Re: [Unity-idm-discuss] Group administrator role

[Krzysztof B. <kb...@un...>]

Sander,

W dniu 11.08.2020 o 09:39, Sander Apweiler pisze:
> Dear Krzysztof,
> we encountered an issue with the group administrator role. If I
> remember correctly we did not cover the case where we have dedicated
> managers for subgroups. At the moment the group administrator is
> administrators of all subgroups and the maingroup itself.
>
> We have now reqeusts for the groupmanagement where multiple subgroups
> are managed by dedicated people but they should not have the
> administrator privileges in upper groups.
>
> E.g.
> user1 is admin of /ABC and everything below.
> user2 is admin of /ABC/DEF and everything below but not of /ABC and
> /ABC/GHI
> user3 is admin of /ABC/GHI and everything below but not of /ABC and
> /ABC/DEF
>
> Is it possible to adopt the group administrator role in the way that it
> is only granted downwards in the tree and not upwards?

Upman was supposed to address exactly this use case. E.g. /ABC/DEF 
should be delegated (UpMan enabled) and user2 be project's admin. Then 
it will have management capabilities also in /ABC/DEF/whatever but not 
in say /ABC or /ABC/GHI.

If you want some more "management capabilities" then extending upman is 
the way to proceed.

Best,
Krzysztof