<!DOCTYPE html>
<html data-lt-installed="true">
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body style="padding-bottom: 1px;">
<p>Hello everyone,</p>
<p>I currently have a system where privileged users can manage users
and roles in their org.</p>
<p>Now I have a situation, where two departments share a role, so
their admins are able to assign this shared role to users in their
org.<br>
This leads to a situation, where an admin cannot see users that
have the role assigned, but are not part of their own org.</p>
<p>Is there a way to select these users as objects in an
authorization?<br>
Basically, I need to select users that have a role assigned, which
belongs to an org the actor is a manager of, without them being
members of said org.<br>
Simple roleRelation rules are not sufficient in this case, as the
actor does not necessarily have a direct relation to the role.<br>
Similarly, orgRelation is insufficient since the subject does not
have a relation to the org of the admin.</p>
<p>I could use per-case authorizations which hard-code the names of
the roles I am dealing with, but I would like to avoid that, as it
makes dealing with this scenario less flexible.<br>
</p>
<p>Kind regards,</p>
<p>Sven<br>
</p>
<pre class="moz-signature" cols="72">--
Sven Feyerabend
Referent für IT-Betreuung
stuvus – Studierendenvertretung Universität Stuttgart
Pfaffenwaldring 5c
70569 Stuttgart</pre>
</body>
<lt-container></lt-container>
</html>