Skip to Content.
Sympa Menu

grouper-users - RE: [grouper-users] web service user READ only, ALL groups

Subject: Grouper Users - Open Discussion List

List archive

RE: [grouper-users] web service user READ only, ALL groups

Chronological Thread 
  • From: "Hyzer, Chris" <>
  • To: "Black, Carey M." <>
  • Cc: "" <>, "O'Dowd, Josh" <>, "Robinson, Justin S" <>
  • Subject: RE: [grouper-users] web service user READ only, ALL groups
  • Date: Mon, 30 Jul 2018 04:58:11 +0000
  • Accept-language: en-US
  • Authentication-results: spf=none (sender IP is ) ;
  • Ironport-phdr: 9a23:G+HeMR1vvXpZR144smDT+DRfVm0co7zxezQtwd8ZseMXI/ad9pjvdHbS+e9qxAeQG9mDtbQc06L/iOPJYSQ4+5GPsXQPItRndiQuroEopTEmG9OPEkbhLfTnPGQQFcVGU0J5rTngaRAGUMnxaEfPrXKs8DUcBgvwNRZvJuTyB4Xek9m72/q99pHPYghEniaxba9vJxiqsAvdsdUbj5F/Iagr0BvJpXVIe+VSxWx2IF+Yggjx6MSt8pN96ipco/0u+dJOXqX8ZKQ4UKdXDC86PGAv5c3krgfMQA2S7XYBSGoWkx5IAw/Y7BHmW5r6ryX3uvZh1CScIMb7Vq4/Vyi84Kh3SR/okCYHOCA/8GHLkcx7kaZXrAu8qxBj34LYZYeYP+d8cKzAZ9MXXWpPUNhMWSxdDI2ybIUPAOgAPelEoIfyqEADrQelCgWwGO/j1iNEi33w0KYn0+ohCwbG3Ak4Et4AsnrVrNT0O7kIUeyt0aLF0zXDb+lX2Tfm5oTDbxcsofSQUrJwccvQyFcgFxneg1WRsozqIymZ1vkVs2eF6epgU/ijhHA6pAFsuzWiwNonhIrRho8N1FzI6CR0zJw7KNGmUkJ3fN2pHIdKuyyaNoZ6Wt4uTm90tCogzrAKpIS3cDYXxJkj3RLTdv6KfomQ7hLtSumcIit0iXdgdb+8mhmy/0etx+j/W8S6zVlFtC9IktfSun0C2BHe79SIR/hn8Uu/3zuEyhrd5fteIU8ukKrWM54hzaA0lpoUqUnNBjP7lkLqgKKYb0kp5+qn5/r+brXhvZCTKZV4igbjMqQygcO/Bvk4Mg4TUGSB4eS8zrrj/VHnT7pWkv02k67ZsJbAKcQcu665HwtV0oEk6xa8FTupzNMYnXwfIFJEfhKIkZTpNknQLPzlDPqzmVqhnClxy/zbPbDtHo/BI3jCnbv5eLZy8U9cyA49zdBF4JJUD6kMIPfvVU/xtN3ZDwE2MxavzubmE9VyypkSWX+XAqCHNqPSt0WE6fwyLOmRfIMVoiryK+A55/7yin80gVAdfbOu3ZsKcHC3AO5mL1yEYXr3nNgBC3wKsxE6TOzrk12CTSVTa2ioU6I94DE7FJypDZ3FRo+znLyNwj23EYNLaWBbWRiwFiKiXYGNUPRIIAmbOMJw2hlCH/D1QYso3hLo7VWh4718M6zZ9jBO5rz5090grc3ChxwosXRfD96cyCvFG2R/nnIaSiUe3bt051Flx1GFl6V0nqoLRpRo+/pVX1JiZtbnxOtgBoW3A1qZJI3bQUu6QtigHTA6R84wxNlLeUtmBtG+lU6fjTGyDeoTkLqGTNwv/6TQ0mK5Bv41ym2OlcxDx0IjXtMJMGSngqBl8A2GAoXJgleUjY6rbq9awTbA8mHFwGaT7wlV
  • Spamdiagnosticmetadata: NSPM
  • Spamdiagnosticoutput: 1:99

Yes great idea, and confirmed by Chad :)

-----Original Message-----
From: Black, Carey M.

Sent: Friday, July 27, 2018 7:34 AM
To: Hyzer, Chris
O'Dowd, Josh
Robinson, Justin S
Subject: RE: [grouper-users] web service user READ only, ALL groups


What if that requirement was desired ONLY in the Web Services interface?....
But I also guess it might also depend on the Authentication source(s) used
for the UI vs WS too.....
I tend to think of "non-human" accounts using WebServices (WS) and
humans using the UI.

Could an installation use two tomcat instances. ( one for the UI and a
separate one for WS )
( Which you really should do anyways. )
Then the UI could not use that setting.
And the WebServices instanced could.

That way WebServices users could "enjoy" that setting only via the WS calls
and not exposing it to "UI users"?

Just a thought...

Carey Matthew

-----Original Message-----

On Behalf Of Hyzer, Chris
Sent: Friday, July 27, 2018 2:27 AM
To: O'Dowd, Josh
Robinson, Justin S

Subject: RE: [grouper-users] web service user READ only, ALL groups

There is a way to do a global READ or VIEW or whatever priv without the
overhead of the inherited privs copying to every object:


# A readonly wheel group allows you to enable non-GrouperSystem subjects to
# like a root user when reading the registry.
groups.wheel.readonly.use = false

# Set to the name of the group you want to treat as the readonly wheel group.
# The members of this group will be treated as root-like users when reading
objects. =

-----Original Message-----

On Behalf Of O'Dowd, Josh
Sent: Thursday, July 26, 2018 1:01 PM
To: Robinson, Justin S

Subject: Re: [grouper-users] web service user READ only, ALL groups

Thanks for that Justin. I will give that a shot once I understand what its
doing, exactly. But your example gives me points of reference to learn more
about. Very kind.

Thank You!

On Jul 26, 2018, at 10:55 AM, Robinson, Justin S

Hi Josh,

There are probably other (possibly better) ways to achieve this - but one way
is to use the RuleApi and GSH to inherit privileges. The example below should
do it:

grouperSession = GrouperSession.startRootSession();
someStem = StemFinder.findByName(grouperSession, "stem:path");
webServiceClientUsers = GroupFinder.findByName(grouperSession,
RuleApi.inheritGroupPrivileges(SubjectFinder.findRootSubject(), someStem,
Stem.Scope.SUB, webServiceClientUsers.toSubject(),


Justin Robinson
Indiana University

On Jul 26, 2018, at 12:42 PM, O'Dowd, Josh


I am wondering if it is possible to give an etc:webServiceClientUsers group
member READ(not ADMIN) privilege for ALL groups(including any new), instead
of having to add that privilege to each group individually? More of a global
group READ privilege, similar to what the etc:sysadmingroup has with the
ADMIN priv for all groups is what we are looking for.

Any help is much appreciated.

-Josh O’Dowd
University of Montana

Archive powered by MHonArc 2.6.19.

Top of Page