attestation read/update issues

----Original Message----
From: Redman, Chad chad_redman@unc.edu
Sent: Wednesday, December 13, 2017 9:42 AM
To: Hyzer, Chris <mchyzer@isc.upenn.edu>; grouper-core@internet2.edu
Subject: RE: [JIRA] (GRP-1640) Attestation mailer sending to group readers

Hi,

Tests work ok for us. This is the behavior I saw which works for us.

wheel group
admin (implied)
can attest, can edit settings
no email

user1
update only
Can see attestation menu item, but can't access the page: "Error: not allowed to read memberships in group:

"
no email

user2
read/update
can attest, can edit settings
emailed

user3
admin/read
can attest, can edit settings
emailed

user4
read only
can view settings
no email

I never realized you can have an update privilege without read, so my suggested fix was too simplistic. If you have update without read you can see the attestation menu item, but when you select it you just get an "Error: not allowed to read memberships in group" error. Not a big deal for us since we'll set update and read together.

Unsetting the group attestation does work now: it doesn't send emails and doesn't show the overdue message. It still shows up in the Miscellaneous->attestation list of groups. Maybe this is since some of the attributes are still set? Might be something to fix with a lower priority.

Thanks for the fixes!
Chad