I think we have to be very careful here about the wording of an explanation of "special groups", because general group membership and membership in a "special group" work in two entirely different ways.
In brief: o in ordinary group membership, the account is added to the group; o in special group membership, the group is added to the session. Granting general group membership to an account causes the group to be altered to refer to the account among its members. Code can look up a group and ask it for a list of its members, and receive references to every account granted membership in this way. If membership in a "special group" is granted by an authentication mechanism, the *logon session* is altered to refer to that group among its list of "special groups". This is why you don't see "special" memberships if you edit the given group: the group was *not* altered. The meaning of the special-groups list might be understood to be: "pretend that the account used in this session is a member of these groups, whenever checking access for this session." There is a way to ask which groups should be associated with a session, without caring which way membership was granted. The access control code uses this method when determining whether to permit a session to use a resource. This arrangement makes a great deal of sense: o no code has to remember which memberships are special so that they can be revoked at logout. Special memberships automatically disappear at logout along with the rest of the session. o if a user uses the same account to authenticate two sessions through two different mechanisms concurrently, the two sessions behave properly: each has access only through the special groups associated with its authentication mechanism (plus the account's general memberships). I will admit that I don't expect to see ordinary users doing this. -- Mark H. Wood, Lead System Programmer [email protected] Friends don't let friends publish revisable-form documents.
pgpLcJDXGYbdA.pgp
Description: PGP signature
------------------------------------------------------------------------------ Crystal Reports - New Free Runtime and 30 Day Trial Check out the new simplified licensing option that enables unlimited royalty-free distribution of the report engine for externally facing server and web deployment. http://p.sf.net/sfu/businessobjects
_______________________________________________ DSpace-tech mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/dspace-tech
