home.md

@@ -49,6 +49,24 @@ Cross-university access
 - gitlab: cross-university auth
 - same recommended tools: eg communication tools (Microsoft Teams)
 
+### Cross-uni authentication
+
+Discussion with Mike Andrews on 28/11/2020:
+
+> @Alex Beech is probably better able to answer.  Wherever possible, if a user has UWE AD domain account, then we prefer if we use those accounts to sign-in even if they prefer to use a BRL account.  If an external user has a temporary UWE AD account, then that would be preferable.   These actions require no specific action on our part to set them up.  
+> 
+> There is also a UWE guest account feature of Azure AD, but I'm not sure how that works.
+> 
+> Alongside the UWE AD tenancy, there is also the BRL AD tenancy, which you and UoB people have an account.  As far as I'm aware, we don't include that Microsoft organizational unit into the LDAP authentication performed by GitLab.  Possibly it could be included.
+> 
+> Alternatively a user can be set-up manually with a standalone account.  These are logged in IT Online, usually handled by our Operations Bridge, and they or we refer to Mark Haley as your designated BRL GitLab administrator for verification if not clear from the trail of communications (e.g. that the requestor is a known BRL staff member).  
+> 
+> We don't allow external sign-ups to take place automatically as there are dangers involved with this.  
+> 
+> There probably is a need for a regular review of accounts given that standalone accounts won't be removed unlike UWE AD domain accounts if a staff or student member leaves.  Mark Haley has administrative access to do this, but admittedly it is a laborious task.  
+> 
+> There is also no official sign-up policy document which users must agree, so any rights and restrictions would be general ones resulting from NDA's, BRL policies and UWE policies.   GitLab has a feature (unused) to include these sign-up terms.
+
 Linux support
 -------------