0

Can usergrid support User's in (Group or Role) have access to ALL user's in same (Group or Role)? The way i understand it is because users are in /users/user1, you would have to iterate over all the users in the group and give explicit permissions to a (group/role/user). Can you prefix user's /users/group_user1?

Could use the organization / application but /users and permissions are specific to a single application.

Basically I want to model organization and groups within a single usergrid application, things such as inheriting permissions, etc.

Any ideas? I am going about this in the wrong way? Other frameworks/apis?

1
  • Can you clarify what you mean? You say you want for a user in a group to have access to other users in the same group? I don't understand what that means. Do you want the first user to be able to edit the other user records? Or do you mean that you want the first user to have the same permissions as the other users in the group?
    – rockerston
    May 9, 2014 at 17:50

2 Answers 2

1

Users are linked within a role, so depending on how you configure your roles you can do set a resource within a role like this:

/roles/{role uuid}/users/*

Which would look more like this in a real example:

/roles/7a7fbe9ec74-70f39f37-1825-379f-8385/users/*

You can then set your verbs (GET, POST, DELETE) as you see fit within that role to allow all members of that role to see or change users within that role. I assume you're looking for them to be able to do a GET but if you have additional linked resources below that user, you can add them explicitly as well like this:

/roles/7a7fbe9ec74-70f39f37-1825-379f-8385/users/*/mylinkedrsource/**

Then you can set the verb to GET for roles/{id}/users/* and add POST or PUT for the resources linked below /users/*/{linked resource}

1
  • That is great info. So you would do the permissions like this? # Admin of Group1 can GET/PUT/POST/DELETE all user's in this role /roles/group1_admin/permissions -> /roles/group1_admin/users/** # Users in role group1_admin can GET/PUT/POST/DELETE all users in group 1/groups/group1/roles -> group1_admin`
    – dre
    May 11, 2014 at 5:02
0

Cross posting from the usergrid google group:

I think you can do what you need with groups.

The idea with groups is that all users in that group get the group's permissions.

So if you do this:

  1. create a group.
  2. give that group permissions for various resources
  3. add users to that group
  4. all users in the group will have the permissions of the group

or

  1. create a group
  2. create various roles, each with various permissions
  3. add the various roles to the group
  4. add users to the group
  5. all users in the group will have the roles (and thus the permissions) of the group

So in this way, you could create various roles for your users. And add users to roles as needed to satisfy the needs of the users. Then, you can create one group for admins. Add all the roles to that admin group, then add your admin users to that admin group. They will have the collective permissions of all the roles.

1
  • can the same be done for apps ? For example App X under Organization A has access to data in App Y ( which is also under Organization A ) ? Oct 7, 2014 at 8:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.