On Tue, 2011-11-15 at 08:15 +0100, Heiko W.Rupp wrote:
When a user can access a resource X, does that always imply he can also see children of X? (The other way obviously does not work)
Or can there a case be constructed where the user e.g. only sees a JBAS server, but not its services?
This is what recursive groups was all about IIRC. No, it is not always implied that if you see a resource P, you can see its children C1..Cn.
If your role has access to a group that has P in it, you can only see P. The group must have C1..Cn in it to see it.
This is why we have recursive groups. So you can explicitly add P to a *recursive* group, and that implicitly gives you access to C1...Cn (that's why in the data model we call C1...Cn "implicit" members and P is called the group's "explicit" member).