Grouper Users - Open Discussion List

["Vachon, Thomas" <>]

We are on 2.3.0 and not fully patched either. We hit some buggy patches which made us more cautious. Likely we won’t do major patching until 2.4 releases unless we have a very good reason

Sent from my iPhone

On Aug 7, 2018, at 4:15 PM, Black, Carey M. <> wrote:

Tom,

 

I note that I do not see the version that you are using.... So I will assume you are fully patched! ( Ha... You should have said otherwise. :) )

 

 

There are WS calls to " Assign Attributes" https://spaces.at.internet2.edu/display/Grouper/Assign+Attributes or https://spaces.at.internet2.edu/display/Grouper/Assign+Attributes+Batch

 

You could add the " inherit to descendant " rules on folders that way. ( It is harder than you want it to be but it could be done.)

 

To explain more of what I mean... use the New UI patch 44 and you can see the details of the attributes that are the "inherit" rules.

 

To the Demo Server.... https://grouperdemo.internet2.edu/grouper_v2_3/

 

I created a folder and added "Admin privileges" for Groups, Folders, and Attributes for (one folder deep) for a "random user" on the system. J

 

<image001.png>

 

Then look at the attributes assigned to the folder.

 

<image003.png>

 

Below are the attributes that ONLY do the “Group” inheritance portion. There are three separate sets of these for the other “Folder” and “Attribute” inheritance rules.

 

<image004.png>

 

So for each type of inheritance the there is an attribute assignment of “rule” ( part of the rulesTypeDef ).

Then there are a set of attribute assignments to the assignment of the “rule” to the folder ( ruleActAsSubjectId, ruleActAsSubjectSourceId, …. ) with values a needed.

 

I would not relish doing it with the current WS. However, the “Assign+Attributes+Batch” might make it a single call. Not a simple one… but one.

 

Maybe that will help…?

 

--

Carey Matthew

 

 

-----Original Message-----
From: <> On Behalf Of Hyzer, Chris
Sent: Tuesday, August 7, 2018 3:30 PM
To: Vachon, Thomas <>;
Subject: RE: [grouper-users] Grouper REST API for Privilege Inheritance

 

Add a jira please and we will address this...  probably by augmenting the privilege assignment WS and not by worrying about the underlying attribute assignments.

 

Or let me know and I can add a jira for you.

 

Thanks

Chris

 

-----Original Message-----

From: Vachon, Thomas []

Sent: Tuesday, August 07, 2018 3:07 PM

To: Hyzer, Chris <>;

Subject: Re: [grouper-users] Grouper REST API for Privilege Inheritance

 

Yea, we mean via grouper-ws.

 

We can do it in the GUI, any groups or stems made after the inherit privilege is granted automatically gets the parents permissions.

________________________________________

From: Hyzer, Chris <>

Sent: Tuesday, August 7, 2018 15:00

To: Vachon, Thomas;

Subject: RE: [grouper-users] Grouper REST API for Privilege Inheritance

 

When you say "API" you mean WS right?  If you give someone CREATE or ADMIN that doesn't inherit to descendant objects...

 

-----Original Message-----

From: Vachon, Thomas []

Sent: Tuesday, August 07, 2018 2:58 PM

To: Hyzer, Chris <>;

Subject: Re: [grouper-users] Grouper REST API for Privilege Inheritance

 

Thanks Chris,

 

I don't quite grok the inherit problem still.  We want to set this up fully via the API. ll we do is give a known group CREATE on the stems and ADMIN on the groups on the top of the "local" stem

________________________________________

From: Hyzer, Chris <>

Sent: Tuesday, August 7, 2018 14:55

To: Vachon, Thomas;

Subject: RE: [grouper-users] Grouper REST API for Privilege Inheritance

 

You can do composite groups with GroupSave.

 

https://spaces.at.internet2.edu/display/Grouper/Group+Save

 

For the inherited privs, in the UI it calls a method to inherit.  But it will also inherit from a daemon which runs nightly.  If you want it to run when you save a rule over WS, please open a jira and be explicit about the calls that you use to configure the privileges...

 

Thanks

Chris

 

-----Original Message-----

From: [] On Behalf Of

Sent: Tuesday, August 07, 2018 2:47 PM

To:

Subject: [grouper-users] Grouper REST API for Privilege Inheritance

 

Hi everyone,

 

We are trying to move automation more into the REST/grouper-ws land from the

GCLI where possible.  We have hit a wall on setting up inherited Grouper

permissions on a stem.

 

As you all know, but I'm going to say anyways, if you don't set the permission

inheritance up first, any groups and stems created don't get retroactively

applied permissions.  Since we do highly decentralized management, this poses

a large problem for us.

 

We have group, stem, and single-execution permissions setup via the API but I

am unable to decipher what needs to happen to get inherited permissions

applied via the API.  I will be committing this back to the community, so any

help is appreciated.

 

Also, for extra credit, if you can help me get composite groups working, that

would save us a bit more time as well.

 

Thank You,

Tom Vachon