ability to view details of other users

Ian Springer ian.springer at redhat.com
Fri Feb 17 22:35:56 UTC 2012


That would be more work implementation-wise, but if you think that level 
of granularity is required, that sounds like a good way to go. One 
possible use case is an admin wanting to make user details visible to 
employees, but hide them from contractors.

In either case, should hiding user details mean hiding everything or 
still leaving things like full name and department visible?

On 02/17/2012 05:10 PM, Charles Crouch wrote:
> Doesn't it make more sense for this to be part of the permissions/role infrastructure, rather than server wide setting? e.g.
>
> VIEW_USER_DETAILS: True/False
>
> We could add the permission to all existing roles and set it True
> When you are creating a role, it would be defaulted to True, but an admin could choose to turn it off for particular roles.
>
> Cheers
> Charles
>
>
> ----- Original Message -----
>> Yeah, ideally I would just leave everything public too, but the BZ is
>> saying we should hide everything, so I was trying to find some sort
>> of
>> compromise. Perhaps it should be configurable via a server setting,
>> e.g.:
>>
>> [ ] yes [x] no  -  Hide User Details - hide details of users from
>> non-admin users
>>
>> The setting could be false by default, which would keep things the
>> same
>> as they've always been by default, but give admins who are hardcore
>> about privacy a way to hide the details.
>>
>> On 02/17/2012 04:37 PM, John Mazzitelli wrote:
>>> I would leave phone and email open. Because if you see something
>>> bad
>>> happening on a resource that a user modified or owns or what have
>>> you,
>>> you will want to get in touch with them. Being able to find the
>>> email/phone would be helpful.
>>>
>>> Hiding phone/email from everyone except for MANAGE_SECURITY users
>>> seems
>>> less useful.
>>>
>>> On Fri, 2012-02-17 at 16:33 -0500, Ian Springer wrote:
>>>> I'm working on https://bugzilla.redhat.com/show_bug.cgi?id=786159.
>>>>
>>>> Currently, a regular user can view the following details about any
>>>> other
>>>> user (via #Administration/Security/Users):
>>>>
>>>> username
>>>> first name
>>>> last name
>>>> department
>>>> email
>>>> phone
>>>> login enabled?
>>>> ldap user?
>>>>
>>>> The assigned roles of other users cannot be viewed.
>>>>
>>>> I propose we change it so they can only view the following fields:
>>>>
>>>> username
>>>> first name
>>>> last name
>>>> department
>>>>
>>>> I think it makes sense to keep these basic details public, because
>>>> it's
>>>> useful to know the real name and department for other users in the
>>>> system. For example, if I see that user pilhun deleted my WAR a
>>>> few days
>>>> earlier, it would be nice if I could find out that pilhun is Heiko
>>>> Rupp
>>>> from the JON dev team (facts not obvious from the username),
>>>> without
>>>> having to go find an RHQ Admin and ask them. I can see hiding
>>>> people's
>>>> phone number and email address for privacy purposes. I'm up in the
>>>> air
>>>> about the two boolean fields.
>>>>
>>>> Users with MANAGE_SECURITY would of course be able to view and
>>>> edit all
>>>> details for all users, as they can today.
>>>>
>>>> Please let me know if you have an opinion on this, as I'd like to
>>>> come
>>>> up with a plan so I can implement it next week.
>>>>
>>>> Thanks,
>>>> Ian
>>>>
>>>> _______________________________________________
>>>> rhq-devel mailing list
>>>> rhq-devel at lists.fedorahosted.org
>>>> https://fedorahosted.org/mailman/listinfo/rhq-devel
>>> _______________________________________________
>>> rhq-devel mailing list
>>> rhq-devel at lists.fedorahosted.org
>>> https://fedorahosted.org/mailman/listinfo/rhq-devel
>>
>> --
>> Ian Springer
>> Principal Software Developer
>> JBoss Operations Network
>> Red Hat
>> ian.springer at redhat.com
>>
>> _______________________________________________
>> rhq-devel mailing list
>> rhq-devel at lists.fedorahosted.org
>> https://fedorahosted.org/mailman/listinfo/rhq-devel
>>
> _______________________________________________
> rhq-devel mailing list
> rhq-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/rhq-devel


-- 
Ian Springer
Principal Software Developer
JBoss Operations Network
Red Hat
ian.springer at redhat.com



More information about the rhq-devel mailing list