Share groups between directories in Crowd

[Matthias Kannenberg]

We would like to use more then one delegated directory but we are also using a rather intricate system of lots of nested groups (building a rights/roles matrix)..

Is there a way to share all these groups across multiple directories as keeping them in sync every time by hand seems rather cumbersome and error prone..

[Bruno Vincent]

Hi @Matthias Kannenberg 

I'm under the impression the aggregating membership feature available in Crowd might help you here but I'm not sure to fully understand what you want to achieve. Can you provide us with an example please?

[Matthias Kannenberg]

Yes and no.

It helps, but it does not solve the issue entirely. Imagine the following scenario:

• 2 directories: directoryX (crowd internal directory) and directoryY (delegated directory)
• One group "project-manager" with a nested group "jira-users" created in directoryY
• 2 users: userA created in directoryX and userB created in directoryY

If I want to add both users to the same group that would not be possible since "project-manager" is not available in directoryX so I would not be able to assign it to userA.

What is possible is to create another group also called "project-manager" in directoryX, assign userA to it and enable aggregating membership. That way userA would also get assigned the nested jira-users group.

The problem with this approach is that you have to create user groups in all crowd directories, which gets tedious if you have (like us) 4 groups representing access level for each project and have multiple projects.

What I want is to create groups and nested groups globally and then assign users from different directories to them, without the need do duplicate all groups in each directory.

[Bruno Vincent]

Thanks @Matthias Kannenberg. Now I understand your situation. Duplicating groups is not an option, is it? I agree this is not a fantastic one, but scripting this with Crowd REST API should not be that painful.