Hi,
Question about access rights:
When a user can access a resource X, does that always imply he can also see children of X? (The other way obviously does not work)
Or can there a case be constructed where the user e.g. only sees a JBAS server, but not its services?
Thanks Heiko
Hi,
we set up a (Mixed) Group and associated this with some user that should have e.g. read access to its members. Since we could say "only platforms ending with '.company.com'" or "platforms ending with '.company.com' + recursive (descendant resources)" I would say it's possible to construct anything you like.
The only question is if really everything would finally work properly, especially regarding the GUI that seems most of the time dependant on the display-tree (with platform root).
Regards Andreas :-)
Am 11/15/2011 08:15 AM, schrieb Heiko W.Rupp:
Hi,
Question about access rights:
When a user can access a resource X, does that always imply he can also see children of X? (The other way obviously does not work)
Or can there a case be constructed where the user e.g. only sees a JBAS server, but not its services?
Thanks Heiko
... little mistake ... we did not use a Group Definition in this case and thus cannot say '... platforms ending with ...', but had to manually assign members to the group.
Am 11/15/2011 10:09 AM, schrieb Andreas Dietrich:
Hi,
we set up a (Mixed) Group and associated this with some user that should have e.g. read access to its members. Since we could say "only platforms ending with '.company.com'" or "platforms ending with '.company.com' + recursive (descendant resources)" I would say it's possible to construct anything you like.
The only question is if really everything would finally work properly, especially regarding the GUI that seems most of the time dependant on the display-tree (with platform root).
Regards Andreas :-)
Am 11/15/2011 08:15 AM, schrieb Heiko W.Rupp:
Hi,
Question about access rights:
When a user can access a resource X, does that always imply he can also see children of X? (The other way obviously does not work)
Or can there a case be constructed where the user e.g. only sees a JBAS server, but not its services?
Thanks Heiko
rhq-devel mailing list rhq-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/rhq-devel
On Tue, 2011-11-15 at 08:15 +0100, Heiko W.Rupp wrote:
When a user can access a resource X, does that always imply he can also see children of X? (The other way obviously does not work)
Or can there a case be constructed where the user e.g. only sees a JBAS server, but not its services?
This is what recursive groups was all about IIRC. No, it is not always implied that if you see a resource P, you can see its children C1..Cn.
If your role has access to a group that has P in it, you can only see P. The group must have C1..Cn in it to see it.
This is why we have recursive groups. So you can explicitly add P to a *recursive* group, and that implicitly gives you access to C1...Cn (that's why in the data model we call C1...Cn "implicit" members and P is called the group's "explicit" member).
No, there's no such implication. If you want all the child Resources to be viewable, you would typically make the group recursive or define a 2nd group that contains them.
I just tried creating a role mapped to a compat group of JBoss AS Servers, and logged in as a user in that role, and confirmed that I could see only JBoss AS Servers and no other Resources in both the Inventory list views and the Resource tree in the Resource view.
On 11/15/2011 02:15 AM, Heiko W.Rupp wrote:
Hi,
Question about access rights:
When a user can access a resource X, does that always imply he can also see children of X? (The other way obviously does not work)
Or can there a case be constructed where the user e.g. only sees a JBAS server, but not its services?
Thanks Heiko
Am 16.11.2011 um 18:27 schrieb Ian Springer:
No, there's no such implication. If you want all the child Resources to
Ok, thanks to all.
I was asking because of caching. Currently we go for each resource and its children to the database. In feature/rest I've introduced a cache, for single resources where each node with a resource also has a set of "viewers" listed.
Now getting the children still means round trips - and so the question was if I could prefetch the children, but obviously this is not always valid.
I have a different layout in mind now, where for each user the visible resources will be listed by id and then other cache area that holds the resources and their relations. I will report back after implementation.
Heiko
rhq-devel@lists.fedorahosted.org