Specific rights to LDAP Accounts

[cello]

Hey folks,

this is my first post here.

I installed mindtouch deki opensource version 9.02 in our company. We use the VMware Image and everything works fine. I successfully integrated the MS Active Directory "extension".

Because of the fact that this wiki has to be a "secret" i did the following:

I added some AD groups into dekiwiki and assigned them the to role "viewer".
So the users who are member of the specified AD groups inherit the "viewer" role.

The second I did was to adjust the "security/new-account-role" to "guest".
So if a user who is not member of any of the specified AD groups, wants to log into my wiki, he is not able to look around the wiki. (Maybe I'll set it to "none" to forbid access)

And now comes my problem. Like I said everything is working fine, the users are able to log in and they can do everything they are allowed due to the role "viewer"!
But....when I now look at the user management page, all the new users which are all member of the specified AD groups, are displayed with the role "guest" and not with the role "viewer"!!

A few posts under mine I saw that someone has an similar problem, but I wanted to start a new thread. I hope it's okay for you.

Can someone please explain my Problem? Or is it perhaps not a problem and I just missunderstood something?

Thank you in advance!!

Greetings,

Cello

[MaxM]

I added some AD groups into dekiwiki and assigned them the to role "viewer".
So the users who are member of the specified AD groups inherit the "viewer" role.

Just to make sure I understand, you added an external group to Deki so the group members are populated automatically right? Or is it a local group and you defined the members within the control panel?

What you're seeing is normal behavior. Each user is directly given the 'Guest' role but some of them inherit the Viewer role from their group membership. The UI will only display their direct role and not take into account the inherited permissions. Access to a page takes into account user + group perms (as well as any specific grants to the page).

[cello]

The Groups are not local. They exist in our AD and I added them by clicking on Group Management and then "Add Group". On that page I choosed "External Microsoft Active Directory" as Authentication type.

[MaxM]

I hope that clears up the confusion then. I'd like to add a note or something on the user management page that mentions that the effective role may be different than the user's role or something to that effect