Grouper Users - Open Discussion List

[Chris Hyzer <>]

It's a security thing.  If VIEW a group means you can add a group to another 
group, and you can see the membership of that group, then you can easily turn 
any VIEW into READ.  Know what I mean?  We have discussed this on the grouper 
call before.  I don't think we should do this...

Thanks,
Chris

-----Original Message-----
From: 

 
[mailto:]
 On Behalf Of Keith Hazelton
Sent: Tuesday, July 01, 2014 2:56 PM
To: 

Subject: Re: [grouper-users] Issue with adding groups as members

I haven't yet seen any responses to this query from UW-Madison's main Grouper 
tech.  In our world, we'd like users with only "view" privileges on group A 
to be able to make group A a member of another group.  As Nathan explains, if 
it is true that you really need "read" privileges to do this, we will have to 
do some kind of work-around.

Not to jump to solutions, but just wondering if it could be a configuration 
option whether you need "read" or "view" privileges on a group to be able to 
add a it as a member of another group.

        -Keith
_________________
On Jun 19, 2014, at 15:58 , Nathan Weyenberg 
<>
 wrote:

> Hi,
> 
> We have taken away default read privileges on groups as we would like users 
> to have to choose to make their group memberships public only if they 
> choose. This has had unintended consequences however, because apparently 
> one needs at least READ privilege on the group you are adding as a member 
> in order to do it. 
> 
> The behavior we expected is that only VIEW privilege would be needed to add 
> a group as a member. Upon adding that group as a member, you could only see 
> its immediate membership, not necessarily those groups effective 
> memberships. Is there any way to do this utilizing grouper?
> 
> -Nathan Weyenberg
> 
> UW-Madison