[Building Sakai] Disallowing permissions for certain roles

[Branden]

Hi all,

I'm wondering if it is possible by virtue of a property or !site.helper
to globally enforce that certain roles don't have certain permissions.

For example, restrict the "Student" role from ever having
"assignment.grade" ability, system-wide. In the assignments permission
tab, the checkbox would then be disabled so an instructor couldn't
enable it by mistake.

Any advice is greatly appreciated.

Thanks!
Branden
_______________________________________________
sakai-dev mailing list
sakai-dev@...
http://collab.sakaiproject.org/mailman/listinfo/sakai-dev

TO UNSUBSCRIBE: send email to sakai-dev-unsubscribe@... with a subject of "unsubscribe"

[Plourde, Mathieu]

Hi Branden,

I have no answer to your question, but I'm also interested in an answer. We got a similar problem earlier this month. This becomes even more critical when lots of instructors share the same site. There is always one person who's adventurous enough to check that box without understanding the consequences.

Best Regards,

=================================

Mathieu Plourde, MBA
Project Leader, LMS/Instructional Designer
IT-Client Support & Services
mathieu@...

=================================

TOP LINKS:

Technology Troubleshooting: http://www.udel.edu/help
Sakai@UD Support and Training: http://www.udel.edu/sakai/training

=================================

-----Original Message-----
From: sakai-dev-bounces@... [mailto:sakai-dev-bounces@...] On Behalf Of Branden Visser
Sent: Wednesday, November 04, 2009 10:09 AM
To: Sakai
Subject: [Building Sakai] Disallowing permissions for certain roles
Importance: Low

Hi all,

I'm wondering if it is possible by virtue of a property or !site.helper
to globally enforce that certain roles don't have certain permissions.

For example, restrict the "Student" role from ever having
"assignment.grade" ability, system-wide. In the assignments permission
tab, the checkbox would then be disabled so an instructor couldn't
enable it by mistake.

Any advice is greatly appreciated.

Thanks!
Branden
_______________________________________________
sakai-dev mailing list
sakai-dev@...
http://collab.sakaiproject.org/mailman/listinfo/sakai-dev

TO UNSUBSCRIBE: send email to sakai-dev-unsubscribe@... with a subject of "unsubscribe"
_______________________________________________
sakai-dev mailing list
sakai-dev@...
http://collab.sakaiproject.org/mailman/listinfo/sakai-dev

TO UNSUBSCRIBE: send email to sakai-dev-unsubscribe@... with a subject of "unsubscribe"

[Branden]

If you want to check the scope of potential disasters, I've attached a
query that does the job.

I might run it nightly as a quick and dirty way to keep tabs on possible
problems until we have a better solution.

Hope that helps,
Branden

Plourde, Mathieu wrote:

> Hi Branden,
>
> I have no answer to your question, but I'm also interested in an answer. We got a similar problem earlier this month. This becomes even more critical when lots of instructors share the same site. There is always one person who's adventurous enough to check that box without understanding the consequences.
>
> Best Regards,
>
> =================================
>
> Mathieu Plourde, MBA
> Project Leader, LMS/Instructional Designer
> IT-Client Support & Services
> mathieu@...
>
> =================================
>
> TOP LINKS:
>
> Technology Troubleshooting: http://www.udel.edu/help
> Sakai@UD Support and Training: http://www.udel.edu/sakai/training
>
> =================================
>
> -----Original Message-----
> From: sakai-dev-bounces@... [mailto:sakai-dev-bounces@...] On Behalf Of Branden Visser
> Sent: Wednesday, November 04, 2009 10:09 AM
> To: Sakai
> Subject: [Building Sakai] Disallowing permissions for certain roles
> Importance: Low
>
> Hi all,
>
> I'm wondering if it is possible by virtue of a property or !site.helper
> to globally enforce that certain roles don't have certain permissions.
>
> For example, restrict the "Student" role from ever having
> "assignment.grade" ability, system-wide. In the assignments permission
> tab, the checkbox would then be disabled so an instructor couldn't
> enable it by mistake.
>
> Any advice is greatly appreciated.
>
> Thanks!
> Branden
> _______________________________________________
> sakai-dev mailing list
> sakai-dev@...
> http://collab.sakaiproject.org/mailman/listinfo/sakai-dev
>
> TO UNSUBSCRIBE: send email to sakai-dev-unsubscribe@... with a subject of "unsubscribe"

select
        ss.site_id,
        ss.title,
  srr.role_name as "Role",
        srf.function_name as "Permission"
from
        sakai_realm_rl_fn srrf
inner join
  sakai_realm_role srr on (
      srr.role_name in ('Student') and
      srrf.role_key = srr.role_key
    )
inner join
        sakai_realm_function srf on (
                        srf.function_name in ('asn.delete', 'asn.grade', 'asn.revise') and
                        srrf.function_key = srf.function_key
                )
inner join
        sakai_realm sr on (srrf.realm_key = sr.realm_key)
inner join
        sakai_site ss on ('/site/'||ss.site_id = sr.realm_id);

_______________________________________________
sakai-dev mailing list
sakai-dev@...
http://collab.sakaiproject.org/mailman/listinfo/sakai-dev

TO UNSUBSCRIBE: send email to sakai-dev-unsubscribe@... with a subject of "unsubscribe"