[xwiki-devs] [Proposal] Members of subwiki migration
Hi developers! In Workspaces, we used to add global users in the XWikiAllGroup page of a subwiki to indicate that they are members of that wiki. Now, we have an option called "user scope", and we can have both global & local users in a subwiki. That means we have global & local users in XWikiAllGroup. Then, it is a problem because it can not work when XWikiAllGroup is a virtual group [1]. Then, I have proposed to create a new group, called XWikiMemberGroup, that hold the members of the subwiki. (Note: XWikiAllGroup will be a member of XWikiMemberGroup, in order to say "a local user is a member"). So, I have written a migration (again!) [2], to create the new group with the current content of XWikiAllGroup. In this migration, I also changes all existing rights that occur on XWikiAllGroup to make them effective for XWikiMemberGroup. I did not want to duplicate these rights by just adding the sames for XWikiMemberGroup. I think it is easier for the user to only take care of the XWikiMemberGroup. But it looks a bit "magical", and some people don't like it. I would like to have your opinion. +1 for adding XWikiMemberGroup and to "migrate" rights (replace all rights given to XWikiAllGroup by rights given to XWikiMemberGroup). Thanks, Louis-Marie [1] http://jira.xwiki.org/browse/XWIKI-9886 - Enabling virtual XWikiAllGroup breaks wiki membership [2] https://github.com/xwiki/xwiki-platform/compare/feature-wiki-members - Git branch for this proposal
Hi Guillaume, I'm not sure that it's a good idea to manage all local users in a same group given the fact that you may have different subwikis: you will loose information about these members (you know they are locals but you don't know from which subwiki). Why not using a thesubwikiyouwant:XWiki.XWikiAllGroup page in each subwiki (only when there is local_user in userScope)? Just an idea, maybe I don't understand all the implications. Sincerely, -- Jean On mar., 2014-01-21 at 17:31 +0100, Guillaume "Louis-Marie" Delhumeau wrote:
Hi developers!
In Workspaces, we used to add global users in the XWikiAllGroup page of a subwiki to indicate that they are members of that wiki.
Now, we have an option called "user scope", and we can have both global & local users in a subwiki. That means we have global & local users in XWikiAllGroup.
Then, it is a problem because it can not work when XWikiAllGroup is a virtual group [1].
Then, I have proposed to create a new group, called XWikiMemberGroup, that hold the members of the subwiki. (Note: XWikiAllGroup will be a member of XWikiMemberGroup, in order to say "a local user is a member").
So, I have written a migration (again!) [2], to create the new group with the current content of XWikiAllGroup. In this migration, I also changes all existing rights that occur on XWikiAllGroup to make them effective for XWikiMemberGroup. I did not want to duplicate these rights by just adding the sames for XWikiMemberGroup. I think it is easier for the user to only take care of the XWikiMemberGroup. But it looks a bit "magical", and some people don't like it.
I would like to have your opinion.
+1 for adding XWikiMemberGroup and to "migrate" rights (replace all rights given to XWikiAllGroup by rights given to XWikiMemberGroup).
Thanks, Louis-Marie
[1] http://jira.xwiki.org/browse/XWIKI-9886 - Enabling virtual XWikiAllGroup breaks wiki membership [2] https://github.com/xwiki/xwiki-platform/compare/feature-wiki-members - Git branch for this proposal _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
Hi Guillaume, I'm not sure that it's a good idea to manage all local users in a same group given the fact that you may have different subwikis: you will loose information about these members (you know they are locals but you don't know from which subwiki). Why not using a thesubwikiyouwant:XWiki.XWikiAllGroup page in each subwiki (only when there is local_user in userScope)? Just an idea, maybe I don't understand all the implications. Sincerely, -- Jean On mar., 2014-01-21 at 17:31 +0100, Guillaume "Louis-Marie" Delhumeau wrote:
Hi developers!
In Workspaces, we used to add global users in the XWikiAllGroup page of a subwiki to indicate that they are members of that wiki.
Now, we have an option called "user scope", and we can have both global & local users in a subwiki. That means we have global & local users in XWikiAllGroup.
Then, it is a problem because it can not work when XWikiAllGroup is a virtual group [1].
Then, I have proposed to create a new group, called XWikiMemberGroup, that hold the members of the subwiki. (Note: XWikiAllGroup will be a member of XWikiMemberGroup, in order to say "a local user is a member").
So, I have written a migration (again!) [2], to create the new group with the current content of XWikiAllGroup. In this migration, I also changes all existing rights that occur on XWikiAllGroup to make them effective for XWikiMemberGroup. I did not want to duplicate these rights by just adding the sames for XWikiMemberGroup. I think it is easier for the user to only take care of the XWikiMemberGroup. But it looks a bit "magical", and some people don't like it.
I would like to have your opinion.
+1 for adding XWikiMemberGroup and to "migrate" rights (replace all rights given to XWikiAllGroup by rights given to XWikiMemberGroup).
Thanks, Louis-Marie
[1] http://jira.xwiki.org/browse/XWIKI-9886 - Enabling virtual XWikiAllGroup breaks wiki membership [2] https://github.com/xwiki/xwiki-platform/compare/feature-wiki-members - Git branch for this proposal _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
Hi Guillaume, I'm not sure that it's a good idea to manage all local users in a same group given the fact that you may have different subwikis: you will loose information about these members (you know they are locals but you don't know from which subwiki). Why not using a XWiki.XWikiAllGroup page in each subwiki (only when there is local_user in userScope)? Just an idea, maybe I don't understand all the implications. Sincerely, -- Jean On mar., 2014-01-21 at 17:31 +0100, Guillaume "Louis-Marie" Delhumeau wrote:
Hi developers!
In Workspaces, we used to add global users in the XWikiAllGroup page of a subwiki to indicate that they are members of that wiki.
Now, we have an option called "user scope", and we can have both global & local users in a subwiki. That means we have global & local users in XWikiAllGroup.
Then, it is a problem because it can not work when XWikiAllGroup is a virtual group [1].
Then, I have proposed to create a new group, called XWikiMemberGroup, that hold the members of the subwiki. (Note: XWikiAllGroup will be a member of XWikiMemberGroup, in order to say "a local user is a member").
So, I have written a migration (again!) [2], to create the new group with the current content of XWikiAllGroup. In this migration, I also changes all existing rights that occur on XWikiAllGroup to make them effective for XWikiMemberGroup. I did not want to duplicate these rights by just adding the sames for XWikiMemberGroup. I think it is easier for the user to only take care of the XWikiMemberGroup. But it looks a bit "magical", and some people don't like it.
I would like to have your opinion.
+1 for adding XWikiMemberGroup and to "migrate" rights (replace all rights given to XWikiAllGroup by rights given to XWikiMemberGroup).
Thanks, Louis-Marie
[1] http://jira.xwiki.org/browse/XWIKI-9886 - Enabling virtual XWikiAllGroup breaks wiki membership [2] https://github.com/xwiki/xwiki-platform/compare/feature-wiki-members - Git branch for this proposal _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
Hi Jean. I might not have been clear about the issue. There is already an XWikiAllGroup page per wiki. The proposal is about creating a new group called XWikiMemberGroup that can contains global users (because XWikiAllGroup can not in some cases). 2014/1/21 Jean SIMARD <[email protected]>
Hi Guillaume,
I'm not sure that it's a good idea to manage all local users in a same group given the fact that you may have different subwikis: you will loose information about these members (you know they are locals but you don't know from which subwiki). Why not using a XWiki.XWikiAllGroup page in each subwiki (only when there is local_user in userScope)? Just an idea, maybe I don't understand all the implications.
Sincerely, -- Jean
On mar., 2014-01-21 at 17:31 +0100, Guillaume "Louis-Marie" Delhumeau wrote:
Hi developers!
In Workspaces, we used to add global users in the XWikiAllGroup page of a subwiki to indicate that they are members of that wiki.
Now, we have an option called "user scope", and we can have both global & local users in a subwiki. That means we have global & local users in XWikiAllGroup.
Then, it is a problem because it can not work when XWikiAllGroup is a virtual group [1].
Then, I have proposed to create a new group, called XWikiMemberGroup, that hold the members of the subwiki. (Note: XWikiAllGroup will be a member of XWikiMemberGroup, in order to say "a local user is a member").
So, I have written a migration (again!) [2], to create the new group with the current content of XWikiAllGroup. In this migration, I also changes all existing rights that occur on XWikiAllGroup to make them effective for XWikiMemberGroup. I did not want to duplicate these rights by just adding the sames for XWikiMemberGroup. I think it is easier for the user to only take care of the XWikiMemberGroup. But it looks a bit "magical", and some people don't like it.
I would like to have your opinion.
+1 for adding XWikiMemberGroup and to "migrate" rights (replace all rights given to XWikiAllGroup by rights given to XWikiMemberGroup).
Thanks, Louis-Marie
[1] http://jira.xwiki.org/browse/XWIKI-9886 - Enabling virtual XWikiAllGroup breaks wiki membership [2] https://github.com/xwiki/xwiki-platform/compare/feature-wiki-members- Git branch for this proposal _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
_______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
Why not make virtual XWikiAllGroup also contain global users? We can make: xwiki.authentication.group.allgroupimplicit=0 -> no xwiki.authentication.group.allgroupimplicit=1 -> yes, all local users xwiki.authentication.group.allgroupimplicit=2 -> yes, local and global Or do you want to have only some global users, not all of them? On 01/21/2014 11:31 AM, Guillaume "Louis-Marie" Delhumeau wrote:
Hi developers!
In Workspaces, we used to add global users in the XWikiAllGroup page of a subwiki to indicate that they are members of that wiki.
Now, we have an option called "user scope", and we can have both global & local users in a subwiki. That means we have global & local users in XWikiAllGroup.
Then, it is a problem because it can not work when XWikiAllGroup is a virtual group [1].
Then, I have proposed to create a new group, called XWikiMemberGroup, that hold the members of the subwiki. (Note: XWikiAllGroup will be a member of XWikiMemberGroup, in order to say "a local user is a member").
So, I have written a migration (again!) [2], to create the new group with the current content of XWikiAllGroup. In this migration, I also changes all existing rights that occur on XWikiAllGroup to make them effective for XWikiMemberGroup. I did not want to duplicate these rights by just adding the sames for XWikiMemberGroup. I think it is easier for the user to only take care of the XWikiMemberGroup. But it looks a bit "magical", and some people don't like it.
I would like to have your opinion.
+1 for adding XWikiMemberGroup and to "migrate" rights (replace all rights given to XWikiAllGroup by rights given to XWikiMemberGroup).
Thanks, Louis-Marie
[1] http://jira.xwiki.org/browse/XWIKI-9886 - Enabling virtual XWikiAllGroup breaks wiki membership [2] https://github.com/xwiki/xwiki-platform/compare/feature-wiki-members - Git branch for this proposal
-- Sergiu Dumitriu http://purl.org/net/sergiu
Sergiu: Exactly, I don't have to have all global users in the this group. Only those who are considered as "members" (ie: they have joined the wiki). 2014/1/21 Sergiu Dumitriu <[email protected]>
Why not make virtual XWikiAllGroup also contain global users?
We can make:
xwiki.authentication.group.allgroupimplicit=0 -> no xwiki.authentication.group.allgroupimplicit=1 -> yes, all local users xwiki.authentication.group.allgroupimplicit=2 -> yes, local and global
Or do you want to have only some global users, not all of them?
On 01/21/2014 11:31 AM, Guillaume "Louis-Marie" Delhumeau wrote:
Hi developers!
In Workspaces, we used to add global users in the XWikiAllGroup page of a subwiki to indicate that they are members of that wiki.
Now, we have an option called "user scope", and we can have both global & local users in a subwiki. That means we have global & local users in XWikiAllGroup.
Then, it is a problem because it can not work when XWikiAllGroup is a virtual group [1].
Then, I have proposed to create a new group, called XWikiMemberGroup, that hold the members of the subwiki. (Note: XWikiAllGroup will be a member of XWikiMemberGroup, in order to say "a local user is a member").
So, I have written a migration (again!) [2], to create the new group with the current content of XWikiAllGroup. In this migration, I also changes all existing rights that occur on XWikiAllGroup to make them effective for XWikiMemberGroup. I did not want to duplicate these rights by just adding the sames for XWikiMemberGroup. I think it is easier for the user to only take care of the XWikiMemberGroup. But it looks a bit "magical", and some people don't like it.
I would like to have your opinion.
+1 for adding XWikiMemberGroup and to "migrate" rights (replace all rights given to XWikiAllGroup by rights given to XWikiMemberGroup).
Thanks, Louis-Marie
[1] http://jira.xwiki.org/browse/XWIKI-9886 - Enabling virtual XWikiAllGroup breaks wiki membership [2] https://github.com/xwiki/xwiki-platform/compare/feature-wiki-members- Git branch for this proposal
-- Sergiu Dumitriu http://purl.org/net/sergiu _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
Just to add some precisions: = What the migrator do = 1. Create a group XWikiMemberGroup, with XWikiAllGroup as the first member. 2. All global users of XWikiAllGroup are put inside XWikiMemberGroup and removed from XWikiAllGroup. 3. All rights concerning XWikiAllGroup are changed (ex: "view for XWikiAllGroup" -> "view for XWikiMemberGroup"). It does not break anything since XWikiAllGroup is a member of XWikiMemberGroup. 4. All candidacies (ie: join requests, etc...) are moved form XWikiAllGroup to XWikiMemberGroup, to be consistent. 2014/1/21 Guillaume "Louis-Marie" Delhumeau <[email protected]>
Sergiu: Exactly, I don't have to have all global users in the this group. Only those who are considered as "members" (ie: they have joined the wiki).
2014/1/21 Sergiu Dumitriu <[email protected]>
Why not make virtual XWikiAllGroup also contain global users?
We can make:
xwiki.authentication.group.allgroupimplicit=0 -> no xwiki.authentication.group.allgroupimplicit=1 -> yes, all local users xwiki.authentication.group.allgroupimplicit=2 -> yes, local and global
Or do you want to have only some global users, not all of them?
On 01/21/2014 11:31 AM, Guillaume "Louis-Marie" Delhumeau wrote:
Hi developers!
In Workspaces, we used to add global users in the XWikiAllGroup page of a subwiki to indicate that they are members of that wiki.
Now, we have an option called "user scope", and we can have both global & local users in a subwiki. That means we have global & local users in XWikiAllGroup.
Then, it is a problem because it can not work when XWikiAllGroup is a virtual group [1].
Then, I have proposed to create a new group, called XWikiMemberGroup, that hold the members of the subwiki. (Note: XWikiAllGroup will be a member of XWikiMemberGroup, in order to say "a local user is a member").
So, I have written a migration (again!) [2], to create the new group with the current content of XWikiAllGroup. In this migration, I also changes all existing rights that occur on XWikiAllGroup to make them effective for XWikiMemberGroup. I did not want to duplicate these rights by just adding the sames for XWikiMemberGroup. I think it is easier for the user to only take care of the XWikiMemberGroup. But it looks a bit "magical", and some people don't like it.
I would like to have your opinion.
+1 for adding XWikiMemberGroup and to "migrate" rights (replace all rights given to XWikiAllGroup by rights given to XWikiMemberGroup).
Thanks, Louis-Marie
[1] http://jira.xwiki.org/browse/XWIKI-9886 - Enabling virtual XWikiAllGroup breaks wiki membership [2] https://github.com/xwiki/xwiki-platform/compare/feature-wiki-members - Git branch for this proposal
-- Sergiu Dumitriu http://purl.org/net/sergiu _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
Did you check that a virtual XWikiAllGroup correctly propagates to automatic membership in the XWikiMembersGroup? On 01/21/2014 12:06 PM, Guillaume "Louis-Marie" Delhumeau wrote:
Just to add some precisions:
= What the migrator do = 1. Create a group XWikiMemberGroup, with XWikiAllGroup as the first member. 2. All global users of XWikiAllGroup are put inside XWikiMemberGroup and removed from XWikiAllGroup. 3. All rights concerning XWikiAllGroup are changed (ex: "view for XWikiAllGroup" -> "view for XWikiMemberGroup"). It does not break anything since XWikiAllGroup is a member of XWikiMemberGroup. 4. All candidacies (ie: join requests, etc...) are moved form XWikiAllGroup to XWikiMemberGroup, to be consistent.
2014/1/21 Guillaume "Louis-Marie" Delhumeau <[email protected]>
Sergiu: Exactly, I don't have to have all global users in the this group. Only those who are considered as "members" (ie: they have joined the wiki).
2014/1/21 Sergiu Dumitriu <[email protected]>
Why not make virtual XWikiAllGroup also contain global users?
We can make:
xwiki.authentication.group.allgroupimplicit=0 -> no xwiki.authentication.group.allgroupimplicit=1 -> yes, all local users xwiki.authentication.group.allgroupimplicit=2 -> yes, local and global
Or do you want to have only some global users, not all of them?
On 01/21/2014 11:31 AM, Guillaume "Louis-Marie" Delhumeau wrote:
Hi developers!
In Workspaces, we used to add global users in the XWikiAllGroup page of a subwiki to indicate that they are members of that wiki.
Now, we have an option called "user scope", and we can have both global & local users in a subwiki. That means we have global & local users in XWikiAllGroup.
Then, it is a problem because it can not work when XWikiAllGroup is a virtual group [1].
Then, I have proposed to create a new group, called XWikiMemberGroup, that hold the members of the subwiki. (Note: XWikiAllGroup will be a member of XWikiMemberGroup, in order to say "a local user is a member").
So, I have written a migration (again!) [2], to create the new group with the current content of XWikiAllGroup. In this migration, I also changes all existing rights that occur on XWikiAllGroup to make them effective for XWikiMemberGroup. I did not want to duplicate these rights by just adding the sames for XWikiMemberGroup. I think it is easier for the user to only take care of the XWikiMemberGroup. But it looks a bit "magical", and some people don't like it.
I would like to have your opinion.
+1 for adding XWikiMemberGroup and to "migrate" rights (replace all rights given to XWikiAllGroup by rights given to XWikiMemberGroup).
Thanks, Louis-Marie
[1] http://jira.xwiki.org/browse/XWIKI-9886 - Enabling virtual XWikiAllGroup breaks wiki membership [2] https://github.com/xwiki/xwiki-platform/compare/feature-wiki-members - Git branch for this proposal
-- Sergiu Dumitriu http://purl.org/net/sergiu
2014/1/21 Sergiu Dumitriu <[email protected]>
Did you check that a virtual XWikiAllGroup correctly propagates to automatic membership in the XWikiMembersGroup?
No. I will do it ASAP.
On 01/21/2014 12:06 PM, Guillaume "Louis-Marie" Delhumeau wrote:
Just to add some precisions:
= What the migrator do = 1. Create a group XWikiMemberGroup, with XWikiAllGroup as the first member. 2. All global users of XWikiAllGroup are put inside XWikiMemberGroup and removed from XWikiAllGroup. 3. All rights concerning XWikiAllGroup are changed (ex: "view for XWikiAllGroup" -> "view for XWikiMemberGroup"). It does not break anything since XWikiAllGroup is a member of XWikiMemberGroup. 4. All candidacies (ie: join requests, etc...) are moved form XWikiAllGroup to XWikiMemberGroup, to be consistent.
2014/1/21 Guillaume "Louis-Marie" Delhumeau <[email protected]>
Sergiu: Exactly, I don't have to have all global users in the this group. Only those who are considered as "members" (ie: they have joined the wiki).
2014/1/21 Sergiu Dumitriu <[email protected]>
Why not make virtual XWikiAllGroup also contain global users?
We can make:
xwiki.authentication.group.allgroupimplicit=0 -> no xwiki.authentication.group.allgroupimplicit=1 -> yes, all local users xwiki.authentication.group.allgroupimplicit=2 -> yes, local and global
Or do you want to have only some global users, not all of them?
On 01/21/2014 11:31 AM, Guillaume "Louis-Marie" Delhumeau wrote:
Hi developers!
In Workspaces, we used to add global users in the XWikiAllGroup page of a subwiki to indicate that they are members of that wiki.
Now, we have an option called "user scope", and we can have both global & local users in a subwiki. That means we have global & local users in XWikiAllGroup.
Then, it is a problem because it can not work when XWikiAllGroup is a virtual group [1].
Then, I have proposed to create a new group, called XWikiMemberGroup, that hold the members of the subwiki. (Note: XWikiAllGroup will be a member of XWikiMemberGroup, in order to say "a local user is a member").
So, I have written a migration (again!) [2], to create the new group with the current content of XWikiAllGroup. In this migration, I also changes all existing rights that occur on XWikiAllGroup to make them effective for XWikiMemberGroup. I did not want to duplicate these rights by just adding the sames for XWikiMemberGroup. I think it is easier for the user to only take care of the XWikiMemberGroup. But it looks a bit "magical", and some people don't like it.
I would like to have your opinion.
+1 for adding XWikiMemberGroup and to "migrate" rights (replace all rights given to XWikiAllGroup by rights given to XWikiMemberGroup).
Thanks, Louis-Marie
[1] http://jira.xwiki.org/browse/XWIKI-9886 - Enabling virtual XWikiAllGroup breaks wiki membership [2] https://github.com/xwiki/xwiki-platform/compare/feature-wiki-members - Git branch for this proposal
-- Sergiu Dumitriu http://purl.org/net/sergiu _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
2014/1/21 Guillaume "Louis-Marie" Delhumeau <[email protected]>
Just to add some precisions:
= What the migrator do = 1. Create a group XWikiMemberGroup, with XWikiAllGroup as the first member. 2. All global users of XWikiAllGroup are put inside XWikiMemberGroup and removed from XWikiAllGroup. 3. All rights concerning XWikiAllGroup are changed (ex: "view for XWikiAllGroup" -> "view for XWikiMemberGroup"). It does not break anything since XWikiAllGroup is a member of XWikiMemberGroup. 4. All candidacies (ie: join requests, etc...) are moved form XWikiAllGroup to XWikiMemberGroup, to be consistent.
Of course, this migration is only done on subwikis.
2014/1/21 Guillaume "Louis-Marie" Delhumeau <[email protected]>
Sergiu: Exactly, I don't have to have all global users in the this group. Only those who are considered as "members" (ie: they have joined the wiki).
2014/1/21 Sergiu Dumitriu <[email protected]>
Why not make virtual XWikiAllGroup also contain global users?
We can make:
xwiki.authentication.group.allgroupimplicit=0 -> no xwiki.authentication.group.allgroupimplicit=1 -> yes, all local users xwiki.authentication.group.allgroupimplicit=2 -> yes, local and global
Or do you want to have only some global users, not all of them?
On 01/21/2014 11:31 AM, Guillaume "Louis-Marie" Delhumeau wrote:
Hi developers!
In Workspaces, we used to add global users in the XWikiAllGroup page of a subwiki to indicate that they are members of that wiki.
Now, we have an option called "user scope", and we can have both global & local users in a subwiki. That means we have global & local users in XWikiAllGroup.
Then, it is a problem because it can not work when XWikiAllGroup is a virtual group [1].
Then, I have proposed to create a new group, called XWikiMemberGroup, that hold the members of the subwiki. (Note: XWikiAllGroup will be a member of XWikiMemberGroup, in order to say "a local user is a member").
So, I have written a migration (again!) [2], to create the new group with the current content of XWikiAllGroup. In this migration, I also changes all existing rights that occur on XWikiAllGroup to make them effective for XWikiMemberGroup. I did not want to duplicate these rights by just adding the sames for XWikiMemberGroup. I think it is easier for the user to only take care of the XWikiMemberGroup. But it looks a bit "magical", and some people don't like it.
I would like to have your opinion.
+1 for adding XWikiMemberGroup and to "migrate" rights (replace all rights given to XWikiAllGroup by rights given to XWikiMemberGroup).
Thanks, Louis-Marie
[1] http://jira.xwiki.org/browse/XWIKI-9886 - Enabling virtual XWikiAllGroup breaks wiki membership [2] https://github.com/xwiki/xwiki-platform/compare/feature-wiki-members - Git branch for this proposal
-- Sergiu Dumitriu http://purl.org/net/sergiu _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
Hi Guillaume, I am definitely -1 to systematically replace XWikiAllGroup by XWikiMemberGroup in any subwiki: 1) because I do not see the meaning of XWikiMemberGroup in the myxwiki.orguse case. 2) because XWikiAllGroup is an habits for many existing user 3) because existing application/extension/scripts may attribute rights to XWikiAllGroup 4) because this could cause confusion if some right are attributed to XWikiAllGroup and others to XWikiMemberGroup, by a mixup of old and new habits. Since we definitely want to use implicit XWikiAllGroup, I do understand that you need a solution for workspace that may be joined by global users. The below proposal should allow you to do so without migrating existing installation. It apply only to subwikis. After thinking about the different possibilities, my best bet to a smooth migration is to keep XWikiAllGroup for its previous meaning: "All authenticated users having access to this wiki" (unless implicit, which restrict it currently to "All Local Users"). Keeping the meaning and potential usage of the group is the key IMO. To support selected global users to enter the implicit XWikiAllGroup, I simply suggest to add implicitly a group as a member of XWikiAllGroup. It could be called XWikiGlobalMemberGroup to be more explicit, and always be a member of the implicit XWikiAllGroup when xwiki.authentication.group.allgroupimplicit=2. Then: A) when xwiki.authentication.group.allgroupimplicit=0, and XWikiAllGroup (not implicit) does not have a member XWikiGlobalMemberGroup. Do not do any migration, and keep the current join behavior, using exclusively XWikiAllGroup for both local and global users. B) when xwiki.authentication.group.allgroupimplicit=1, keep the existing behavior, obviously prevent any global user to join, do not provide global user scope in wiki creation, and warn on the wiki setting if the user scope is incompatible with the current implicit setting. C) when xwiki.authentication.group.allgroupimplicit=2, check at startup that a XWikiGlobalMemberGroup exists, else create it and migrate any global users in XWikiAllGroup to XWikiGlobalMemberGroup. D) when xwiki.authentication.group.allgroupimplicit=2, or when xwiki.authentication.group.allgroupimplicit=0 and XWikiAllGroup contains XWikiGlobalMemberGroup, use the new behavior, allowing creation of all user scopes, removing any warnings, joining global users to the XWikiGlobalMemberGroup (and local users to the XWikiAllGroups if not implicit). The net benefit of the above proposal is to keep actual habits and existing use cases untouched. Moreover, the security is ensured to be kept as it is with no risk of side effect, which is priority. WDTH ? Obviously, my +1 for the above proposal. Thanks, On Tue, Jan 21, 2014 at 6:50 PM, Guillaume "Louis-Marie" Delhumeau < [email protected]> wrote:
2014/1/21 Guillaume "Louis-Marie" Delhumeau <[email protected]>
Just to add some precisions:
= What the migrator do = 1. Create a group XWikiMemberGroup, with XWikiAllGroup as the first member. 2. All global users of XWikiAllGroup are put inside XWikiMemberGroup and removed from XWikiAllGroup. 3. All rights concerning XWikiAllGroup are changed (ex: "view for XWikiAllGroup" -> "view for XWikiMemberGroup"). It does not break anything since XWikiAllGroup is a member of XWikiMemberGroup. 4. All candidacies (ie: join requests, etc...) are moved form XWikiAllGroup to XWikiMemberGroup, to be consistent.
Of course, this migration is only done on subwikis.
2014/1/21 Guillaume "Louis-Marie" Delhumeau <[email protected]>
Sergiu: Exactly, I don't have to have all global users in the this group. Only those who are considered as "members" (ie: they have joined the wiki).
2014/1/21 Sergiu Dumitriu <[email protected]>
Why not make virtual XWikiAllGroup also contain global users?
We can make:
xwiki.authentication.group.allgroupimplicit=0 -> no xwiki.authentication.group.allgroupimplicit=1 -> yes, all local users xwiki.authentication.group.allgroupimplicit=2 -> yes, local and global
Or do you want to have only some global users, not all of them?
On 01/21/2014 11:31 AM, Guillaume "Louis-Marie" Delhumeau wrote:
Hi developers!
In Workspaces, we used to add global users in the XWikiAllGroup page of a subwiki to indicate that they are members of that wiki.
Now, we have an option called "user scope", and we can have both global & local users in a subwiki. That means we have global & local users in XWikiAllGroup.
Then, it is a problem because it can not work when XWikiAllGroup is a virtual group [1].
Then, I have proposed to create a new group, called XWikiMemberGroup, that hold the members of the subwiki. (Note: XWikiAllGroup will be a
member
of
XWikiMemberGroup, in order to say "a local user is a member").
So, I have written a migration (again!) [2], to create the new group with the current content of XWikiAllGroup. In this migration, I also changes all existing rights that occur on XWikiAllGroup to make them effective for XWikiMemberGroup. I did not want to duplicate these rights by just adding the sames for XWikiMemberGroup. I think it is easier for the user to only take care of the XWikiMemberGroup. But it looks a bit "magical", and some people don't like it.
I would like to have your opinion.
+1 for adding XWikiMemberGroup and to "migrate" rights (replace all rights given to XWikiAllGroup by rights given to XWikiMemberGroup).
Thanks, Louis-Marie
[1] http://jira.xwiki.org/browse/XWIKI-9886 - Enabling virtual XWikiAllGroup breaks wiki membership [2] https://github.com/xwiki/xwiki-platform/compare/feature-wiki-members - Git branch for this proposal
-- Sergiu Dumitriu http://purl.org/net/sergiu _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
_______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
-- Denis Gervalle SOFTEC sa - CEO
The proposal made by Denis sounds better to me. +1 Thanks, Marius On Jan 21, 2014 8:53 PM, "Denis Gervalle" <[email protected]> wrote:
Hi Guillaume,
I am definitely -1 to systematically replace XWikiAllGroup by XWikiMemberGroup in any subwiki:
1) because I do not see the meaning of XWikiMemberGroup in the myxwiki.orguse case. 2) because XWikiAllGroup is an habits for many existing user 3) because existing application/extension/scripts may attribute rights to XWikiAllGroup 4) because this could cause confusion if some right are attributed to XWikiAllGroup and others to XWikiMemberGroup, by a mixup of old and new habits.
Since we definitely want to use implicit XWikiAllGroup, I do understand that you need a solution for workspace that may be joined by global users. The below proposal should allow you to do so without migrating existing installation. It apply only to subwikis.
After thinking about the different possibilities, my best bet to a smooth migration is to keep XWikiAllGroup for its previous meaning: "All authenticated users having access to this wiki" (unless implicit, which restrict it currently to "All Local Users"). Keeping the meaning and potential usage of the group is the key IMO.
To support selected global users to enter the implicit XWikiAllGroup, I simply suggest to add implicitly a group as a member of XWikiAllGroup. It could be called XWikiGlobalMemberGroup to be more explicit, and always be
a
member of the implicit XWikiAllGroup when xwiki.authentication.group.allgroupimplicit=2. Then:
A) when xwiki.authentication.group.allgroupimplicit=0, and XWikiAllGroup (not implicit) does not have a member XWikiGlobalMemberGroup. Do not do any migration, and keep the current join behavior, using exclusively XWikiAllGroup for both local and global users.
B) when xwiki.authentication.group.allgroupimplicit=1, keep the existing behavior, obviously prevent any global user to join, do not provide global user scope in wiki creation, and warn on the wiki setting if the user scope is incompatible with the current implicit setting.
C) when xwiki.authentication.group.allgroupimplicit=2, check at startup that a XWikiGlobalMemberGroup exists, else create it and migrate any global users in XWikiAllGroup to XWikiGlobalMemberGroup.
D) when xwiki.authentication.group.allgroupimplicit=2, or when xwiki.authentication.group.allgroupimplicit=0 and XWikiAllGroup contains XWikiGlobalMemberGroup, use the new behavior, allowing creation of all user scopes, removing any warnings, joining global users to the XWikiGlobalMemberGroup (and local users to the XWikiAllGroups if not implicit).
The net benefit of the above proposal is to keep actual habits and existing use cases untouched. Moreover, the security is ensured to be kept as it is with no risk of side effect, which is priority.
WDTH ?
Obviously, my +1 for the above proposal. Thanks,
On Tue, Jan 21, 2014 at 6:50 PM, Guillaume "Louis-Marie" Delhumeau < [email protected]> wrote:
2014/1/21 Guillaume "Louis-Marie" Delhumeau <[email protected]>
Just to add some precisions:
= What the migrator do = 1. Create a group XWikiMemberGroup, with XWikiAllGroup as the first member. 2. All global users of XWikiAllGroup are put inside XWikiMemberGroup and removed from XWikiAllGroup. 3. All rights concerning XWikiAllGroup are changed (ex: "view for XWikiAllGroup" -> "view for XWikiMemberGroup"). It does not break anything since XWikiAllGroup is a member of XWikiMemberGroup. 4. All candidacies (ie: join requests, etc...) are moved form XWikiAllGroup to XWikiMemberGroup, to be consistent.
Of course, this migration is only done on subwikis.
2014/1/21 Guillaume "Louis-Marie" Delhumeau <[email protected]>
Sergiu: Exactly, I don't have to have all global users in the this group.
Only
those who are considered as "members" (ie: they have joined the wiki).
2014/1/21 Sergiu Dumitriu <[email protected]>
Why not make virtual XWikiAllGroup also contain global users?
We can make:
xwiki.authentication.group.allgroupimplicit=0 -> no xwiki.authentication.group.allgroupimplicit=1 -> yes, all local users xwiki.authentication.group.allgroupimplicit=2 -> yes, local and global
Or do you want to have only some global users, not all of them?
On 01/21/2014 11:31 AM, Guillaume "Louis-Marie" Delhumeau wrote:
Hi developers!
In Workspaces, we used to add global users in the XWikiAllGroup page of a subwiki to indicate that they are members of that wiki.
Now, we have an option called "user scope", and we can have both global & local users in a subwiki. That means we have global & local users in XWikiAllGroup.
Then, it is a problem because it can not work when XWikiAllGroup is a virtual group [1].
Then, I have proposed to create a new group, called XWikiMemberGroup, that hold the members of the subwiki. (Note: XWikiAllGroup will be a member of XWikiMemberGroup, in order to say "a local user is a member").
So, I have written a migration (again!) [2], to create the new group with the current content of XWikiAllGroup. In this migration, I also changes all existing rights that occur on XWikiAllGroup to make them effective for XWikiMemberGroup. I did not want to duplicate these rights by just adding the sames for XWikiMemberGroup. I think it is easier for the user to only take care of the XWikiMemberGroup. But it looks a bit "magical", and some people don't like it.
I would like to have your opinion.
+1 for adding XWikiMemberGroup and to "migrate" rights (replace all rights given to XWikiAllGroup by rights given to XWikiMemberGroup).
Thanks, Louis-Marie
[1] http://jira.xwiki.org/browse/XWIKI-9886 - Enabling virtual XWikiAllGroup breaks wiki membership [2] https://github.com/xwiki/xwiki-platform/compare/feature-wiki-members- Git branch for this proposal
-- Sergiu Dumitriu http://purl.org/net/sergiu _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
_______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
-- Denis Gervalle SOFTEC sa - CEO _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
Denis’ proposal seems good to me too even though I’m probably not understanding all the minute details. But I like the spirit of it. Thanks -Vincent On 21 Jan 2014, at 19:52, Denis Gervalle <[email protected]> wrote:
Hi Guillaume,
I am definitely -1 to systematically replace XWikiAllGroup by XWikiMemberGroup in any subwiki:
1) because I do not see the meaning of XWikiMemberGroup in the myxwiki.orguse case. 2) because XWikiAllGroup is an habits for many existing user 3) because existing application/extension/scripts may attribute rights to XWikiAllGroup 4) because this could cause confusion if some right are attributed to XWikiAllGroup and others to XWikiMemberGroup, by a mixup of old and new habits.
Since we definitely want to use implicit XWikiAllGroup, I do understand that you need a solution for workspace that may be joined by global users. The below proposal should allow you to do so without migrating existing installation. It apply only to subwikis.
After thinking about the different possibilities, my best bet to a smooth migration is to keep XWikiAllGroup for its previous meaning: "All authenticated users having access to this wiki" (unless implicit, which restrict it currently to "All Local Users"). Keeping the meaning and potential usage of the group is the key IMO.
To support selected global users to enter the implicit XWikiAllGroup, I simply suggest to add implicitly a group as a member of XWikiAllGroup. It could be called XWikiGlobalMemberGroup to be more explicit, and always be a member of the implicit XWikiAllGroup when xwiki.authentication.group.allgroupimplicit=2. Then:
A) when xwiki.authentication.group.allgroupimplicit=0, and XWikiAllGroup (not implicit) does not have a member XWikiGlobalMemberGroup. Do not do any migration, and keep the current join behavior, using exclusively XWikiAllGroup for both local and global users.
B) when xwiki.authentication.group.allgroupimplicit=1, keep the existing behavior, obviously prevent any global user to join, do not provide global user scope in wiki creation, and warn on the wiki setting if the user scope is incompatible with the current implicit setting.
C) when xwiki.authentication.group.allgroupimplicit=2, check at startup that a XWikiGlobalMemberGroup exists, else create it and migrate any global users in XWikiAllGroup to XWikiGlobalMemberGroup.
D) when xwiki.authentication.group.allgroupimplicit=2, or when xwiki.authentication.group.allgroupimplicit=0 and XWikiAllGroup contains XWikiGlobalMemberGroup, use the new behavior, allowing creation of all user scopes, removing any warnings, joining global users to the XWikiGlobalMemberGroup (and local users to the XWikiAllGroups if not implicit).
The net benefit of the above proposal is to keep actual habits and existing use cases untouched. Moreover, the security is ensured to be kept as it is with no risk of side effect, which is priority.
WDTH ?
Obviously, my +1 for the above proposal. Thanks,
On Tue, Jan 21, 2014 at 6:50 PM, Guillaume "Louis-Marie" Delhumeau < [email protected]> wrote:
2014/1/21 Guillaume "Louis-Marie" Delhumeau <[email protected]>
Just to add some precisions:
= What the migrator do = 1. Create a group XWikiMemberGroup, with XWikiAllGroup as the first member. 2. All global users of XWikiAllGroup are put inside XWikiMemberGroup and removed from XWikiAllGroup. 3. All rights concerning XWikiAllGroup are changed (ex: "view for XWikiAllGroup" -> "view for XWikiMemberGroup"). It does not break anything since XWikiAllGroup is a member of XWikiMemberGroup. 4. All candidacies (ie: join requests, etc...) are moved form XWikiAllGroup to XWikiMemberGroup, to be consistent.
Of course, this migration is only done on subwikis.
2014/1/21 Guillaume "Louis-Marie" Delhumeau <[email protected]>
Sergiu: Exactly, I don't have to have all global users in the this group. Only those who are considered as "members" (ie: they have joined the wiki).
2014/1/21 Sergiu Dumitriu <[email protected]>
Why not make virtual XWikiAllGroup also contain global users?
We can make:
xwiki.authentication.group.allgroupimplicit=0 -> no xwiki.authentication.group.allgroupimplicit=1 -> yes, all local users xwiki.authentication.group.allgroupimplicit=2 -> yes, local and global
Or do you want to have only some global users, not all of them?
On 01/21/2014 11:31 AM, Guillaume "Louis-Marie" Delhumeau wrote:
Hi developers!
In Workspaces, we used to add global users in the XWikiAllGroup page of a subwiki to indicate that they are members of that wiki.
Now, we have an option called "user scope", and we can have both global & local users in a subwiki. That means we have global & local users in XWikiAllGroup.
Then, it is a problem because it can not work when XWikiAllGroup is a virtual group [1].
Then, I have proposed to create a new group, called XWikiMemberGroup, that hold the members of the subwiki. (Note: XWikiAllGroup will be a
member
of
XWikiMemberGroup, in order to say "a local user is a member").
So, I have written a migration (again!) [2], to create the new group with the current content of XWikiAllGroup. In this migration, I also changes all existing rights that occur on XWikiAllGroup to make them effective for XWikiMemberGroup. I did not want to duplicate these rights by just adding the sames for XWikiMemberGroup. I think it is easier for the user to only take care of the XWikiMemberGroup. But it looks a bit "magical", and some people don't like it.
I would like to have your opinion.
+1 for adding XWikiMemberGroup and to "migrate" rights (replace all rights given to XWikiAllGroup by rights given to XWikiMemberGroup).
Thanks, Louis-Marie
[1] http://jira.xwiki.org/browse/XWIKI-9886 - Enabling virtual XWikiAllGroup breaks wiki membership [2] https://github.com/xwiki/xwiki-platform/compare/feature-wiki-members - Git branch for this proposal
-- Sergiu Dumitriu http://purl.org/net/sergiu _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
_______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
-- Denis Gervalle SOFTEC sa - CEO _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
The proposal of Denis looks good. But is it something we want for 5.4 (next Monday)? I need to modify the UI and test it, and I only have 2 days to do it. But http://jira.xwiki.org/browse/XWIKI-9886 is considered as a blocker. What should we do? 2014/1/22 Vincent Massol <[email protected]>
Denis’ proposal seems good to me too even though I’m probably not understanding all the minute details. But I like the spirit of it.
Thanks -Vincent
On 21 Jan 2014, at 19:52, Denis Gervalle <[email protected]> wrote:
Hi Guillaume,
I am definitely -1 to systematically replace XWikiAllGroup by XWikiMemberGroup in any subwiki:
1) because I do not see the meaning of XWikiMemberGroup in the myxwiki.orguse case. 2) because XWikiAllGroup is an habits for many existing user 3) because existing application/extension/scripts may attribute rights to XWikiAllGroup 4) because this could cause confusion if some right are attributed to XWikiAllGroup and others to XWikiMemberGroup, by a mixup of old and new habits.
Since we definitely want to use implicit XWikiAllGroup, I do understand that you need a solution for workspace that may be joined by global users. The below proposal should allow you to do so without migrating existing installation. It apply only to subwikis.
After thinking about the different possibilities, my best bet to a smooth migration is to keep XWikiAllGroup for its previous meaning: "All authenticated users having access to this wiki" (unless implicit, which restrict it currently to "All Local Users"). Keeping the meaning and potential usage of the group is the key IMO.
To support selected global users to enter the implicit XWikiAllGroup, I simply suggest to add implicitly a group as a member of XWikiAllGroup. It could be called XWikiGlobalMemberGroup to be more explicit, and always be a member of the implicit XWikiAllGroup when xwiki.authentication.group.allgroupimplicit=2. Then:
A) when xwiki.authentication.group.allgroupimplicit=0, and XWikiAllGroup (not implicit) does not have a member XWikiGlobalMemberGroup. Do not do any migration, and keep the current join behavior, using exclusively XWikiAllGroup for both local and global users.
B) when xwiki.authentication.group.allgroupimplicit=1, keep the existing behavior, obviously prevent any global user to join, do not provide global user scope in wiki creation, and warn on the wiki setting if the user scope is incompatible with the current implicit setting.
C) when xwiki.authentication.group.allgroupimplicit=2, check at startup that a XWikiGlobalMemberGroup exists, else create it and migrate any global users in XWikiAllGroup to XWikiGlobalMemberGroup.
D) when xwiki.authentication.group.allgroupimplicit=2, or when xwiki.authentication.group.allgroupimplicit=0 and XWikiAllGroup contains XWikiGlobalMemberGroup, use the new behavior, allowing creation of all user scopes, removing any warnings, joining global users to the XWikiGlobalMemberGroup (and local users to the XWikiAllGroups if not implicit).
The net benefit of the above proposal is to keep actual habits and existing use cases untouched. Moreover, the security is ensured to be kept as it is with no risk of side effect, which is priority.
WDTH ?
Obviously, my +1 for the above proposal. Thanks,
On Tue, Jan 21, 2014 at 6:50 PM, Guillaume "Louis-Marie" Delhumeau < [email protected]> wrote:
2014/1/21 Guillaume "Louis-Marie" Delhumeau <[email protected]>
Just to add some precisions:
= What the migrator do = 1. Create a group XWikiMemberGroup, with XWikiAllGroup as the first member. 2. All global users of XWikiAllGroup are put inside XWikiMemberGroup and removed from XWikiAllGroup. 3. All rights concerning XWikiAllGroup are changed (ex: "view for XWikiAllGroup" -> "view for XWikiMemberGroup"). It does not break anything since XWikiAllGroup is a member of XWikiMemberGroup. 4. All candidacies (ie: join requests, etc...) are moved form XWikiAllGroup to XWikiMemberGroup, to be consistent.
Of course, this migration is only done on subwikis.
2014/1/21 Guillaume "Louis-Marie" Delhumeau <[email protected]>
Sergiu: Exactly, I don't have to have all global users in the this group. Only those who are considered as "members" (ie: they have joined the wiki).
2014/1/21 Sergiu Dumitriu <[email protected]>
Why not make virtual XWikiAllGroup also contain global users?
We can make:
xwiki.authentication.group.allgroupimplicit=0 -> no xwiki.authentication.group.allgroupimplicit=1 -> yes, all local users xwiki.authentication.group.allgroupimplicit=2 -> yes, local and
global
Or do you want to have only some global users, not all of them?
On 01/21/2014 11:31 AM, Guillaume "Louis-Marie" Delhumeau wrote: > Hi developers! > > In Workspaces, we used to add global users in the XWikiAllGroup page of a > subwiki to indicate that they are members of that wiki. > > Now, we have an option called "user scope", and we can have both global & > local users in a subwiki. That means we have global & local users in > XWikiAllGroup. > > Then, it is a problem because it can not work when XWikiAllGroup is
a
> virtual group [1]. > > Then, I have proposed to create a new group, called XWikiMemberGroup, that > hold the members of the subwiki. (Note: XWikiAllGroup will be a member of > XWikiMemberGroup, in order to say "a local user is a member"). > > So, I have written a migration (again!) [2], to create the new group with > the current content of XWikiAllGroup. In this migration, I also changes all > existing rights that occur on XWikiAllGroup to make them effective for > XWikiMemberGroup. I did not want to duplicate these rights by just adding > the sames for XWikiMemberGroup. I think it is easier for the user to only > take care of the XWikiMemberGroup. But it looks a bit "magical", and some > people don't like it. > > I would like to have your opinion. > > +1 for adding XWikiMemberGroup and to "migrate" rights (replace all rights > given to XWikiAllGroup by rights given to XWikiMemberGroup). > > Thanks, > Louis-Marie > > > [1] http://jira.xwiki.org/browse/XWIKI-9886 - Enabling virtual > XWikiAllGroup breaks wiki membership > [2] https://github.com/xwiki/xwiki-platform/compare/feature-wiki-members- > Git branch for this proposal
-- Sergiu Dumitriu http://purl.org/net/sergiu _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
_______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
-- Denis Gervalle SOFTEC sa - CEO _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
_______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
Why not actually fix the problem instead of adding unexpected implicit behavior? Proposal: pseudocode for "is a user in a group": if the group name is XWikiAllGroup and XAG is configured as virtual and the user is local, then return true otherwise, check the standard way, with the object attached to document verification The fact that XWikiAllGroup is configured as virtual doesn't mean that it suddenly becomes an intangible document. On 01/21/2014 01:52 PM, Denis Gervalle wrote:
Hi Guillaume,
I am definitely -1 to systematically replace XWikiAllGroup by XWikiMemberGroup in any subwiki:
1) because I do not see the meaning of XWikiMemberGroup in the myxwiki.orguse case. 2) because XWikiAllGroup is an habits for many existing user 3) because existing application/extension/scripts may attribute rights to XWikiAllGroup 4) because this could cause confusion if some right are attributed to XWikiAllGroup and others to XWikiMemberGroup, by a mixup of old and new habits.
Since we definitely want to use implicit XWikiAllGroup, I do understand that you need a solution for workspace that may be joined by global users. The below proposal should allow you to do so without migrating existing installation. It apply only to subwikis.
After thinking about the different possibilities, my best bet to a smooth migration is to keep XWikiAllGroup for its previous meaning: "All authenticated users having access to this wiki" (unless implicit, which restrict it currently to "All Local Users"). Keeping the meaning and potential usage of the group is the key IMO.
To support selected global users to enter the implicit XWikiAllGroup, I simply suggest to add implicitly a group as a member of XWikiAllGroup. It could be called XWikiGlobalMemberGroup to be more explicit, and always be a member of the implicit XWikiAllGroup when xwiki.authentication.group.allgroupimplicit=2. Then:
A) when xwiki.authentication.group.allgroupimplicit=0, and XWikiAllGroup (not implicit) does not have a member XWikiGlobalMemberGroup. Do not do any migration, and keep the current join behavior, using exclusively XWikiAllGroup for both local and global users.
B) when xwiki.authentication.group.allgroupimplicit=1, keep the existing behavior, obviously prevent any global user to join, do not provide global user scope in wiki creation, and warn on the wiki setting if the user scope is incompatible with the current implicit setting.
C) when xwiki.authentication.group.allgroupimplicit=2, check at startup that a XWikiGlobalMemberGroup exists, else create it and migrate any global users in XWikiAllGroup to XWikiGlobalMemberGroup.
D) when xwiki.authentication.group.allgroupimplicit=2, or when xwiki.authentication.group.allgroupimplicit=0 and XWikiAllGroup contains XWikiGlobalMemberGroup, use the new behavior, allowing creation of all user scopes, removing any warnings, joining global users to the XWikiGlobalMemberGroup (and local users to the XWikiAllGroups if not implicit).
The net benefit of the above proposal is to keep actual habits and existing use cases untouched. Moreover, the security is ensured to be kept as it is with no risk of side effect, which is priority.
WDTH ?
Obviously, my +1 for the above proposal. Thanks,
On Tue, Jan 21, 2014 at 6:50 PM, Guillaume "Louis-Marie" Delhumeau < [email protected]> wrote:
2014/1/21 Guillaume "Louis-Marie" Delhumeau <[email protected]>
Just to add some precisions:
= What the migrator do = 1. Create a group XWikiMemberGroup, with XWikiAllGroup as the first member. 2. All global users of XWikiAllGroup are put inside XWikiMemberGroup and removed from XWikiAllGroup. 3. All rights concerning XWikiAllGroup are changed (ex: "view for XWikiAllGroup" -> "view for XWikiMemberGroup"). It does not break anything since XWikiAllGroup is a member of XWikiMemberGroup. 4. All candidacies (ie: join requests, etc...) are moved form XWikiAllGroup to XWikiMemberGroup, to be consistent.
Of course, this migration is only done on subwikis.
2014/1/21 Guillaume "Louis-Marie" Delhumeau <[email protected]>
Sergiu: Exactly, I don't have to have all global users in the this group. Only those who are considered as "members" (ie: they have joined the wiki).
2014/1/21 Sergiu Dumitriu <[email protected]>
Why not make virtual XWikiAllGroup also contain global users?
We can make:
xwiki.authentication.group.allgroupimplicit=0 -> no xwiki.authentication.group.allgroupimplicit=1 -> yes, all local users xwiki.authentication.group.allgroupimplicit=2 -> yes, local and global
Or do you want to have only some global users, not all of them?
On 01/21/2014 11:31 AM, Guillaume "Louis-Marie" Delhumeau wrote:
Hi developers!
In Workspaces, we used to add global users in the XWikiAllGroup page of a subwiki to indicate that they are members of that wiki.
Now, we have an option called "user scope", and we can have both global & local users in a subwiki. That means we have global & local users in XWikiAllGroup.
Then, it is a problem because it can not work when XWikiAllGroup is a virtual group [1].
Then, I have proposed to create a new group, called XWikiMemberGroup, that hold the members of the subwiki. (Note: XWikiAllGroup will be a
member
of
XWikiMemberGroup, in order to say "a local user is a member").
So, I have written a migration (again!) [2], to create the new group with the current content of XWikiAllGroup. In this migration, I also changes all existing rights that occur on XWikiAllGroup to make them effective for XWikiMemberGroup. I did not want to duplicate these rights by just adding the sames for XWikiMemberGroup. I think it is easier for the user to only take care of the XWikiMemberGroup. But it looks a bit "magical", and some people don't like it.
I would like to have your opinion.
+1 for adding XWikiMemberGroup and to "migrate" rights (replace all rights given to XWikiAllGroup by rights given to XWikiMemberGroup).
Thanks, Louis-Marie
[1] http://jira.xwiki.org/browse/XWIKI-9886 - Enabling virtual XWikiAllGroup breaks wiki membership [2] https://github.com/xwiki/xwiki-platform/compare/feature-wiki-members - Git branch for this proposal
-- Sergiu Dumitriu http://purl.org/net/sergiu
Hi. We have eventually noticed that the bug we tried to fix was invalid (see: http://jira.xwiki.org/browse/XWIKI-9886 ). I have not even tried to reproduce it, I just relied on the description. I won't do it again, I will always try to reproduce the bug before doing anything else. I am sorry for having disturbed you with this thread and I feel ashamed. Louis-Marie 2014-01-25 Sergiu Dumitriu <[email protected]>
Why not actually fix the problem instead of adding unexpected implicit behavior?
Proposal:
pseudocode for "is a user in a group": if the group name is XWikiAllGroup and XAG is configured as virtual and the user is local, then return true otherwise, check the standard way, with the object attached to document verification
The fact that XWikiAllGroup is configured as virtual doesn't mean that it suddenly becomes an intangible document.
On 01/21/2014 01:52 PM, Denis Gervalle wrote:
Hi Guillaume,
I am definitely -1 to systematically replace XWikiAllGroup by XWikiMemberGroup in any subwiki:
1) because I do not see the meaning of XWikiMemberGroup in the myxwiki.orguse case. 2) because XWikiAllGroup is an habits for many existing user 3) because existing application/extension/scripts may attribute rights to XWikiAllGroup 4) because this could cause confusion if some right are attributed to XWikiAllGroup and others to XWikiMemberGroup, by a mixup of old and new habits.
Since we definitely want to use implicit XWikiAllGroup, I do understand that you need a solution for workspace that may be joined by global users. The below proposal should allow you to do so without migrating existing installation. It apply only to subwikis.
After thinking about the different possibilities, my best bet to a smooth migration is to keep XWikiAllGroup for its previous meaning: "All authenticated users having access to this wiki" (unless implicit, which restrict it currently to "All Local Users"). Keeping the meaning and potential usage of the group is the key IMO.
To support selected global users to enter the implicit XWikiAllGroup, I simply suggest to add implicitly a group as a member of XWikiAllGroup. It could be called XWikiGlobalMemberGroup to be more explicit, and always be a member of the implicit XWikiAllGroup when xwiki.authentication.group.allgroupimplicit=2. Then:
A) when xwiki.authentication.group.allgroupimplicit=0, and XWikiAllGroup (not implicit) does not have a member XWikiGlobalMemberGroup. Do not do any migration, and keep the current join behavior, using exclusively XWikiAllGroup for both local and global users.
B) when xwiki.authentication.group.allgroupimplicit=1, keep the existing behavior, obviously prevent any global user to join, do not provide global user scope in wiki creation, and warn on the wiki setting if the user scope is incompatible with the current implicit setting.
C) when xwiki.authentication.group.allgroupimplicit=2, check at startup that a XWikiGlobalMemberGroup exists, else create it and migrate any global users in XWikiAllGroup to XWikiGlobalMemberGroup.
D) when xwiki.authentication.group.allgroupimplicit=2, or when xwiki.authentication.group.allgroupimplicit=0 and XWikiAllGroup contains XWikiGlobalMemberGroup, use the new behavior, allowing creation of all user scopes, removing any warnings, joining global users to the XWikiGlobalMemberGroup (and local users to the XWikiAllGroups if not implicit).
The net benefit of the above proposal is to keep actual habits and existing use cases untouched. Moreover, the security is ensured to be kept as it is with no risk of side effect, which is priority.
WDTH ?
Obviously, my +1 for the above proposal. Thanks,
On Tue, Jan 21, 2014 at 6:50 PM, Guillaume "Louis-Marie" Delhumeau < [email protected]> wrote:
2014/1/21 Guillaume "Louis-Marie" Delhumeau <[email protected]>
Just to add some precisions:
= What the migrator do = 1. Create a group XWikiMemberGroup, with XWikiAllGroup as the first member. 2. All global users of XWikiAllGroup are put inside XWikiMemberGroup and removed from XWikiAllGroup. 3. All rights concerning XWikiAllGroup are changed (ex: "view for XWikiAllGroup" -> "view for XWikiMemberGroup"). It does not break anything since XWikiAllGroup is a member of XWikiMemberGroup. 4. All candidacies (ie: join requests, etc...) are moved form XWikiAllGroup to XWikiMemberGroup, to be consistent.
Of course, this migration is only done on subwikis.
2014/1/21 Guillaume "Louis-Marie" Delhumeau <[email protected]>
Sergiu: Exactly, I don't have to have all global users in the this group. Only those who are considered as "members" (ie: they have joined the wiki).
2014/1/21 Sergiu Dumitriu <[email protected]>
Why not make virtual XWikiAllGroup also contain global users?
We can make:
xwiki.authentication.group.allgroupimplicit=0 -> no xwiki.authentication.group.allgroupimplicit=1 -> yes, all local users xwiki.authentication.group.allgroupimplicit=2 -> yes, local and
global
Or do you want to have only some global users, not all of them?
On 01/21/2014 11:31 AM, Guillaume "Louis-Marie" Delhumeau wrote: > Hi developers! > > In Workspaces, we used to add global users in the XWikiAllGroup page of a > subwiki to indicate that they are members of that wiki. > > Now, we have an option called "user scope", and we can have both global & > local users in a subwiki. That means we have global & local users in > XWikiAllGroup. > > Then, it is a problem because it can not work when XWikiAllGroup is
a
> virtual group [1]. > > Then, I have proposed to create a new group, called XWikiMemberGroup, that > hold the members of the subwiki. (Note: XWikiAllGroup will be a member of > XWikiMemberGroup, in order to say "a local user is a member"). > > So, I have written a migration (again!) [2], to create the new group with > the current content of XWikiAllGroup. In this migration, I also changes all > existing rights that occur on XWikiAllGroup to make them effective for > XWikiMemberGroup. I did not want to duplicate these rights by just adding > the sames for XWikiMemberGroup. I think it is easier for the user to only > take care of the XWikiMemberGroup. But it looks a bit "magical", and some > people don't like it. > > I would like to have your opinion. > > +1 for adding XWikiMemberGroup and to "migrate" rights (replace all rights > given to XWikiAllGroup by rights given to XWikiMemberGroup). > > Thanks, > Louis-Marie > > > [1] http://jira.xwiki.org/browse/XWIKI-9886 - Enabling virtual > XWikiAllGroup breaks wiki membership > [2] https://github.com/xwiki/xwiki-platform/compare/feature-wiki-members- > Git branch for this proposal
-- Sergiu Dumitriu http://purl.org/net/sergiu _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
Well, that said, it could be interesting to keep this up for 6.x. Currently, the way XWikiAllGroup has been optimized is far from optimum, and we may when to keep the current thread when we look back at it. Le lundi 27 janvier 2014, Guillaume "Louis-Marie" Delhumeau < [email protected]> a écrit :
Hi.
We have eventually noticed that the bug we tried to fix was invalid (see: http://jira.xwiki.org/browse/XWIKI-9886 ).
I have not even tried to reproduce it, I just relied on the description.
I won't do it again, I will always try to reproduce the bug before doing anything else.
I am sorry for having disturbed you with this thread and I feel ashamed.
Louis-Marie
2014-01-25 Sergiu Dumitriu <[email protected] <javascript:;>>
Why not actually fix the problem instead of adding unexpected implicit behavior?
Proposal:
pseudocode for "is a user in a group": if the group name is XWikiAllGroup and XAG is configured as virtual and the user is local, then return true otherwise, check the standard way, with the object attached to document verification
The fact that XWikiAllGroup is configured as virtual doesn't mean that it suddenly becomes an intangible document.
On 01/21/2014 01:52 PM, Denis Gervalle wrote:
Hi Guillaume,
I am definitely -1 to systematically replace XWikiAllGroup by XWikiMemberGroup in any subwiki:
1) because I do not see the meaning of XWikiMemberGroup in the myxwiki.orguse case. 2) because XWikiAllGroup is an habits for many existing user 3) because existing application/extension/scripts may attribute rights to XWikiAllGroup 4) because this could cause confusion if some right are attributed to XWikiAllGroup and others to XWikiMemberGroup, by a mixup of old and new habits.
Since we definitely want to use implicit XWikiAllGroup, I do understand that you need a solution for workspace that may be joined by global users. The below proposal should allow you to do so without migrating existing installation. It apply only to subwikis.
After thinking about the different possibilities, my best bet to a smooth migration is to keep XWikiAllGroup for its previous meaning: "All authenticated users having access to this wiki" (unless implicit, which restrict it currently to "All Local Users"). Keeping the meaning and potential usage of the group is the key IMO.
To support selected global users to enter the implicit XWikiAllGroup, I simply suggest to add implicitly a group as a member of XWikiAllGroup. It could be called XWikiGlobalMemberGroup to be more explicit, and always be a member of the implicit XWikiAllGroup when xwiki.authentication.group.allgroupimplicit=2. Then:
A) when xwiki.authentication.group.allgroupimplicit=0, and XWikiAllGroup (not implicit) does not have a member XWikiGlobalMemberGroup. Do not do any migration, and keep the current join behavior, using exclusively XWikiAllGroup for both local and global users.
B) when xwiki.authentication.group.allgroupimplicit=1, keep the existing behavior, obviously prevent any global user to join, do not provide global user scope in wiki creation, and warn on the wiki setting if the user scope is incompatible with the current implicit setting.
C) when xwiki.authentication.group.allgroupimplicit=2, check at startup that a XWikiGlobalMemberGroup exists, else create it and migrate any global users in XWikiAllGroup to XWikiGlobalMemberGroup.
D) when xwiki.authentication.group.allgroupimplicit=2, or when xwiki.authentication.group.allgroupimplicit=0 and XWikiAllGroup contains XWikiGlobalMemberGroup, use the new behavior, allowing creation of all user scopes, removing any warnings, joining global users to the XWikiGlobalMemberGroup (and local users to the XWikiAllGroups if not implicit).
The net benefit of the above proposal is to keep actual habits and existing use cases untouched. Moreover, the security is ensured to be kept as it is with no risk of side effect, which is priority.
WDTH ?
Obviously, my +1 for the above proposal. Thanks,
On Tue, Jan 21, 2014 at 6:50 PM, Guillaume "Louis-Marie" Delhumeau < [email protected]> wrote:
2014/1/21 Guillaume "Louis-Marie" Delhumeau <[email protected]>
Just to add some precisions:
-- Denis Gervalle SOFTEC sa - CEO
On Tue, Jan 21, 2014 at 5:31 PM, Guillaume "Louis-Marie" Delhumeau <[email protected]> wrote:
Hi developers!
In Workspaces, we used to add global users in the XWikiAllGroup page of a subwiki to indicate that they are members of that wiki.
Now, we have an option called "user scope", and we can have both global & local users in a subwiki. That means we have global & local users in XWikiAllGroup.
Then, it is a problem because it can not work when XWikiAllGroup is a virtual group [1].
Then, I have proposed to create a new group, called XWikiMemberGroup, that hold the members of the subwiki. (Note: XWikiAllGroup will be a member of XWikiMemberGroup, in order to say "a local user is a member").
So, I have written a migration (again!) [2], to create the new group with the current content of XWikiAllGroup. In this migration, I also changes all existing rights that occur on XWikiAllGroup to make them effective for XWikiMemberGroup. I did not want to duplicate these rights by just adding the sames for XWikiMemberGroup. I think it is easier for the user to only take care of the XWikiMemberGroup. But it looks a bit "magical", and some people don't like it.
I would like to have your opinion.
+1 for adding XWikiMemberGroup and to "migrate" rights (replace all rights given to XWikiAllGroup by rights given to XWikiMemberGroup).
+1 for duplicating rights +0 for "migrating" rights
Thanks, Louis-Marie
[1] http://jira.xwiki.org/browse/XWIKI-9886 - Enabling virtual XWikiAllGroup breaks wiki membership [2] https://github.com/xwiki/xwiki-platform/compare/feature-wiki-members - Git branch for this proposal _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
-- Thomas Mortagne
participants (7)
-
Denis Gervalle -
Guillaume "Louis-Marie" Delhumeau -
Jean SIMARD -
Marius Dumitru Florea -
Sergiu Dumitriu -
Thomas Mortagne -
Vincent Massol