Grouper Users - Open Discussion List

["Hyzer, Chris" <>]

Nope.  Can you organize your folders so that the inheritance is pure?  e.g. put a folder to the side that has the one-offs.  Otherwise if you inherit priv, I wouldnt change those afterwards with a hook.  You could do the whole thing outside of inherited privs if that what you mean.  Thanks, Chris

---

From: <> on behalf of Black, Carey M. <>
Sent: Monday, January 14, 2019 10:13:10 AM
To:
Subject: [grouper-users] Is it possible to block inherited privs on some objects?

 

Before I go invent something for myself....
        Is there an existing way to tag/restricted inherited privileges in Grouper?


I have a condition where generally I want to use inherited privileges on (groups/folders/attributes) but I also have some exceptions to that as well.
        A folder that should be "fully controlled" (read ADMIN) by GroupA. However, GroupB wants some groups/folders to exist in that folder and they don't want GroupA to be able to  make changes to them.
        NOTE: I am not concerned about GroupA having visibility to the objects. I am only concerned about preventing GroupA from being able to change the objects. ( all things like: object rename, object delete, member changes, attribute changes (values, Add/remove,etc....))

I am leaning toward making a set of hooks that add an additional "authorization check" before allowing any Stem, Group, Attribute, Membership event from completing.
        Attribute would have a "GroupName" value, or a list with a "requireOne, RequireAll" specification . If user making the change is not a member of "GroupName" then throw HookVeto with message.


Is there an easier way to achieve this?

Other thoughts?

--
Carey Matthew