Usecase: Map identity to a user profile

[servilla]

Allow a user to map multiple identities to the same profile.

Story: User/Group Management and Microsoft SSO #3

Goal:
Allow a user to map multiple authentication identities to a single PASTA user profile.

Actors:

1. User
2. System

Prerequisites:

1. User "A" profile exists in the system and has relationship with identity "A".
2. User "A" has never authenticated to system with identity "B".
3. Identity "A" and identity "B" are for the same user.

Actions:

1. User "A" authenticates into system with identity "A".
2. User "A" selects "manage user profile" menu.
3. System displays "manage user profile" menu items.
4. User "A" selects "map identity" menu item.
5. System requests User "A" to authenticate with identity "B".
6. User "A" authenticates using identity "B".
7. Auth returns affirmation of authentication with identity "B".
8. System creates and stores identity "B" (UID of identity assertion) in authentication record.
9. System creates relationship between identity "B" and user profile "A".

Alternate 1:

Prerequisites:

1. User "A" exists in the system and has relationship with identity "A".
2. User "B" exists in the system and has relationship with identity "B".
3. Identity "A" and identity "B" are for the same user.

Actions:

1. User "A" authenticates into system with identity "A".
2. User "A" selects "map identity" menu item.
3. System requests User "A" to authenticate with identity "B".
4. User "A" authenticates using identity "B".
5. Auth returns affirmation of authentication with identity "B".
6. System finds authentication record of identity "B" (UID of identity assertion).
7. System finds relationship between identity "B" and user profile "B".
8. System alerts user that mapping identity "B" to user profile "A" will remove user profile "B" from system.
9. User confirms mapping.
10. System creates relationship between identity "B" and user profile "A".
11. System removes user profile "B".

Notes:

1. Creating a user profile will likely include storing user and authentication information, and storing each set of information in a database table makes the most sense. There is an expectation that an individual will have the opportunity to authenticate with multiple IdPs and will want the same user profile to be active regardless of IdP used to authenticate. It is, therefore, reasonable to have a relationship cardinality of many auth entries to one user profile entry.
2. An authentication identity can only be mapped to one user profile at a time.

Mockups: