User identification and authorization

With the exception of publicly available content, access to UPB resources is granted through specific access credentials. The basic principle for creating user accounts for access to UPB’s technological infrastructures takes into account the user’s profile as well as the resource and/or service they need to access, also bearing in mind that UPB, as an Identity provider, is responsible for supplying reliable and accurate identity assertions to its own services and those of third parties, making it essential to guarantee a process for assigning credentials with a high degree of reliability and security, forcing greater accountability on those involved in the whole process. Users with a contractual or occasional link are eligible for access accounts to resources, and the person responsible for assigning the account is responsible for identifying the individual, ensuring that there is a legitimate reason and clearly distinguishing between the types of identity registered in the systems (users, generic, non-human accounts, etc.). In the process of assigning identity to users, UPB collects at least the following data: name, email address and institutional identification number of the holder. The accounts associated with a user are always accompanied by an expiry date appropriate to the profile and reason justifying their creation, which constitutes the right of access, being aligned at the maximum limit with the terminus of the link or reason for creation. User accounts are created by those responsible for UPB’s technological infrastructures within the scope of their duties. In cases where access to resources by a user requires authorization, this must be duly justified so that it takes into consideration the profile and functions, and will be granted by the Institution entity responsible for the service. Thus, in addition to the situations identified above, temporary user accounts with limited permissions may be created to access wireless networks and other electronic services displayed on the Internet. Authorization to access resources implies express acceptance of this policy, and remains valid for as long as the right of access persists. It may be suspended or canceled in the event of non-compliance or for security reasons. The authorizations granted are personal and non-transferable, and it is up to the user to maintain the confidentiality and protection of the credentials assigned to them.