bcgov / entity

ServiceBC Registry Team working on Legal Entities
Apache License 2.0
23 stars 58 forks source link

Spike: Business BCeID #22709

Open fionazhou-jsb opened 1 month ago

fionazhou-jsb commented 1 month ago

Background:

For a host application or platform application, users can log into SBC Connect account via BCSC or Business BCeID. An individual person or a business can register for a STR unit.

Currently, we do not ask individual host to input their first name and last name as we can get this information directly from BCSC/SBC account.


Objectives:

  1. If users login with Business BCeID, will we be able to get their first name and last name?
  2. If we can get this info, how reliable is it? Is the name verified just like the name from SBC/BCSC?
  3. If we cannot get this info, this would have design implications.

Approach:

Outline the steps that will be taken to conduct the Spike. The approach may be adjusted based on findings during the Spike.


PO Notes on Possible Solutions:

Provide guidance, suggestions, or leads that might help the team. This could include contacts (e.g., "Reach out to [Name] in [Department] for insight"), specific resources (e.g., "Check out the [API Name] documentation"), or any known constraints or considerations.


Acceptance Criteria:

  1. What should be achieved for the Spike to be considered complete?
  2. How will the information or solution be validated?

Outcome:


Assumptions:

List any assumptions that are made during the Spike.


Dependencies:

Identify any dependencies that may affect the Spike.


Resources Needed:


Connection to Product Goals:

Explain how this Spike connects to the broader product goals or sprint objectives.


Post-Spike Reflection:

How will the team reflect on what was learned and its impact on future work?


Additional Notes:

Any other relevant information.

Context: For hosts, they can use BCSC to login.

For platforms, they can login with BCSC or Business BCeID. Business BCeID is needed for international companies who don't have presence in BC or Canada. How will this flow look like?

The current design of platform registration form only reflects the flow when platform reps/employees use their BCSC to login. You can see from the screenshot that we pull the person's first and last name from BCSC so we don't need them to manually fill out the info. Can we pull the person's name if they login using Business BCeID, how reliable it is or we just ask them to fill out the field?

image.png
mbertucci commented 2 weeks ago

Where is the name currently coming from SBC Connect?

rstens commented 2 weeks ago

SSO delivers the following for Business BCeID: https://mvp.developer.gov.bc.ca/docs/default/component/css-docs/Identity-Provider-Attribute-Mapping

User Property/Attribute Standard Realm - Claim Name
Email email
Display Name display_name
Display Name given_name
Display Name name
BCeID Username bceid_username
BCeID User GUID bceid_user_guid
Keycloak Generated Preferred Username preferred_username
BCeID Business Guid bceid_business_guid
BCeID Business Name bceid_business_name

Additionally when signing up with SBC, users can add their own stuff.

fionazhou-jsb commented 2 weeks ago

Thank you @rstens. We will receive their given name for sure. What does Display name - name mean, is it family name? Does all the attributes transfer to SBC account and they can override it?

rstens commented 2 weeks ago

The left column is what comes from BCeID (Display Name is actually a field with multiple variables in there). The left column values are mapped to the right column values which are available for us to consume. _displayname is a combination of the given_name and the name.

Business BCeID goes through a few steps to approve: https://www.bceid.ca/register/business/getting_started/getting_started.aspx

I do not know if that improves the data quality as far as STRR is concerned.

When signing up for an SBC account, I saw that all information can be changed/added.

mbertucci commented 1 week ago

Thank you for the research on this I am going to move this to the backlog and we will address it after December 15th