[Identity Pallet] Any account can be add as sub

[leonardocustodio]

Hello guys,

Not sure this is present in the current code but it is present in the current runtime at Polkadot and Kusama People.

Right now, when anyone wants to add a sub it can choose any account to do so. There is one check that will not let the person add an account that is already a sub of another account.

But, there is no check to add other accounts as sub. What I mean, is that I can add any parent account as my sub regardless if this account has an identity or not.

If this issue is still present, I believe there is two choices:

1. Don't allow accounts that have an identity (parent accounts) to be add as someone sub
2. Add something like acceptUsername that is used for the usernames, so, I suppose acceptSub

Regards,

[ggwpez]

You mean the issue is that an account can have two identities then? One self-set and one as sub? Ie:

• Alice sets identity Alice
• Bob sets identity Bob
• Bob sets Alice as sub Bob/hey
• Alice now has identity Alice and Bob/hey

Don't allow accounts that have an identity (parent accounts) to be add as someone sub

Then you could block someone from registering an identity by setting them to be your sub, or it would have to force-remove all subs when an identity is set (not ideal either).

Can we not just define a priority? Like saying that self-set identity always trumps sub identities?
I would like to avoid a two-way protocol where the other side has to opt-in, but that would be the most unambiguous.

[leonardocustodio]

I agree but giving another thought about the first option (don't allow identities to be sub), that would be an issue in the following case:

• An organization has an identity, possible its directors would have their identities on their wallets too. If the organization wants to set the directors as its subs, if we were going to this option, it would not allow it.

But yes, the issue is precisely that you can set anyone as your sub without an authorization. If you are an account without an identity or an account with an identity set, it doesn't matter, the extrinsic will always allow any account to be set as a sub of the signer account.

With the exception of other subs, if the account is a sub already, it will throw an error saying the account is already a sub of someone else. But having this verification only for subs and not for other "parent identities" doesn't seem to be ideal