Uploaded image for project: 'Grouper'
  1. Grouper
  2. GRP-1231

hook to assure that only one group in a folder contains a member

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Open
    • Priority: Minor
    • Resolution: Unresolved
    • Affects Version/s: None
    • Fix Version/s: 2.2.2.patch, 2.2.3, 2.3.0
    • Component/s: API
    • Labels:
      None

      Description

      From: Jeffrey Crawford
      Sent: Tuesday, December 01, 2015 12:18 PM
      To: Chris Hyzer
      Cc:
      Subject: Re: [grouper-users] Auto removal on groupA or groupB when "added" to groupC

      Morning Chris,

      Reminder of the request to enforce one group membership per folder

      Thanks

      Jeffrey

      Both pilots and IT professionals require training and currency before charging into clouds!
      ---------------------------------------

      On Tue, Oct 27, 2015 at 12:51 PM, Jeffrey Crawford wrote:
      Put a reminder on my calendar for Dec 1 , thanks!

      Jeffrey

      Both pilots and IT professionals require training and currency before charging into clouds!
      ---------------------------------------

      On Tue, Oct 27, 2015 at 12:47 PM, Chris Hyzer wrote:
      Ok, remind me in 6 weeks and I will take care of this for you

      Thanks,
      Chris

      From: Jeffrey Crawford
      Sent: Tuesday, October 27, 2015 3:47 PM

      To: Chris Hyzer
      Subject: Re: [grouper-users] Auto removal on groupA or groupB when "added" to groupC

      This particular project is not going live until beginning of next year, not super urgent, and we can make do with a manual process in the meantime but it would be sweet to have grouper to it automatically.

      Jeffrey

      Both pilots and IT professionals require training and currency before charging into clouds!
      ---------------------------------------

      On Tue, Oct 27, 2015 at 12:45 PM, Chris Hyzer <mchyzer@isc.upenn.edu> wrote:
      Ok, we can do folders. Just curious, when do you need this?

      From: Jeffrey Crawford
      Sent: Tuesday, October 27, 2015 3:45 PM

      To: Chris Hyzer
      Subject: Re: [grouper-users] Auto removal on groupA or groupB when "added" to groupC

      Not sure which works best, if someone wanted to categorize policies in sub-folders, would putting the rule on the folder still work. It seems like it's easier to understand, "From this point on, users can only be in one group" I do like the folder idea. Just thinking about what others might do.

      Jeffrey

      Both pilots and IT professionals require training and currency before charging into clouds!
      ---------------------------------------

      On Tue, Oct 27, 2015 at 12:37 PM, Chris Hyzer wrote:
      You could also do it with an attribute on the groups if you like… either that or like I described below (attribute on a folder)

      From: Jeffrey Crawford
      Sent: Tuesday, October 27, 2015 3:37 PM
      To: Chris Hyzer

      Subject: Re: [grouper-users] Auto removal on groupA or groupB when "added" to groupC

      yea I suppose on the folder level that would work, I guess if you are going to be in a policy you'd keep the policies in one folder. At lest we are doing it that way.

      so yes within that folder a subject can only be in one group. If they are added to another, they should be removed from the first.

      Jeffrey


      Both pilots and IT professionals require training and currency before charging into clouds!
      ---------------------------------------

      On Tue, Oct 27, 2015 at 12:16 PM, Chris Hyzer <mchyzer@isc.upenn.edu> wrote:
      So you want a folder where a subject can be in one and only one group in that folder and if in another when added, remove from the other(s), right?

      From: Jeffrey Crawford
      Sent: Tuesday, October 27, 2015 2:58 PM

      To: Chris Hyzer
      Cc: Gouper Users List
      Subject: Re: [grouper-users] Auto removal on groupA or groupB when "added" to groupC

      I'm willing to test if you guys come up with something. I can imagine it would be useful to others as well.

      Jeffrey E. Crawford
      ITS Application Administrator (IdM)

      Both pilots and IT professionals require training and currency before charging into clouds!
      ---------------------------------------

      On Tue, Oct 27, 2015 at 11:14 AM, Chris Hyzer wrote:
      I think a hook is better for this… until we have better rule support for this

      If you need help let me know

      Thanks,
      Chris

      From: Jeffrey Crawford
      Sent: Tuesday, October 27, 2015 2:13 PM

      To: Chris Hyzer
      Cc: Gouper Users List
      Subject: Re: [grouper-users] Auto removal on groupA or groupB when "added" to groupC

      There are about 8 or 9

      Jeffrey

      Both pilots and IT professionals require training and currency before charging into clouds!
      ---------------------------------------

      On Mon, Oct 26, 2015 at 10:00 PM, Chris Hyzer wrote:
      Are all the groups in one folder? If it's 4 groups only forever then some rules might work. Otherwise might need a hook and java logic.

      -------- Original message --------
      From: Jeffrey Crawford
      Date:10/26/2015 3:44 PM (GMT-05:00)
      To: Chris Hyzer
      Cc: Gouper Users List
      Subject: Re: [grouper-users] Auto removal on groupA or groupB when "added" to groupC

      This is more like a trigger. Let say you have 4 policies for a service:

      policy1
      policy2
      policy3
      policy4

      The system can only map a user to a single policy. Since we are representing this with groups a member can only be a member of one of the above groups.

      So if for example someone changes jobs and needs to move from policy1 to policy3, however the person managing the groups forgets to remove the user out of policy1 then they are a member of two policies, which can cause bad behavior. Therefore if grouper can trigger a job when a user is added to policy3 to make sure said member is removed if they exist in policy1 policy2 or policy4.

      Both pilots and IT professionals require training and currency before charging into clouds!
      ---------------------------------------

      On Mon, Oct 26, 2015 at 11:22 AM, Chris Hyzer wrote:
      Can you give a more explicit example please?

      Groups can be members of other groups. i.e.

      GroupA has GroupB as a member, and GroupB has jsmith as a member
      GroupA2 also has GroupB as a member, which also means jsmith is an effective member of GroupA2.

      If you remove jsmith from GroupB, then jsmith will then not be an effective member of GroupA or GroupA2. Is that what you want?

      Thanks,
      Chris

      From: grouper-users-request On Behalf Of Jeffrey Crawford
      Sent: Monday, October 26, 2015 2:19 PM
      To: Gouper Users List
      Subject: [grouper-users] Auto removal on groupA or groupB when "added" to groupC

      I know the RuleApi allows you to remove from groupA if removed from groupB, however we have a concept of "profiles" which require that a user is only a member of a single group in a particular series of groups.

      I was wondering if you have such a concept since trying to remember to remove someone from a group if they are added to another group is error prone.

      Jeffrey

      Both pilots and IT professionals require training and currency before charging into clouds!
      ---------------------------------------

        Smart Checklist

          Attachments

            Activity

              People

              Assignee:
              chris.hyzer@at.internet2.edu Chris Hyzer (upenn.edu)
              Reporter:
              chris.hyzer@at.internet2.edu Chris Hyzer (upenn.edu)
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Dates

                Created:
                Updated: