature. I'm looking for the label, not the description, though. Not every service supports this way of working. For those that do, I want to be able to say, for example, "Oh, Digital Ocean supports PAMT" or "FooBar Inc doesn't do PAMT, so you just have to use a role account."
@lightweight The big question is deliverability. When I've tried this, I've ended up spending lots of time trying to convince -- sometimes successfully, sometimes not -- large providers that the emails coming from our service were not spam (which they 100% were not, by the way). The burden of those interactions was very high, but the price of not engaging in them was that our users could not send email to anyone with, e.g., a Hotmail address.
How did you solve this? Or do you not have this problem? Or do you have it but tolerate it?
We knew about SPF/DKIM/DMARC, and AFAIK implemented everything correctly. I'm sure that helped -- our delivery rates would have been much worse without that. But still, some providers are just eager to reject, and yet sometimes people you want to reach are using those providers.
Some online services handle the "multiple users per organization && multiple organizations per user" situation in the following way:
A user logs in with their individual account and then chooses (typically from a menu in the upper right) which "team" they want want to currently be acting in. A team might correspond to a company, or to a department within a company, or whatever: it's some organization that the user is associated with. So instead of people logging in with a role account that represents the team, they log in as themselves and then "wear a cloak" that lets them act on the team's behalf (within whatever permissions the team admin has granted to that particular member). Naturally, a user can be associated with multiple teams, and those teams don't all have to know about each other -- maybe only the user knows them all.
Is there a name for this pattern? I'm going with "PAMT" ("Personal Account Multiple Teams") for now, but if there's already a widely-used term I'd like to know it.
I just saw a program I wrote 25 years ago, cvs2cl, referenced as an optional dependency by Gource, which is itself not young but which happened to be on the front page of Hacker News today for some reason.
And the Gource documentation doesn't even need to link to cvs2cl's home page, because it can assume that cvs2cl is available in your OS distribution's packaging system (which it is, if you're on any of the major distributions).
Warms the cockles of my hearty-heart-heart on a cold January day.
@tlariv@evan@tlariv@evan Quite right. The imaginary unit i had not been invented yet, and therefore did not exist.
Embed this noticeKarl Fogel (kfogel@kfogel.org)'s status on Wednesday, 01-Jan-2025 02:48:18 JST
Karl FogelThese days, whatever I'm doing, I just automatically ask myself whether I should be using SQLite. Opening a jar of pickles with a tough-to-turn lid? We've all been there -- try SQLite! Retrieving a ball that rolled under the couch? Sounds like a job for SQLite. Car engine running a little low on coolant? It wouldn't be doing that if the manufacturer had used SQLite...
@serge@johanneskastl That's interesting, that you think of useradd as the canonical one! I keep a reminder to myself about defaulting to adduser, because I can never remember which is which, but now I think maybe my reminder oversimplifies things.
@carlmalamud Oh that. Yeah, I heard about it. I just assumed that the intersection of "people who donate to Wikipedia" and "people who listen to Elon Musk" is the empty set.
@carlmalamud Ok, but I still didn't know what memo I missed. (Of course, given that I've pretty clearly signaled that I don't have an open mind regarding what that memo is apparently saying, perhaps it doesn't matter that I remain otherwise unfamiliar with it!)
Home page: http://red-bean.com/kfogel/Fediverse: - @kfogel@kfogel.org (tweetidentitoots and such) - @kfogel@rants.org (my blog, also Fediverse-enabled)