Home » Authentication » LiveUser » Bug #8522

[2006-08-21 00:53 UTC] jan dot bolmeson at ecotech dot se

Description:
------------
I have been trying to get this right the last couple of hours but I don't seem to get it work. The situatiopn is as follows; I have a UserA , he is a member of GroupA and GroupB.

GroupA and GroupB both have the RightA but at different right levels. GroupA at level 3 whereas GroupB at level -3. So far so good.

Now when I check the right for the user it returns tells me that the current right_level is 3.

What I have tried:
1. I added a user right at level -3. It returned 0 (don't know why 0 instead of -3, but that's ok)
2. I removed membership of GroupA. Returned -3 -correctly.

So the question stands - if a right is assigned two several groups at different levels - how is the right level calculated?

Expected result:
----------------
see description.

Actual result:
--------------
see description.

[2006-08-21 01:10 UTC] jan dot bolmeson at ecotech dot se

I just dug a little bit deeper and went for the readGroupRights() function in DB.php:270. It fetches group rights with a MAX-condition and hence only pick up a right once and then with the max right_level.

SELECT GR.right_id, MAX( GR.right_level )
FROM liveuser_grouprights GR
WHERE GR.group_id
IN ( GroupA_ID , GroupB_ID )
GROUP BY GR.right_id
LIMIT 0 , 50

If the situaiton is as in my example below - the other groups right_level at -3 is ignored.

In my point of view negated rights should always have precedence? Or what do you think?

[2006-08-21 01:12 UTC] jan dot bolmeson at ecotech dot se

I replaced MAX with SUM in my version... just a thought...

[2006-08-21 12:53 UTC] jan dot bolmeson at ecotech dot se

Hi Lukas,

Thanks for your quick reply - but I don't really agree with you. As I wrote in the bug report and you say - it WORKS if the right's negated by a userright - but why don't you want this behaviour for grouprights as well?

In my point of view declined rights should always precede rights that give access. Whereas user rights have precedence above grouprights just as it is implemented.

In my application with several hundred rights, groups and users I don't want to put a user right on every user - instead I want to be able to put the user in a group that determines the rights.

E.g. I have a Normal group which gives the user a set of rights. Now when I add a limited user account I still want him to have the rights from the Normal group except one or two. In my point of view - the easiest thing should be to add the user to a Limited Group.

Now I could add all the normal rights except for the two, but that seem redundant (with 80+ rights)- so I wanted Limited to consist of two rights with level -3. Hence the bug report?

Am thinking in a wrong direction, or how would you solve the matter?

Thanks in advance,
Jan Bolmeson
ZCE

[2006-08-21 17:49 UTC] jan dot bolmeson at ecotech dot se

Hi (again)!

I am not going to try to convince you, you have made a great job with the package and you have my full trust. I have been happy ever since I figured out that SUM() solved my problem - the rest is just my opinion... :)

I agree with you that rights should be divided into subsets but after a while even the smallest subsets tend to grow. =o|

The thing that cought my attention was that (this wasn't documented in your docs and) your default choice between accepting or denying access you choose to give rather then forbid. This was just opposite to what I have been though... :)

Keep up the good work!
Jan Bolmeson
ZCE