Manual group definition and ID assignment

The implementation of the permission infrastructure assumes that each node in the group tree can either be clearly identified or has no meaning. The ID attribute in the groups.xml file provided by the server is used for this task.

Basically, it is possible to assign an independent, unique ID to each group. This assignment must occur if a group has no further subgroups (i.e. each leaf has to have an ID). If an ID is not to be assigned to group, the group ID is implicitly defined from the union of all subgroup IDs (transitive).

The semantics of an ID assignment means that persons can only exist in groups with an ID. If a group contains subgroups but not persons, it is not necessary to assign an ID. Such a group is only used for demonstration purposes. If at least one person is contained in a group, it is necessary to assign an ID. When assigning an ID, ensure that the IDs correspond to the group IDs determined during personalization. Particularly observe that the group hierarchy in the personalization module is not evaluated, since normalisation has already been executed by the permission component!

The composed ID is returned while evaluating the permission configuration:

All (ID=, eff:1, 2, 3, 4, 5, 6, 7, 8, 9, 10)
+--group 1 (ID=, eff: 7, 10)
+--+--group 1.1 (ID 7)
+--+-- group 1.2 (ID 10)
+--group 2 (ID=9, eff:1, 2, 3, 4, 5, 6,9)
+--+--group 2.1 (ID 4, eff: 1, 2, 3, 4)
+--+--+--group 2.1.1(ID 1)
+--+--+--group 2.1.2(ID 2)
+--+--+--group 2.1.3(ID 3)
+--+--group 2.2 (ID 6, eff: 5,6)
+-----+--group 2.2.1 (ID 5)
+--group 3 (ID=8)

In this example “group 1” does not have an explicit ID. Therefore, the ID results from the union of all IDs of the subgroups. In this case “7” and “10”. If, e.g., a configuration is returned from the “group 1” layer, the result “7, 10” is returned. This means that there are no persons in “group 1”, but only in “group 1.1 (7)” and “group 1.2 (10)”.

This is different in the case of “group 2”. This group has the ID 9 and additionally diverse subgroups. This means that there are persons either directly in “group 2” or in the subgroups.