Grouper Users - Open Discussion List

["Redman, Chad" <>]

The users were waiting on a fix for this, so I debugged the source code to figure out exactly what was needed for a regular user to view the attestation or mark it as Reviewed.

 

To view the attestation page:

 

1)      User needs to have Read on etc:attribute:attestation:attestationDef

2)      User needs to have Read on etc:attribute:attestation:attestationValueDef

3)      User needs both Read and Attribute Read on the group in question

 

Note that the button to mark it as reviewed shows up for these users, even though they don't have the update privilege that would make it work. They just get a user-unfriendly message about no access to the attribute definition. Checking for the correct permissions before showing the button would be helpful here.

 

 

To be able to mark the group as Reviewed:

 

1)      User needs to have Read and Update on etc:attribute:attestation:attestationDef

2)      User needs to have Read and Update on etc:attribute:attestation:attestationValueDef

3)      User needs Read on the group in question (Update isn't necessary unless you want them to edit the membership)

4)      User needs both Attribute Read and Attribute Update on the group in question

 

 

To simplify configuration slightly, we created a Readers group and an Updaters group, instead of granting individual permissions to the attribute definitions in etc:attribute. Any users who would be doing any kind of attestation work would be put into one of these groups. It's possible that it's safe to make access to the attribute definitions public, as you can only read or edit groups where you have attribute read/update anyway. We were just playing it safe there for now.

 

-Chad

 

 

 

 

From: [mailto:] On Behalf Of Redman, Chad
Sent: Wednesday, June 28, 2017 11:44 AM
To:
Subject: [grouper-users] Non-wheel privileges for attestation access

 

This sender failed our fraud detection checks and may not be who they appear to be. Learn about spoofing

Feedback

We just had our first user get an attestation recertification email, and when they tried to certify, they reported back an error: "etc:attribute:attestation:attestation attribute doesn't exist".

 

The user actually wasn't an admin for the group, but got the email because the address was explicitly set in the Email addresses field. However, in my testing using a non-wheel account, being an admin for the group is not enough. When I gave my non-wheel user admin privileges, I could reproduce the same error. The only way I could get attestation to work was to grant the user read/update on etc:attribute:attestation:attestationDef and etc:attribute:attestation:attestationValueDef. But this is not desirable, as it now allows the user to edit attestation for any group.

 

Am I looking at this the wrong way?

 

Thanks!

-Chad