Permissions and Assingment

[mahescho]

I'm experimenting to find a good way to set permissions and automatically assign every thing.

A simple and common scenario:

• N groups of client systems (aka devices)
• N groups of supporters (aka users)
• Supporter group 1 should be able to access client system group 1 and 2.
• Supporter group 2 should be able to access client system group 4 and 2.
• Supporter group 3 should be able to access client system group 1 and 3.
• Supporter group N should be able to access all client systems.
  and so on ...

Current state:

• Devices can be grouped logically by adding them to address books.
• Devices can join groups by being assigned to a user wich group is the desired group.
• A user can be member of ONE single group.
• Access to other groups could be granted to groups.

My suggestion:

1. Allow to assign devices to N groups and/or to N users, perhaps in some use cases users are required. No inheritance by user.
2. Allow to assign the group to the custom client by "advanced setting"

My current, ugly workaround:

To get around I create a "unused" user which owns the clients of a group as I want no real user to own them.

FIXED with #304 : As there is no "advanced setting" to set the owner of a device there is no workaround for 2. so it has to be done manually.

Yes, a real permission system (user device permissions, group device permissions, multiple groups for users) would be nice and IMHO better, but I think my suggestion does not interfere too much with the current state and allows to get every thing necessary.

Can any one tell me why the permission system is like it is? I just don't see any advantage in it. Are there technical reasons?

[priechodsky]

yes, I'm dealing with the exact same thing and I don't understand why it's designed this way :/
#336