Grouper Developers Forum

[Chris Hyzer <>]

No, UPDATE means assign.  ADMIN means rename, and edit properties.

 

Similar to groups.  UPDATE means change membership, but you cant rename it or change metadata or whatever

 

From: John Gasper [mailto:]
Sent: Monday, October 19, 2015 2:04 PM
To: Chris Hyzer;
Subject: Re: [grouper-dev] RE: Assigning attribute value requires Def Update priv?

 

Hi Chris,

 

I guess I don’t follow…

 

If I have attributeDef "etc:attribute:myDef", and I want users to be able to assign it to their groups, I’d think that I’d grant them “view” or maybe “read”. Wouldn’t “update” allow them to change the underlying properties of the attributeDef… the name, the type, multi-value, etc??

 

Thanks.

 

-- 

John Gasper
IAM Consultant
Unicon, Inc.
PGP/GPG Key: 0xbafee3ef

 

 

From: <> on behalf of Chris Hyzer <>
Date: Friday, October 16, 2015 at 3:19 PM
To: John Gasper <>, "" <>
Subject: [grouper-dev] RE: Assigning attribute value requires Def Update priv?

 

Yes.  You don’t want any user to be able to assign any attribute to objects they own right?  J  if so for an attribute assign grouperAll to update of that AttributeDef.  Ok?  J

 

Thanks,

Chris

 

From: [] On Behalf Of John Gasper
Sent: Friday, October 16, 2015 5:54 PM
To:
Subject: [grouper-dev] Assigning attribute value requires Def Update priv?

 

Hi Devs,

 

I’ve got some code that assigns a value to an attribute on a group. It appears that Grouper requires that the user has Update on the AttributeDef/Name in order to add a value (and likely adding the attribute def/name to the target Group for the initial invocation). Here’s the trace…

 

edu.internet2.middleware.grouper.exception.InsufficientPrivilegeException: Subject Subject id: jsmith, sourceId: ldap cannot update attributeDef etc:attribute:provisioningTargets:google:googleProvisioningTargetDef,

Problem calling method groupEditAttributesSubmit on edu.internet2.middleware.grouper.grouperUi.serviceLogic.UiV2GroupProvisioningTarget

        at edu.internet2.middleware.grouper.attr.assign.AttributeAssignGroupDelegate.assertCanUpdateAttributeDefName(AttributeAssignGroupDelegate.java:129)

        at edu.internet2.middleware.grouper.attr.assign.AttributeAssignBaseDelegate.internal_assignAttributeHelper(AttributeAssignBaseDelegate.java:488)

        at edu.internet2.middleware.grouper.attr.assign.AttributeAssignBaseDelegate.assignAttribute(AttributeAssignBaseDelegate.java:466)

        at edu.internet2.middleware.grouper.attr.assign.AttributeAssignBaseDelegate.assignAttribute(AttributeAssignBaseDelegate.java:455)

        at edu.internet2.middleware.grouper.attr.assign.AttributeAssignBaseDelegate.assignAttributeByName(AttributeAssignBaseDelegate.java:548)

        at edu.internet2.middleware.grouper.attr.assign.AttributeAssignBaseDelegate.assignAttributeByName(AttributeAssignBaseDelegate.java:183)

        at edu.internet2.middleware.grouper.attr.value.AttributeValueDelegate.assignValue(AttributeValueDelegate.java:71)

 

As soon as I assigned the Update priv to the Def it worked.

 

Does assigning an attributeDef/Name to a group require Update on the Attribute Def? Is that intended? 

 

-- 

John Gasper
IAM Consultant
Unicon, Inc.
PGP/GPG Key: 0xbafee3ef