TTP view of group membership differs from ZMI view

[grahamperrin]

Maybe consider this symptom alongside User | Group Memberships | select then remove group | removal fails; site manager is silently misdirected to the wrong user

Through the Plone, I:

1. browsed a group Freeman Centre seminars
2. sought perrin
3. found two LDAP users, selected the required gjp22
4. added the user to the group.

Wondering whether TTP addition was successful, I took a look through the ZMI.

Contradiction

ZMI view of groups shows that gjp22 is a member of Freeman Centre seminars and two other groups.

TTP view of memberships for gjp22 shows two groups not including Freeman Centre seminars.

Observation

For  plone.app.ldap at the time of writing, documentation may be lacking. I'm intentionally not reading materials relating to precdecessor product(s) — I shouldn't make summary guesses about differences between products — and so to some degree, it's learning through discovery.

I wonder whether the ZMI list of functions at
/acl_users/ldap/manage_activateInterfacesForm
must be altered to suit our situation (access to this particular LDAP service is read-only). In any case, the contradiction between Plone and ZMI is unexpected/unexplained and certainly

• without warning to the manager at the time of supposed membership.

Regards
Graham

[grahamperrin]

Repeated attempts to add the group through the Plone do not succeed.

[grahamperrin]

Now, compare the preceding screen shot and observation

• can not add group to user, I tried two or three times TTP

with an earlier observation, separate ticket

• OpenID user: Group Memberships: first attempt to 'Add user to selected groups' always fails; subsequent attempt succeeds.

I wonder whether there is some relationship.

[grahamperrin]

Since those attempts/experiments I have used ZMI to modify some preferences relating to LDAP. I wonder whether behaviour will improve.

My sense at the moment is that Plone and/or plone.app.ldap might be improved to

• at least, detect errors as they occur, and warn managers

• ideally, prevent errors

• probably, refer from the TTP LDAP control panel to (a) the ZMI and/or (b) documentation.

[grahamperrin]

Incidentally, whilst

1.  LDAP: how best to work around duplicate ID issues? remains unanswered in the support forum, and

2. I use LDAP

it may be impossible for me to /acl_users/source_groups/manage_groups without encountering tracebacks such as this:  http://pastebin.ca/1231168

[grahamperrin]

Repeated attempts to add the group through the Plone do not succeed

That symptom is reaffirmed in Plone 3.1.6.

[grahamperrin]

See also

ticket:7297, Adding user to group works, adding group to user doesn't.

[grahamperrin]

See also

ticket:8710, Changes saved is a false statement when a group addition fails without explanation.

[grahamperrin]

See also

ticket:8557, Nested groups are not shown in prefs_group_members.

Critically

ZMI might suggest that group CENTRIM is a member of group Freeman Centre, but as a member of CENTRIM I am unable to edit in a folder where privileges have been granted to Freeman Centre.

From that observation I assume that group membership must be true through the Plone for membership to be effective.

[grahamperrin]

LDAP users

Elsewhere I find issues that occur only when plone.app.ldap is introduced to the mix.

[grahamperrin]

Possible workaround

In the following areas of ZMI:

• /acl_users/ZCacheable_manage
• /acl_users/ldap/ZCacheable_manage

— where Pluggable Auth Service apparently defaults to RAMCache

and

— where Plone LDAP plugin apparently defaults to RAMCache

change both to (None).

[grahamperrin]

The other changes made today, maybe relevant, are at /acl_users/ldap/manage_activateInterfacesForm:

[√] Authentication (authenticateCredentials)
[ ] Reset Credentials (resetCredentials)
[√] Group_Enumeration (enumerateGroups)
[√] Group_Introspection (getGroupById)
[√] Group_Management (removePrincipalFromGroup)
[√] Groups (getGroupsForPrincipal)
[√] Properties (getPropertiesForUser)
[√] Role_Enumeration (enumerateRoles)
[√] Roles (getRolesForPrincipal)
[√] User_Adder (doAddUser)
[√] User_Enumeration (enumerateUsers)
[√] User_Management (doChangeUser)

(To a degree, without documentation: guesswork.)