Entity and Profile rights should be entity based

MHI · 2008-11-14 13:16:11

I do have the following problem when it comes to administrating entities and profiles as those ones are handled as "global rights". The situation is that the local IT staff in every location should be able to create subentities for their location, like department, cost center, etc. For this I have to assign "write rights" to their profile.
Entity creation itself seems to be entity based as they are only able to create entities under or on the same level they have been assigned to.
The main problem is now that those users can add themselves or anybody else to other entities where they should not have access to.
Are there any plans to make those things entity based as well ?
This would release some pain from the central admin, who otherwise needs to create all of such small requests which could be easily done by the local IT, if everything is locked down to their entity, like it has been done with users and groups.

JMD · 2008-11-14 15:05:12

Entity are not group , this is a specific concept.

I'don't think that is a good idea to delegate this right.

Management of entity would be a root admin right.

Manage entity is a complex and difficult task. It would be better to give it to the root admin.

MHI · 2008-11-15 01:31:04

I can agree to that one, but the concept then was not consequently followed as the "entity write" security flag in a profile is more a mixture of a global and entity right. As said a user who is assigned to one entity, but also has the ability to "write entity" can only add entities on the same or child level from the entity he has been assigned to. If "write entity" is a global profile right the user needs to be able to create entities right below the "root entity", which he can't. On the other hand he can see and add himself or others to all other existing entities.
Hope this explantion is somehow understandable, as it is not easy to explain and mayeb now it's more clear why I asked if there is a way to check for the users entities he has been assigned to and just displays them for modifictation, which means to make the "entity write" security option, entitiy based.

remi · 2008-11-15 09:28:59

First, I agree with JMD, I don't think is a great idea to delegate entity creation.

But, I've made some tests and I don't see how you can give "upper" right to users :
- you can't assign a profile with more rights than yours
- you can't assign a profil on a entity you doesn't manage

Tests made with the super-admin profil on a child entity.

++

remi · 2008-11-15 09:32:39

I've answer too quickly

You can't assign upper right from the User form, but you can from the Entity form (User tab).

++

Forum GLPI-Project

Announcement

#1 2008-11-14 13:16:11

Entity and Profile rights should be entity based

#2 2008-11-14 15:05:12

Re: Entity and Profile rights should be entity based

#3 2008-11-15 01:31:04

Re: Entity and Profile rights should be entity based

#4 2008-11-15 09:28:59

Re: Entity and Profile rights should be entity based

#5 2008-11-15 09:32:39

Re: Entity and Profile rights should be entity based

Board footer