How to deny users to edit groups?

[helge]

Hi there,

I have the followng issure:
since User-resrictions in my OX installation are based on groups, i dont want them to edit their groups of course.

I've done the following:

/opt/open-xchange/sbin/changeuser -c 1 -A oxadmin -P ????? -u username --access-edit-group off

then:

User XX in context 1 changed

But: The changed user is sill able to the groups!

Any solution?

Thx, Helge

[Martin Heiland]

Hi,

did you do a real logout/login with that user after changing the preferences? On the server side the group edit access is blocked for the user but the GUI still shows the plugin until the configuration has been reloaded, which happens at the login.

Greetings

[helge]

Yes, I did this. And indeed, I see the GUI interface. And I can edit and add groups - the gui does so, though. How do I see any difference to the non - deactivated edit-group-access?

thx

[waerter]

Hi

my read is, that the access combination name for this context is set so all. If it is so all Users have all Rights in in this Context.
Set the Access Combination Name for this context to premium, and give some user who needs it the right to edit groups.

Greetings
Waerter

[helge]

Thx Wearter,

Hi

Set the Access Combination Name for this context to premium, and give some user who needs it the right to edit groups.

Greetings
Waerter

I can remember form the install process to have done something about the Set the Access Combination Name. Could be a solution. But I need a hint how do do it, since there is no documentation how to use this option

In the meantime however I fixed it myself: changed the CONTEXT with access-edid-goups off and swiching an admin - user back on

Thx
Helge

[waerter]

Hi,

for all other users:

changecontext -A adminuser -P adminpass -c contextid --access-combination-name premium

The access-combination-names can be found in /opt/open-xchange/etc/admindaemon/ModuleAccessDefinitions.properties
there you can also edit the access-combination-names, but you have to apply the new access-combination to the context.

[helge]

GREAT!

Thanks allot for the tip!

Helge