eids permissioning scheme

[jdwieland8282]

Type of issue

feature request

Description

Do Publishers need additional controls for determining which user ids go to which bid adapters?  Publishers can currently control what User id modules they deploy and which bid adapters they integrate with.  Are their scenarios where a publisher would deploy a user id module but decide NOT to send the resulting user id to a bid adapter they've integrated with? If we believe there are then a permissioning structure in the eids config is needed. 

Proposed Structure

pbjs.setConfig({
    userSync: {
        userIds: [{
            name: "MODULE NAME",
            **bidders: ['bidderA', 'bidderB'], // new permissions field. This ID can only go to these bidders.**
            params: {
                ...
            }
        }]
    }
});

OpenRTB support

{
    ext: {
        prebid: {
            data: {
                bidders: ['bidderA','bidderB']
            }
        }
    }
}

[bretg]

Implications for PBJS:

• something would need to modify the bidRequest object before going to each bidder.
• unclear whether this is PBJS-core or perhaps its just done through a hook in the UserId module itself

Implications for Prebid Server:

• Since pubs can define that some eids are global, while other eids are bidder-specific, we'll need to extend the permissioning scheme.

Solution: put eids permissions alongside FPD permissions. e.g.

{
    ext: {
        prebid: {
            data: {
                eidpermissions: [   // prebid server will use this to filter user.ext.eids
                   {"source": "sharedid.org", "bidders": ["*"]},
                   {"source": "neustar.biz", "bidders": ["bidderB"]},
                   {"source": "id5-sync.com", "bidders": ["bidderA","bidderC"]}
                ]
            }
        }
    }
}

The question is: who's going to create this eidspermissions block? The pbsBidAdapter can't do it alone because getConfig({userSync.userIds}) provides module name not eids.source.

I'll get the Prebid Server team building the server-side code to support eidspermissions while the PBJS team figures out how to get the data into openrtb. Note that Prebid Server will assume the default permission is "*" if a source isn't specified.

Note that the pbsBidAdapter should only include bidders that are server-side bidders. It will ignore unknown bidders with a warning.

[bretg]

Updated openrtb spec

[gglas]

@jdwieland8282 we think this issue is closed, please let us know if any reason to reopen.