From 3e78cd070538d1ef32ee6b95e8fa0ceeed0ae786 Mon Sep 17 00:00:00 2001 From: ebner Date: Thu, 5 Mar 2026 13:08:39 +0100 Subject: [PATCH] Update docs/engineering-guide/accounts-and-groups.md --- docs/engineering-guide/accounts-and-groups.md | 28 ++++++++----------- 1 file changed, 12 insertions(+), 16 deletions(-) diff --git a/docs/engineering-guide/accounts-and-groups.md b/docs/engineering-guide/accounts-and-groups.md index 016c680d..53abae84 100644 --- a/docs/engineering-guide/accounts-and-groups.md +++ b/docs/engineering-guide/accounts-and-groups.md @@ -7,17 +7,16 @@ Linux accounts are generally stored and managed in Active Directory. There are several types of accounts, which are usually indicated by a prefix or suffix: -- Normal accounts. No prefix or suffix. Older accounts are just last - names, newer accounts are LASTNAME_X, where X is the first letter of - the given name. -- Global accounts (or gac-accounts). These have a `gac-` prefix. These are shared accounts where several people know the password. Note that some global accounts were originially experiment accounts and share the properties of experiment accounts -- Administrator accounts. Marked with an `-adm` suffix. -- External users. These start with an `ext-` prefix and are provided - to external users, ie. those who are not PSI employees. -- Experiment accounts (or e-accounts). These start with `e` followed by the uid (+ some global accounts which where renamed later). - These are managed by the [Digital User Office (DUO)](https://duo.psi.ch). - The password is shared by all users involved in the experiment. -- Service accounts. These come with an `svcusr-` prefix and are used for running services. +- __Normal Account__ - No prefix or suffix. Older accounts are just last names, newer accounts are LASTNAME_X, where X is the first letter of the given name. +- __Global Account (gac-accounts)__ - These have a `gac-` prefix. These are shared accounts where several people know the password. Note that some global accounts were originially experiment accounts and share the properties of experiment accounts + +!!! warning + GAC accounts __must not__ be used for administrative tasks (also see: AW-95-17-02 Logical Access Control). Therefore membership in groups granting such privilidges is not permitted. + +- __Administrator Account__ - Marked with an `-adm` suffix. +- __External Users__ - These accounts start with an `ext-` prefix and are provided to external users, ie. those who are not PSI employees. +- __Experiment Account (e-accounts)__ - These start with `e` followed by the uid (+ some global accounts which where renamed later). These are managed by the [Digital User Office (DUO)](https://duo.psi.ch). The password is shared by all users involved in the experiment. +- __Service Account__ - These come with an `svcusr-` prefix and are used for running services. Official documentation on PSI IT account naming convention can be found [here](https://psi.service-now.com/psisp?sys_kb_id=c498a3cb1bff68502c5940498b4bcb44&id=kb_article_view&sysparm_rank=1&sysparm_tsqueryId=4877d78687cc1d10bc150d830cbb3540) @@ -35,12 +34,9 @@ To be able to easily distinguish between the different account types, a user sha The passwords for all these users are found in the [Shared Core Linux Secret Store](https://gitea.psi.ch/lx/core-linux-secrets), except for `e22284` which is found in the [PSI e-account Password Manager](https://epwd.psi.ch/cred/detail/18556/). -```{note} -unx-lx_ext_users - this group does not yet contain all ext accounts (only the ones that are currently in the scope of IAM - this should be fixed by end of January 2025 -``` +!!! note + unx-lx_ext_users - this group does not yet contain all ext accounts (only the ones that are currently in the scope of IAM -### Policies -GAC accounts __must not__ be used for administrative tasks (also see: AW-95-17-02 Logical Access Control). Therefore membership in groups granting such privilidges is not permitted. ## UID Allocation