Re: [Unity-idm-discuss] Group administrator role

[Krzysztof B. <kb...@un...>]

Dear Sander,


W dniu 12.08.2020 o 07:12, Sander Apweiler pisze:
> Dear Krzysztof,
> at the moment we delegated (via UpMan) the management of /ABC. If we
> create further subgroups /ABC/DEF and ABC/GHI (via UpMan) and set user2
> as admin in /ABC/DEF as admin (via UpMan), user2 is also admin in /ABC
> and /ABC/GHI. I had a look in our email exchange and we did not defined
> it in this way. We just defined that it should be possible to add
> additional administrators. What was the planned design during the
> implementation?

I think there is some misunderstanding. Upman is solving the problem of 
hierarchical groups management authorization by designating a selected 
group as a "project" for which you can provide management capabilities 
in restricted form by upman. The fact that you can create subgroups 
under a project in upman does not mean that in upman suddenly we have 
hierarchical groups authorization defined and implemented.

So a user can be an upman-admin (project manager formally) of a project, 
which is managed in upman. This means all subgroups will be under 
control of this user.

If you want to support your situation you can, to some extend. But you 
need to designate both /ABC/DEF and /ABC/GHI as separate projects 
(delegate them to upman), then after adding user2 project admin 
privileges in /ABC/DEF it will be able to manage this project, but not 
GHI, where you can add other user.

HTH,
Krzysztof