Re: [Unity-idm-discuss] Group administrator role

[Sander A. <sa....@fz...>]

Good morning Krzysztof,
than you very much for the explanation. I understood the problem. This
will sadly not work for us because we expect much usage of subgroups
and we do not want to manage the tree by the unity administrators.

Cheers,
Sander

On Sun, 2020-08-16 at 22:24 +0200, Krzysztof Benedyczak wrote:
> Dear Sander,
> 
> 
> W dniu 12.08.2020 o 07:12, Sander Apweiler pisze:
> > Dear Krzysztof,
> > at the moment we delegated (via UpMan) the management of /ABC. If
> > we
> > create further subgroups /ABC/DEF and ABC/GHI (via UpMan) and set
> > user2
> > as admin in /ABC/DEF as admin (via UpMan), user2 is also admin in
> > /ABC
> > and /ABC/GHI. I had a look in our email exchange and we did not
> > defined
> > it in this way. We just defined that it should be possible to add
> > additional administrators. What was the planned design during the
> > implementation?
> 
> I think there is some misunderstanding. Upman is solving the problem
> of 
> hierarchical groups management authorization by designating a
> selected 
> group as a "project" for which you can provide management
> capabilities 
> in restricted form by upman. The fact that you can create subgroups 
> under a project in upman does not mean that in upman suddenly we
> have 
> hierarchical groups authorization defined and implemented.
> 
> So a user can be an upman-admin (project manager formally) of a
> project, 
> which is managed in upman. This means all subgroups will be under 
> control of this user.
> 
> If you want to support your situation you can, to some extend. But
> you 
> need to designate both /ABC/DEF and /ABC/GHI as separate projects 
> (delegate them to upman), then after adding user2 project admin 
> privileges in /ABC/DEF it will be able to manage this project, but
> not 
> GHI, where you can add other user.
> 
> HTH,
> Krzysztof
> 
-- 
Federated Systems and Data
Juelich Supercomputing Centre

phone: +49 2461 61 8847
fax: +49 2461 61 6656
email: sa....@fz...

----------------------------------------------------------------------
-----------------------------------------------------------------------
Forschungszentrum Juelich GmbH
52425 Juelich
Sitz der Gesellschaft: Juelich
Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Volker Rieke
Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender),
Karsten Beneke (stellv. Vorsitzender), Prof. Dr.-Ing. Harald Bolt
-----------------------------------------------------------------------
-----------------------------------------------------------------------