[KULRICE-4575] IM Person doc should only allow editing of direct group memberships Created: 20/Sep/10 Updated: 03/Nov/10 Resolved: 22/Sep/10
|Project:||Kuali Rice Development|
|Reporter:||Dan Lemus (Inactive)||Assignee:||Jeremy Hanson|
|Remaining Estimate:||Not Specified|
|Time Spent:||Not Specified|
|Original Estimate:||Not Specified|
|KAI Review Status:||Not Required|
|KTI Review Status:||Not Required|
Currently, the UIDocumentServiceImpl#loadEntityToPersonDoc method pulls group memberships from GroupService#getGroupsForPrincipal. While wildly useful in other contexts (such as finding out which responsiblities a principal has through a group), in this context it's deadly: getGroupsForPrincipal returns all memberships in groups and all memberships implied by groups being members in other groups.
Basically, if principal kmoutlaw is a member of group A, and group A is a member of group B, then when you do an IM Person doc on kmoutlaw, the memberships for both group A and group B are shown as editable. Editors might miss this and simply save the doc, thereby making kmoutlaw a direct member of group A and group B. The second time we open an IM person doc on kmoutlaw, both the direct membership to group B and the indirect membership (through group A) to group B are editable...which leads to optimistic lock exceptions.
On the IM Person doc, only direct group memberships should be editable.
Note from James on how to fix this issue (listed on
List<? extends Group> groups = getGroupService().getGroupsForPrincipal(identityManagementPersonDocument.getPrincipalId());
List<? extends Group> groups = getGroupsByIds(getGroupService().getDirectGroupIdsForPrincipal(identityManagementPersonDocument.getPrincipalId()));
and added this method (all of this is in UA's override of that service):
|Comment by Dan Lemus (Inactive) [ 20/Sep/10 ]|
Not sure if this should be listed more as a contribution, or fix. But the appropriate fix has been added to the description field of this JIRA.
|Comment by Jeremy Hanson [ 21/Sep/10 ]|
Currently, non direct group memberships are not shown on the IM Person document. Not sure when this was implemented, but it does check to make sure the principalId is a direct member before adding it to the doc.
That said, the current way of doing this looks incredibly complicated for what it does.
So I think I'm going to updated this code to James' solution as it should be more efficient.
|Comment by Jeremy Hanson [ 22/Sep/10 ]|