Group ids

[renspr]

Hi everyone,

group ids within Alfresco are unique, even if structured within sub-groups. That means if I have a group A and a group B (on the same level), I can not have a subgroup of A named B! I think this is very limiting.

We are developing a course and learning management solution based on Alfresco for a large university. For each course space we create a "learners" and a "staff" group. Because this groups have to be unique we prefix the group names with a course identifier and a semester id. For example the staff group for the course "w121325" in semester "ws0708" will be named: "ws0708.w121325.staff". This way we only can create "root" groups. But I would like to use subgroups:

ws0708 
    | 
     -> w121325 
    |         |
    |         -> staff
    |         |
    |         -> learners
    |
    -> w231214
              |
              -> staff (won't work)
              |
              -> learners (won't work)
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

This actually won't work because "learners" and "staff" have to unique. So Alfresco supports the concept of groups within groups but requires the group id to be unique. This makes not really sense to me. I would suggest that the id of a subgroup is something like a concatenation with the parent groups (like the way we do this manually) or identified by it's path.

I would like to know if there something on the roadmap to address this?

Best regards, René

[renspr]

Hi again,

it would be really nice if one of the Alfresco developers would make a comment on that.

Best regards,

René

[dhalupa]

well, there is cm:name property in authorityContainer type. That property could be used to store human readable identification of the group and  authorityName would hold unique groupId with defined pattern (GROUP_*).

It should not be that hard to modify group management dialogs in order to utilize that existing field.

[renspr]

I found the JIRA entry about nested groups: http://issues.alfresco.com/browse/AWC-1551. I think they are talking about the same thing as I do. I originally thought that the current subgroup feature of Alfresco is exactly that, but with the constraint that the group ids have to be globally unique this feature is in my case useless without workarounds. So, it would be really nice to have real nested group feature as outlined here and in the mentioned JIRA issue.

Best regards,

René

[andy]

Hi

The bug referenced does not really relate to your issue.

Nested groups are supported but not via the standard UI.

In your situation, groups still need to have a unique identifier (there could be other display names - but these would also need to be unique).
A unique id/whatever is required so you invite the correct group. (there is no navigation of the group hierarchy in the UI invite users). A group id based on where the group structure is messy as groups can move in the group structure implying the gid changes and you have to fix up all references. What does reusing a subgroup mean for the gid?

I think your use case could be resolved when groups are internationalised and we distinguish display name and gid. In the end there needs to be unique gid, at the moment we do not expose anything else.

My guess is you really want something else, maybe as described in the Jira Issue. To generate dynamic group membership (query defined groups) or have staff/student groups and course enrolement groups and assign access rights to members of the intersection.

It is possible to do this in code at the moment with dynamic authorities like we use for ownership but there is no general support for group intersection.

I agree, out of the box, what you want to do is currently a pain.

What are you using for identity management outside alfresco? If you are using LDAP for example, you may be able to use query based groups exported and manged from LDAP. (I have not tried this.)

Andy

[renspr]

Hi Andy,

Nested groups are supported but not via the standard UI.

thanks for the clarification. I was confused by the UI. I started to experiment with nested groups using the standard UI and thought it is a general constraint. We are developing our own UI using JBoss Seam and using AMP, Webscripts and Webservices on the Alfresco side. So using a code based approach would not be a problem. I will have a look at the documentation…

Thanks, René