Organisation IDs in registry metadata are not unique

[andylolz]

For example, publishers simone_sympany and humana_houben both use the same organisation identifier

Same issue raised here: https://github.com/codeforIATI/iati-data-bugtracker/issues/19

…and mentioned here: https://github.com/IATI/ckanext-iati/issues/128#issuecomment-317987006

Organisation IDs on the registry not being unique is a problem, because it prevents them from being used as a key. #363 is a related problem.

---

Explanation of the issue

Publishers Sympany+ and Stichting Humana are both using org ID NL-KVK-30285304 in their registry metadata, and in their IATI data too.

URLs / screenshots

• http://iatiregistry.org/publisher/simone_sympany
• https://iatiregistry.org/publisher/humana_houben

[andreaszenasidi]

@andylolz thanks for raising this. We couldn't get in touch with the publishers, unfortunately, thus we won't be able to amend their IATI org identifiers. Their data is quite old from 2015 and it's in version 1.03 and 2.01 therefore it should be a minimal impact on data users.

[andylolz]

Their data is quite old from 2015 and it's in version 1.03 and 2.01 therefore it should be a minimal impact on data users.

Okay, I have reworded the title of the issue to make it clearer what the more general problem is here. The specific example may not have much of an impact on data users, but the general problem affects tools that use IATI data.

[andreaszenasidi]

@andylolz thanks for making the change. I checked the current publishers and these two are the only ones at the moment that have duplicate IATI org ID's. Are you aware of other ones by any chance?

The Registry publisher registration form now includes a validation check and doesn't allow new publishers to reuse an existing org ID, thus this issue shouldn't occur again.

[andylolz]

Are you aware of other ones by any chance?

Nope, there aren’t any others.

The Registry publisher registration form now includes a validation check and doesn't allow new publishers to reuse an existing org ID, thus this issue shouldn't occur again.

Great to know that there’s validation on the form. I believe these values can also be modified via the API – is that right? If so, does the validation also apply there?

[andreaszenasidi]

@andylolz thanks for confirming that there aren't other duplicates. You are correct that you can create a new publisher or update an existing one via the API, but I don't know what checks are done for the Org ID field.

@gtkChop Could you please let us know if there is any validation done for the organization_create and organization_update endpoints _publisher_iatiid field to avoid duplications?

[andylolz]

Nice – I just tried via the API organization_patch endpoint, and got the following error messages:

IATI identifier already exists. Please verify if your organisation already has a publisher account.
Only system admin can change this publisher_iati_id for an active dataset.

So that is fine I think. (The wording of the second error message isn’t quite right since it isn’t a dataset, but it’s close enough.)

[ss-bhat]

Maybe these are the ones added before the validators. I can see the validators here

https://github.com/IATI/ckanext-iati/blob/master/ckanext/iati/plugins.py#L149

publisher_iati_id is supposed to be unique and there is a validation for the same.

[andreaszenasidi]

@gtkChop thank you for checking!