<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE article PUBLIC "-//UR1//DTD docbookAllegeEsup//FR"
"http://www.esup-portail.org/consortium/espace/docbook/xxe/dtd/docbook_allege_esup.dtd">
<article lang="FR">
  <title>uPortal store group mapping</title>

  <articleinfo>
    <abstract>
      <para>This document deals with the uportal store group mapping.</para>
    </abstract>

    <author>
      <firstname>Thomas Bellembois</firstname>

      <surname></surname>

      <affiliation>
        <orgname><ulink url="http://">University of Rennes 1</ulink></orgname>
      </affiliation>
    </author>

    <revhistory>
      <revision>
        <revnumber>1.0</revnumber>

        <date>2006.09.15 : Thomas Bellembois (University of Rennes1) : first
        release</date>

        <revdescription>
          <para></para>
        </revdescription>
      </revision>
    </revhistory>
  </articleinfo>

  <section>
    <title>Introduction</title>

    <para>The ESUP WebDAV server retrieves its group hierarchy from the ESUP
    portail portal it is connected to. The group tree is like :
    <varname>local.0/local101/PAGS_COMPPERS/PAGS_PERS_UR1</varname> where
    <varname>local*</varname> are local groups <emphasis>automatically
    generated</emphasis> when the portal database is initialized and
    <varname>PAGS*</varname> are PAGS groups defined by the administrator.
    Permissions on resources are set with regard to these groups.</para>

    <para>As said above, local groups are automatically generated. It can be a
    major problem to manage permissions set on the server.</para>

    <para>====</para>

    <para>Imagine the following scenario :</para>

    <para>1. Permissions are set on 2 folders :</para>

    <para><filename>/files/shareSpaces/jediCouncil</filename> &gt; READ and
    WRITE for group
    <varname>/roles/uPortal/local.0/local.5/PAGS_JEDI</varname></para>

    <para><filename>/files/shareSpaces/lightSaberLessons</filename> &gt; READ
    and WRITE for group
    <varname>/roles/uPortal/local.0/local.10</varname></para>

    <para>Note that the first permission is set for a PAGS and the second one
    for a local group.</para>

    <para>2. The portal database is re-initialized - local groups are
    automatically generated :</para>

    <para><filename>/roles/uPortal/local.0/local.5/PAGS_JEDI</filename>
    becomes
    <varname>/roles/uPortal/local.0/local.55/PAGS_JEDI</varname></para>

    <para><filename>/roles/uPortal/local.0/local.10</filename> becomes
    <varname>/roles/uPortal/local.0/local.100</varname></para>

    <para>3. The consequences are :</para>

    <para>- The permission set on the
    <filename>/files/shareSpaces/jediCouncil</filename> folder becomes
    obsolete - in other words, people in the PAGS_JEDI group can not
    READ/WRITE anymore.</para>

    <para>- The local.10 group does not contain the same people as before the
    re-initialization, and then, rights to READ and WRITE are given to people
    who are not supposed to be allowed to READ and WRITE !</para>

    <para>====</para>

    <para>But hoppefully, the ESUP WebDAV server contains a mapping file to
    map group paths to aliases.</para>
  </section>

  <section>
    <title>The group mapping file</title>

    <para>The ESUP WebDAV server package contains a
    <filename>perso/Slide/src/conf/webapp/uportalStoreGroupMapping.xml</filename>
    file.</para>

    <para>Once the server is deployed, this file is in the
    <filename>{deploymentDirectory}/webapps/slide</filename> directory.</para>

    <para>Let's have a look at this file :</para>

    <para><programlisting>&lt;uPortalStoreGroupMapping&gt;
&lt;mapping alias="ToutLeMonde" targetGroup="local.0" /&gt;
&lt;mapping alias="ToutLeMonde/Personnels" targetGroup="local.0/local.101/local.104"/&gt;
&lt;mapping alias="ToutLeMonde/Personnels/CRI" targetGroup="local.0/local.101/local.104/pags.COMPPERS/pags.PERS_957" /&gt;
&lt;mapping alias="ToutLeMonde/Personnels/CRI/SI" targetGroup="local.0/local.101/local.104/pags.COMPPERS/pags.PERS_957/pags.PERS_57SI" /&gt;
&lt;mapping alias="ToutLeMonde/Etudiants" targetGroup="local.0/local.101/local.103" /&gt;
&lt;mapping alias="ToutLeMonde/Etudiants/UFR_Etudiants" targetGroup="local.0/local.101/local.103/pags.UFRETU" /&gt;
&lt;/uPortalStoreGroupMapping&gt;</programlisting></para>

    <para>To disable the mapping just erase the xml file or comment the
    &lt;mapping&gt; entries.</para>

    <para><important>
        <para>It is very important to fill this file in meticulously. Errors
        can lead to problems with permissions set on resources.</para>
      </important></para>

    <para>Aliases and target group paths are fully qualified names.</para>

    <para></para>
  </section>

  <section>
    <title>Server behavior</title>

    <para>When the file contains at least one &lt;mapping&gt; entry, only the
    defined groups and their non mapped sub groups are visible.</para>

    <para>Consider the following mapping file :</para>

    <para><programlisting>&lt;uPortalStoreGroupMapping&gt;
&lt;mapping alias="ToutLeMonde" targetGroup="local.0" /&gt;
&lt;mapping alias="ToutLeMonde/Personnels" targetGroup="local.0/local.101/local.104"/&gt;
&lt;mapping alias="ToutLeMonde/Etudiants" targetGroup="local.0/local.101/local.103" /&gt;
&lt;/uPortalStoreGroupMapping&gt;</programlisting></para>

    <para>The visible groups will be :</para>

    <para>-ToutLeMonde</para>

    <para>-Personnels</para>

    <para>-Etudiants</para>

    <para>-All of the non mapped sub groups of Personnels</para>

    <para>-All of the non mapped sub groups of Etudiants</para>

    <para>Even if the local.0 group contains a local.102 group, this local.102
    group (ToutLeMonde/local.102) will not be visible because the mapping file
    defines two sub groups (Personnels and Etudiants) for local.0... and no
    alias for local.102. In other words, if you map at least one group, you
    need to map all of the groups at the same depth to make them
    visible.</para>

    <para><important>
        <para>If a group is not visible, it is considered as unknown by the
        server and then setting permissions with invisible groups will have no
        effect.</para>
      </important></para>

    <para></para>
  </section>
</article>