Grouper Users - Open Discussion List

["Redman, Chad" <>]

Added to the script a query for direct admins of stems, to go along with the query for groups:

 

select count(*), v.subject_id, v.subject_source, m.sort_string0, m.name

from grouper_memberships_v v

join grouper_members m on v.member_id = m.id

where     v.list_type = 'naming'

    and   v.list_name like 'stemAdmins'

    and   v.membership_type = 'immediate'

    and   v.subject_source != 'g:gsa'

group by v.subject_id, v.subject_source, m.sort_string0, m.name

order by 1 desc;

 

 

From: Redman, Chad
Sent: Wednesday, October 03, 2018 3:27 PM
To:
Subject: Enclosed script to clean up admin privs for wheel users

 

In Grouper 2.4.0, when new groups and stems are created, the creator is no longer added as an admin if they are in the wheel group. The explicit access is unnecessary since users in the wheel group automatically have admin access even without the permission. This script performs a cleanup of these permissions, looping through a defined list of subjects (mixed ids/identifiers), and removing the admin access from the groups and stems. This cleanup could remove many thousands of excess memberships from the database, possibly improving performance.

 

After completion, the number of groups and stems where specific users have direct admin privileges should be very low. These remaining privileges should be looked at. Normally you would want to put users into policy groups instead, instead of giving direct access.

 

Note that this could take an hour or two to run, depending on how many privileges you have.

 

Regards,

-Chad

 

 

https://gist.github.com/cer28/b143b36ac280da2ac0fb6d360898a298

 

/****

*

* removeDefaultOwnerPermissions.groovy

*

* In Grouper 2.4.0, when new groups and stems are created, the creator is no longer added as an admin

* if they are in the wheel group. The explicit access is unnecessary since users in the wheel group automatically

* have admin access even without the permission. This script performs a cleanup of these permissions, looping through

* a defined list of subjects (mixed ids/identifiers), and removing the admin access from the groups and stems.

* This cleanup could remove many thousands of excess memberships from the database, possibly improving performance.

*

* After completion, the number of groups and stems where specific users have direct admin privileges should be very

* low. These remaining privileges should be looked at. Normally you would want to put users into policy groups instead,

* instead of giving direct access.

*

 * TODO get the count and add a countdown

* TODO revoke from attribute privileges

*

* Chad Redman <>, 2018-10-03, Free for any use

****/

 

subjects = ["GrouperSystem", "other-ids-or-identifiers", "for-current-and-past-wheel-members", ]

 

gs = GrouperSession.startRootSession()

//me = SubjectFinder.findByIdentifierAndSource("myUid", "mySource", true)

//gs = GrouperSession.start(me)

 

import edu.internet2.middleware.grouper.cfg.GrouperConfig

import edu.internet2.middleware.grouper.internal.dao.QueryOptions

import edu.internet2.middleware.grouper.membership.MembershipType

 

GrouperConfig.retrieveConfig().propertiesOverrideMap().put("ws.getMemberships.maxResultSize", "300000")

 

subjects.each { subject ->

    try {

       

        theUser=SubjectFinder.findByIdOrIdentifier(subject, true)

        println "Revoking admin privs for ${subject} (${theUser.name})"

   

        // QueryOptions has side effects! Can't reuse between group/subject queries because the sort option sticks to it

        queryOptions = new QueryOptions()

        queryOptions.paging(500, 1, false)  // 500 is the max allowed?

       

        while (true) {

            x = new MembershipFinder().

              addSubject(theUser).

              assignFieldType(FieldType.ACCESS).

              assignEnabled(true).

              assignHasFieldForGroup(true).

              assignHasMembershipTypeForGroup(true).

              addField("admins").

              assignMembershipType(MembershipType.IMMEDIATE).

              assignQueryOptionsForGroup(queryOptions).

              findMembershipResult().

              getMembershipSubjectContainers()

       

            if (x.size() == 0) {

                break

            }

            println "\t${x.size()}"

       

            x.each { member ->

                println "\tRevoke " + subject + " from group " + member.groupOwner.name

                member.groupOwner.revokePriv(theUser, AccessPrivilege.ADMIN, false)

            }

        }

       

    

        queryOptions = new QueryOptions()

        queryOptions.paging(500, 1, false)  // 500 is the max allowed?

       

        while (true) {

            x = new MembershipFinder().

              addSubject(theUser).

              assignFieldType(FieldType.NAMING).

              assignEnabled(true).

              assignHasFieldForStem(true).

              assignHasMembershipTypeForStem(true).

              addField("stemAdmins").

              assignMembershipType(MembershipType.IMMEDIATE).

              assignQueryOptionsForStem(queryOptions).

              findMembershipResult().

              getMembershipSubjectContainers()

       

            if (x.size() == 0) {

                break

            }

            println "\t${x.size()}"

       

            x.each { member ->

                println "\tRevoke " + subject + " from stem " + member.stemOwner.name

                member.stemOwner.revokePriv(theUser, NamingPrivilege.STEM_ADMIN, false)

            }

        }

    } catch (Exception e) {

        println "*** Failed to revoke from user ${subject}: ${e}"

        e.printStackTrace()

    }

}

 

 

 

/**** Alternative to MembershipFinder?

* import edu.internet2.middleware.grouper.internal.dao.hib3.Hib3MembershipDAO

* H = new Hib3MembershipDAO().findAllImmediateByMemberAndField(gs.member.uuid, FieldFinder.find("admins", true), true)

*

 * H.each { membership ->

*     member.groupOwner.revokePriv(me, AccessPrivilege.ADMIN, false)

* }

****/

 

 

 

/**** Now that the direct admin list is much smaller, at some point you should look at subjects

      that have direct access, instead of indirect by policy group. This query will show counts and Subject Ids

 

select count(*) as num_objects, subject_id, subject_source

from grouper_memberships_v

where     list_type = 'access'

    and   list_name = 'admins'

    and   membership_type = 'immediate'

    and   subject_source != 'g:gsa'

group by subject_id, subject_source

order by count(*) desc;

 

*/