Skip to Content.
Sympa Menu

grouper-users - RE: [grouper-users] web service user READ only, ALL groups

Subject: Grouper Users - Open Discussion List

List archive

RE: [grouper-users] web service user READ only, ALL groups

Chronological Thread 
  • From: "Redman, Chad" <>
  • To: "Black, Carey M." <>, "Hyzer, Chris" <>
  • Cc: "" <>, "O'Dowd, Josh" <>, "Robinson, Justin S" <>
  • Subject: RE: [grouper-users] web service user READ only, ALL groups
  • Date: Fri, 27 Jul 2018 13:45:10 +0000
  • Accept-language: en-US
  • Authentication-results: spf=none (sender IP is ) ;
  • Ironport-phdr: 9a23:wxy21BdR8XN7YdC//1QwynyElGMj4u6mDksu8pMizoh2WeGdxcWyYx7h7PlgxGXEQZ/co6odzbaO7ea4ASQp2tWoiDg6aptCVhsI2409vjcLJ4q7M3D9N+PgdCcgHc5PBxdP9nC/NlVJSo6lPwWB6nK94iQPFRrhKAF7Ovr6GpLIj8Swyuu+54Dfbx9HiTahYL5+Ngm6oRnMvcQKnIVuLbo8xAHUqXVSYeRWwm1oJVOXnxni48q74YBu/SdNtf8/7sBMSar1cbg2QrxeFzQmLns65Nb3uhnZTAuA/WUTX2MLmRdVGQfF7RX6XpDssivms+d2xSeXMdHqQb0yRD+v9LlgRgP2hygbNj456GDXhdJ2jKJHuxKquhhzz5fJbI2JKPZye6XQds4YS2VcRMZcTyxPDJ2hYYsTAeQPPuhYoIv8p1QSohWxChKhBP/0xTNUmnP6wbE23uYnHArb3AIgBdUOsHHModn7KKkdT/26zKzSwjXFd/9dxCnw6IjSfR88r/2HQLV9ftbRyUY1CgzKlk+QppL4MDOQzOsNtXOW7/dmVe2zkWIotRx+oiW2y8oql4LHhZoVx0ja+Spj3Io5ONi1RFNmbdK5FZZQuS6XO5dqTs4nTWFnpiY3xqEDtJO+fSUG1ogoywbCZ/GHbYSE+AzvWPyMLTtkmn5pYq+zihmx/ES4xO3zSMq53EpPoydAjNbAq2oC1xLW58WFS/Zw/Fqu1DOR2wzN6exJI0U5mrHbJpE/w7M9kIcYv17ZES/sgkr2ibebdkU69eis7OTqeq3oq4ObOYNoigzyK7ojlNWiDeghNQgBRHaU9f671L3+4U32W7JKjuAwkqbEqpzaPd4bpqmlAwBLzokj9xe/DzCg0NgCmnkHMU5FeBaAj4juOFHCOuz3DfC6g1i0kTdrwe7JPqH5D5nTNHfPjKrtcLNg50JB1QY+yN5f6p1IBr0dJf/zVFH+udzEAhI8NgG5wvjrB8ll2oMbQ22PA6uZMK3IsV+P4+IiO/WDZI8PtzngM/cl/eDhgmI8mVAHe6mkxoYXaHakEfh8PUqWfGfsjs8bEWgWpgo+UPDqiFqaXD5cfXayWL885iklB4K8FIvDW5utj6Kb3CegBZBWYmFGCkuQEXfzaYmIQfYMaCSOIsB/iDwEU6auS5M/2R20qgD11qdnfaLo/XhSn5bq39sxr8bajxwjvRkyRYzJ2WWERGIyxzlTbzgtweZyrVErjh/J8blqjuYcXfdT/fJSGE9uMJXc3v53EfjzQQmHY8+ETlDgT9m7V2IfVNU0lpU0bkp4EtPmxjvD1ibgS+sel7WHM4Y5/qfV2VDsIc07xnrbgvpyx2I6S9dCYDX1zpV08BLeUsuQyx3DzfSjaLgc0SjR9WyK0WuJugRCXRVtVbneAypNfVPY+NL+4E6KD6SjD7gqKENg8YaDMeMLD7+hllBaXLHmMdXabXi2njK7BR+E8amBYI/jfU0A2i6bBUQZwEge
  • Spamdiagnosticmetadata: NSPM
  • Spamdiagnosticoutput: 1:99

I don't know if this helps your setup. What we have is that both people and
service accounts are in LDAP. But our people are in the ou=people branch, and
service accounts are in ou=applications. Shibboleth only looks in ou=people,
so it doesn't authenticate service accounts. That effectively keeps them out
of Grouper. Our WS setup goes directly against Kerberos, so works with both
people and service accounts.

Also, if they are different subject types in Grouper, there is also a UI

# comma separated source ids that the authenticating user must be in to
authenticate (if blank accept all)
grouper.ui.authentication.sourceIds =

We aren't using this, but we do have different subject sources for them, so
we could if SSO wasn't effective enough. This option is available as of UI
2.3.0 patch 14.

And there is an analogous property for WS to limit source types too. We do
use this just to lock it down to the sources we have the best control of.


-----Original Message-----

On Behalf Of Black, Carey M.
Sent: Friday, July 27, 2018 7:34 AM
To: Hyzer, Chris
O'Dowd, Josh
Robinson, Justin S
Subject: RE: [grouper-users] web service user READ only, ALL groups


What if that requirement was desired ONLY in the Web Services interface?....
But I also guess it might also depend on the Authentication source(s) used
for the UI vs WS too.....
I tend to think of "non-human" accounts using WebServices (WS) and
humans using the UI.

Could an installation use two tomcat instances. ( one for the UI and a
separate one for WS )
( Which you really should do anyways. )
Then the UI could not use that setting.
And the WebServices instanced could.

That way WebServices users could "enjoy" that setting only via the WS calls
and not exposing it to "UI users"?

Just a thought...

Carey Matthew

-----Original Message-----

On Behalf Of Hyzer, Chris
Sent: Friday, July 27, 2018 2:27 AM
To: O'Dowd, Josh
Robinson, Justin S

Subject: RE: [grouper-users] web service user READ only, ALL groups

There is a way to do a global READ or VIEW or whatever priv without the
overhead of the inherited privs copying to every object:


# A readonly wheel group allows you to enable non-GrouperSystem subjects to
# like a root user when reading the registry.
groups.wheel.readonly.use = false

# Set to the name of the group you want to treat as the readonly wheel group.
# The members of this group will be treated as root-like users when reading
objects. =

-----Original Message-----

On Behalf Of O'Dowd, Josh
Sent: Thursday, July 26, 2018 1:01 PM
To: Robinson, Justin S

Subject: Re: [grouper-users] web service user READ only, ALL groups

Thanks for that Justin. I will give that a shot once I understand what its
doing, exactly. But your example gives me points of reference to learn more
about. Very kind.

Thank You!

On Jul 26, 2018, at 10:55 AM, Robinson, Justin S

Hi Josh,

There are probably other (possibly better) ways to achieve this - but one way
is to use the RuleApi and GSH to inherit privileges. The example below should
do it:

grouperSession = GrouperSession.startRootSession();
someStem = StemFinder.findByName(grouperSession, "stem:path");
webServiceClientUsers = GroupFinder.findByName(grouperSession,
RuleApi.inheritGroupPrivileges(SubjectFinder.findRootSubject(), someStem,
Stem.Scope.SUB, webServiceClientUsers.toSubject(),


Justin Robinson
Indiana University

On Jul 26, 2018, at 12:42 PM, O'Dowd, Josh


I am wondering if it is possible to give an etc:webServiceClientUsers group
member READ(not ADMIN) privilege for ALL groups(including any new), instead
of having to add that privilege to each group individually? More of a global
group READ privilege, similar to what the etc:sysadmingroup has with the
ADMIN priv for all groups is what we are looking for.

Any help is much appreciated.

-Josh O’Dowd
University of Montana

Archive powered by MHonArc 2.6.19.

Top of Page