grouper-users - [grouper-users] RE: Folder visibility
Please Wait...
grouper-users@internet2.edu
Subject: Grouper Users - Open Discussion List
List archive
- From: "Klug, Lawrence" <lklug@it.ucla.edu>
- To: "Klug, Lawrence" <lklug@it.ucla.edu>, Chris Hyzer <mchyzer@isc.upenn.edu>, "grouper-users@internet2.edu" <grouper-users@internet2.edu>
- Subject: [grouper-users] RE: Folder visibility
- Date: Wed, 23 May 2012 18:42:07 +0000
- Accept-language: en-US
Hi Chris, Do the properties file settings affect “EveryEntity” privileges? I modified grouper.properties as described in the thread below: groups.create.grant.all.read =
false groups.create.grant.all.view =
false Then deployed the UI to a test server. Observe that “EveyEntity” still has READ and VIEW privileges (see screen grab). Is this the expected behavior? Thanks, Lawrence From: grouper-users-request@internet2.edu [mailto:grouper-users-request@internet2.edu]
On Behalf Of Klug, Lawrence Chris, Thanks for the ideas. This may be enough to accomplish our use cases. Cheers, Lawrence From: Chris Hyzer
[mailto:mchyzer@isc.upenn.edu]
Did you try this in the UI, or are you asking us to try it?
J First of all you should probably set these in the grouper.properties: groups.create.grant.all.read =
false groups.create.grant.all.view =
false My guesses are: 1.
When Joe logs in, he will start at root, but he will see the Math Lab folder (if it is a top level folder), or if he clicks “manage” or “create” on the left he will see the folders where he has those
privileges. He could also bookmark the folder URL to start there each time 2.
He shouldn’t be able to see other folders where he doesn’t have objects inside that are relevant to him 3.
Grant READ on the org group to someone who needs it and they will only see that group/folder and not others Let me know if you need me to do an example or if you can try it and let me know what doesn’t work. Thanks, Chris From: Klug, Lawrence
[mailto:lklug@it.ucla.edu] Here are a couple of use cases we are thinking about. Is it possible to set up Grouper UI so that on login, the user lands on folder down the hierarchy? First use case: 1.
We assign a folder “Math Lab” to the Math Department and grant folder/group create permissions for the “Math Lab” folder to the Math Department Admin. “Joe.” 2.
When Joe logs in to Grouper – he lands on the “Math Lab” folder and begins creating folders and groups. 3.
Joe can’t see any of the folders/groups above the “Math Lab” folder. Is it possible to control folder visibility? Second Use case: 4.
Orgs hierarchy has been imported via Grouper loader group into a parallel “UCLA:Orgs” stem 5.
Joe doesn’t want to re-create the whole math department group so he asks for access to the Org stem 6.
We assign view/read rights for the Math dept org to Joe 7.
Joe is able to view the Math dept org and add memberships to his groups created in “Math Lab” folder 8.
Joe can’t see other folders in the org hierarchy that are outside the Math department. From:
grouper-users-request@internet2.edu [mailto:grouper-users-request@internet2.edu]
On Behalf Of Klug, Lawrence Chris, Yes, I’ll work up a use case for this. Thanks, Lawrence From: Chris Hyzer
[mailto:mchyzer@isc.upenn.edu]
You can do a similar thing with rules…
J https://spaces.internet2.edu/display/Grouper/Grouper+rules+use+case+-+Inherited+privileges+on+groups Hope a new UI at some point will make that easier to assign/view/etc. Lawrence, can you do a use case about how grouper works now to show us what you are concerned about? i.e. go to the UI as a non privileged user and see what they can see which is not ideal? Thanks, Chris From: Nathan Kopp
[mailto:Nathan.Kopp@ccci.org] I’m not sure if this is exactly what Lawrence is asking, but I’ve always thought it would be great to be able to assign group permissions (e.g. “update” to let you manage members) at the FOLDER level and have
those permissions apply to all groups stored within that folder. That would make life much easier for certain use cases. -Nathan From:
grouper-users-request@internet2.edu [mailto:grouper-users-request@internet2.edu]
On Behalf Of Klug, Lawrence Chris, I’m imagining a scenario where the organizational hierarchy has been loaded into grouper with many levels of folders and groups (divisions, sub-divisions, departments, etc.). Let’s say we create a folder in
a different area for the Math Department and give them admin control of the folder. They may want to work with groups in the organizational hierarchy related to Math, but might need to be restricted from other sections of the orgs. Can we limit visibility?
How do you handle this at Penn? Thanks, Lawrence From: Chris Hyzer [mailto:mchyzer@isc.upenn.edu]
Well, there is no VIEW privilege on folders, so I don’t think the API hides them. However, the UI should not show folders that are not applicable to a user (e.g. no privileges and no objects inside which are viewable or have privileges). Right? Or does it show them somewhere? There is a find folder WS operation, maybe that should be locked down in a similar fashion if it is not already. Thanks, Chris From:
grouper-users-request@internet2.edu
[mailto:grouper-users-request@internet2.edu]
On Behalf Of Klug, Lawrence I have a question about folder visibility in Grouper. Are all folders other than root:etc visible by default to non-sysadmingroup members? Is this configurable? Thanks, Lawrence Klug IMS Platform Development 310 825-2061 ext 52061 |
Attachment:
everyEntityPriv.png
Description: everyEntityPriv.png
- [grouper-users] Folder visibility, Klug, Lawrence, 05/17/2012
- [grouper-users] RE: Folder visibility, Chris Hyzer, 05/17/2012
- [grouper-users] RE: Folder visibility, Klug, Lawrence, 05/17/2012
- [grouper-users] RE: Folder visibility, Nathan Kopp, 05/17/2012
- [grouper-users] RE: Folder visibility, Chris Hyzer, 05/17/2012
- [grouper-users] RE: Folder visibility, Klug, Lawrence, 05/17/2012
- [grouper-users] RE: Folder visibility, Klug, Lawrence, 05/21/2012
- [grouper-users] RE: Folder visibility, Chris Hyzer, 05/21/2012
- [grouper-users] RE: Folder visibility, Klug, Lawrence, 05/21/2012
- [grouper-users] RE: Folder visibility, Klug, Lawrence, 05/23/2012
- [grouper-users] RE: Folder visibility, Chris Hyzer, 05/23/2012
- [grouper-users] RE: Folder visibility, Klug, Lawrence, 05/23/2012
- [grouper-users] RE: Folder visibility, Chris Hyzer, 05/23/2012
- [grouper-users] RE: Folder visibility, Klug, Lawrence, 05/21/2012
- Re: [grouper-users] RE: Folder visibility, Tom Barton, 05/17/2012
- [grouper-users] RE: Folder visibility, Klug, Lawrence, 05/17/2012
- [grouper-users] RE: Folder visibility, Chris Hyzer, 05/17/2012
- [grouper-users] RE: Folder visibility, Nathan Kopp, 05/17/2012
- [grouper-users] RE: Folder visibility, Klug, Lawrence, 05/17/2012
- [grouper-users] RE: Folder visibility, Chris Hyzer, 05/17/2012
Archive powered by MHonArc 2.6.16.