Call for responses: proposal to remove expired roles from SDS

The Care Identity Service (CIS) maintains a database of users and their positions / roles at organisations. The entire history of positions is stored in 3 separate locations.

This proposal is to remove the data pertaining to closed roles from the directories (including SDS), and only maintain it in the CIS database. 

The effect on consuming systems would be that closed roles would no longer be available in the SDS data available to suppliers via the LDAP API. 

This would provide benefits across the service, such as:

• reduced storage costs
• improved search response times
• reduction in issues due to excessively large numbers of child objects for certain users

Master data for CIS users is held in a database, and then synchronised across to the directories, including SDS.

The 'user tree' in the directories used for CIS1 and CIS2 Authentication contains 3 objects in its hierarchy:

• user
  • userOrg
    • userOrgRole

Out of these, only the user can be re-opened (by removing the end date of the object and setting the status).

Roles, which are derived from positions in Care Identity Management (previously the CIS1 application, URS), can only ever be closed (end date set) and cannot be re-opened. If a user is re-assigned the same position, then a new set of role objects are created. 

These old roles still exist in the directory, however, and use up valuable storage that could be reduced to lower costs and speed up backups and recovery times.

Additionally, removing these old objects will reduce index sizes, and the number of items returned in any search for a user and their roles, thus improving search response times. 

The master data for old and expired roles will still be available for audit purposes.

This notice is to canvas feedback on whether any downstream consumers of the SDS user data rely on this old data for any processes. 

If you believe that your application or service requires the data to include closed roles, then please email us detailing how you use the data, and what the impact of removing it from SDS would be.

Email [email protected] referencing the "Proposal to remove expired roles from SDS" in the subject.

Please let us have your response by the end of June 2024.