Seeing parent resource implies seeing children?

John Mazzitelli jmazzite at redhat.com
Tue Nov 15 14:18:12 UTC 2011


On Tue, 2011-11-15 at 08:15 +0100, Heiko W.Rupp wrote:
> When a user can access a resource X, does that always imply he can also see children of X?
> (The other way obviously does not work)
> 
> Or can there a case be constructed where the user e.g. only sees a JBAS server, but not its
> services?

This is what recursive groups was all about IIRC. No, it is not always
implied that if you see a resource P, you can see its children C1..Cn.

If your role has access to a group that has P in it, you can only see P.
The group must have C1..Cn in it to see it.

This is why we have recursive groups. So you can explicitly add P to a
*recursive* group, and that implicitly gives you access to C1...Cn
(that's why in the data model we call C1...Cn "implicit" members and P
is called the group's "explicit" member).



More information about the rhq-devel mailing list