Grouper Developers Forum

[Chris Hyzer <>]

The UPDATE privilege on the attributeDef means you can assign it (well, you 
might need more, but at least that).  If you think we only need READ, then 
you and I need to discuss on the phone so we can get on the same page.

 
> The analog for a stem of ADMIN for a group is STEM. Like my rationale 
> for groups, for the time being perhaps just let those with STEM who can 
> READ an attribute assign it to the stem.

Per our discussion on the dev call with Shilen, any stem STEMMER or CREATOR 
can assign an attribute (they can UPDATE)

> 
> > Members
> > 
> > - read attribute
> >   - read attribute
> > 
> > - assign attribute
> >   - wheel or root? and update attribute
> 
> Wheel sounds right, at least for now. I don't see the need for UPDATE on 
> the attribute here.

I think we need a group for this that you specify in grouper.properties (or 
wheel)...  lets see if I get to it.  Someone will want to use member 
attributes who is not wheel...

> > - assign the attribute
> >   - update the underlying assignment? (follow the above rules), and 
> > update the attribute
> 
> Is "this assignment expires next Wednesday" an example of an assignment 
> on an attribute assignment? What's a better example, to help guide our 
> thinking about this?

Yeah, or, e.g. for a permission you assign to a person in a role (membership 
attribute), but you want to say that permission is only for a certain time of 
day, from a certain ip range, on certain slices of the data, etc.

Anyways, this needs to get resolved at latest by the end of the next dev 
meeting.  If you want to discuss earlier, send me your available so we can 
talk on the phone.

Thanks,
Chris