Grouper Users - Open Discussion List

["Hyzer, Chris" <>]

Yes correct.

 

A grouper sysadmin could construct the groups for someone else who doesn’t have READ on the underlying FERPA groups.  Otherwise users need READ or ADMIN on the member group.

 

If you can READ a group you can see whos in the group whether or not you can READ underlying member groups.

 

Thanks

Chris

 

 

From: [mailto:] On Behalf Of Rob Gorrell
Sent: Tuesday, April 10, 2018 1:09 PM
To: Andrew Morgan <>
Cc: Jeffrey Williams <>; Grouper-Users <>
Subject: Re: [grouper-users] Noob Question about VIEW permissions

 

Andy, 

 

I thought I had seen situations where an admin who has privs to both groups adds group A as a member to B. If A's owner doesn't have READ privs to B, they would simply not see B's subjects listed as indirect members of A (even though they were in fact members). This gave me hope this is what the VIEW permission was intended for... the ability to use a group as a component factor preserving anonymity of its members from those that lack READ. But thats not what you are saying... the purpose of VIEW seems simply a way of announcing the group's existence, though this permission alone implies no practical usability of the group to those that possess it, is that correct?

 

Do you have any suggestions on how to approach groups with sensitive membership (say FERPA) that might need to be used in construction of other non-sensitive groups? Or are you going to say there's not getting away from transitivity here?

 

-Rob

 

 

On Tue, Apr 10, 2018 at 11:41 AM, Andrew Morgan <> wrote:

On Tue, 10 Apr 2018, Jeffrey Williams wrote:

I'm working on a permissions model for a group of users to allow them to
use a group without seeing its membership.

When I apply the view permission for a group, the target user can see that
the group exists, can't see the membership, but also cannot add it to
groups of their own for use.

To contrast, a user with read permissions can add the group as a member of
target group.  The user with view permissions of that same target group can
see the member group, but not the resulting indirect member names(I think
only blank rows).

Should users have read permissions in order to add a group as a member?  Is
there something I can configure or have misconfigured to adjust that
behavior?

 

If your users need to add group FOO to one of their groups, then they need READ privileges on group FOO.

If a person with VIEW privileges were able to add group FOO to their own group, they could discover the membership of group FOO.

        Andy

 

--

Robert W. Gorrell
IT Manager, Identity and Access Management

University of NC at Greensboro
336-334-5954
PGP Key ID B36DB0CA