Skip to Content.
Sympa Menu

grouper-users - RE: [grouper-users] rights inheritance ...

Subject: Grouper Users - Open Discussion List

List archive

RE: [grouper-users] rights inheritance ...


Chronological Thread 
  • From: Chris Hyzer <>
  • To: Steven Carmody <>, Grouper-Users <>
  • Subject: RE: [grouper-users] rights inheritance ...
  • Date: Mon, 26 Jan 2015 22:49:24 +0000
  • Accept-language: en-US

For #1, you just put it on an ancestor stem, you dont have to put it on the
substeams, it will inherit. The rule fires immediately, I believe its in the
same transaction as the group or stem create. Is that what you meant by
"cycle". This use case is what the rule is for, I would use that :) In
general this is what sites generally need, otherwise it is difficult to have
multiple local admins and when individuals leave you have a lot of individual
privileges pepperred throughout the registry when most of them should have
been group privileges.

Thanks,
Chris

-----Original Message-----
From:


[mailto:]
On Behalf Of Steven Carmody
Sent: Monday, January 26, 2015 5:25 PM
To: Grouper-Users
Subject: [grouper-users] rights inheritance ...

Hi,

we're making a major push giving Depts the authority to create and manage
groups within Grouper. Each Dept has an Admins group with privileges within
the Dept STEM.

The default permissions assigned when a group is created, tho, is that the
person who created the group gets rights. We want the members of the Admins
group to get those rights. They work as a group, and they all need to be able
to see and manage the new group.

We can think of two ways to obtain the outcome we want. But, we're sure we're
not the only campus encountering this issue, and we're keenly interested in
hearing how other campuses are approaching this problem.
The two approaches we can think of are:

1) use Grouper's Rules functionality. There's a nice example in the Grouper
doc:

https://spaces.internet2.edu/display/Grouper/Grouper+rules+use+case+-+Reassign+group+privileges+if+from+group

This is really clever. Our concern about this approach, tho, is its lack of
transparency. You can't see or set these Rules via any known GUI. Its
there... but no one in the Depts would ever see the Rules. Also, we don't
know on what cycle the Rules would be implemented.

2) Use a process outside of Grouper to reset the permissions when a group is
created. We're thinking that the Change Log Consumer, when it saw a Create
Group Msg, could reach back into Grouper and change the permissions, if
appropriate. The Depts wouldn't see this either, but we'd be able to easily
see the logic.

How are other sites dealing with this issue ? Do you have a different
approach ? Thoughts on these two ideas -- which would you prefer ?

Thanks very much !



Archive powered by MHonArc 2.6.16.

Top of Page