Every Special Purpose Account (SPA) at UC Berkeley consists of two distinct records in our identity systems. Understanding the difference between the Account and the Group is essential for proper access control and group management.
- The Account: This is the CalNet account that logs in, has an email address, and owns files.
- The SPA Group: This is the list of people authorized to use that account.
Naming Conventions by System
To provide clarity when searching CalGroups, the Delegation Group is prefixed with group-, while the Account identity is prefixed with spa-.
| System | The Account (Identity) | The Delegation Group |
|---|---|---|
| CalGroups (Grouper) | spa-testname |
group-spa-testname |
| LDAP / CalNet ID | uid=spa-testname |
N/A (Group exists in ou=campus groups) |
| bConnected (Email) | testname@berkeley.edu |
N/A |
| Active Directory (AD) | N/A (SPAs are not in AD) | CN=group-spa-testname |
| CAS Login | spa-testname+YourID |
Grants the permission to log in |
Searching in CalGroups: Which record should I pick?
When you search for a SPA name within CalGroups (Grouper), you will see two items. It is important to choose the correct one based on your goal:
1. Choosing "SP_Account, [Name]"
This selects the Account itself. If you add this record to another group, you are making the SPA account a member of that group. You should do this if you want the SPA identity to have access to a specific resource (like a shared folder or application).
2. Choosing "group-spa-[name]"
This selects the SPA Group. If you add this record to another group, you are nesting the permissions. Everyone who is authorized to use the SPA will also inherit the permissions of the new group.
Technical Details for Developers
In LDAP, the SPA functions like a regular person account but includes the berkeleyEduSPAAdminGroup attribute. This attribute points to the DN of the Delegation Group. When a user authenticates via SSO (CAS), the system checks if the user is a member of the group listed in that attribute to determine if the login should be permitted.
Support: If you have questions about how your SPA is structured, contact the CalNet team at itcsshelp@berkeley.edu.