{"action":"created","issue":{"url":"https://api.github.com/repos/tildaslash/RatticWeb/issues/297","labels_url":"https://api.github.com/repos/tildaslash/RatticWeb/issues/297/labels{/name}","comments_url":"https://api.github.com/repos/tildaslash/RatticWeb/issues/297/comments","events_url":"https://api.github.com/repos/tildaslash/RatticWeb/issues/297/events","html_url":"https://github.com/tildaslash/RatticWeb/issues/297","id":38025361,"number":297,"title":"Multiple Password Groups","user":{"login":"plabbett","id":1407028,"avatar_url":"https://avatars.githubusercontent.com/u/1407028?v=3","gravatar_id":"","url":"https://api.github.com/users/plabbett","html_url":"https://github.com/plabbett","followers_url":"https://api.github.com/users/plabbett/followers","following_url":"https://api.github.com/users/plabbett/following{/other_user}","gists_url":"https://api.github.com/users/plabbett/gists{/gist_id}","starred_url":"https://api.github.com/users/plabbett/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/plabbett/subscriptions","organizations_url":"https://api.github.com/users/plabbett/orgs","repos_url":"https://api.github.com/users/plabbett/repos","events_url":"https://api.github.com/users/plabbett/events{/privacy}","received_events_url":"https://api.github.com/users/plabbett/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/tildaslash/RatticWeb/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/tildaslash/RatticWeb/labels/security","name":"security","color":"e10c02"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2014-07-16T21:11:06Z","updated_at":"2015-02-20T17:02:04Z","closed_at":null,"body":"From wiki documentation on RatticDB:  \"We also tried to make the ACL system as simple as possible, passwords belong to a single group, and users can be in any number of groups.\"\r\n\r\nThis seems counter-intuitive when using LDAP. For example, let's say I have \"CustomerService\" and \"InformationTechnology\" LDAP groups. If there is a password that I want both groups to have the same access to, I can either create duplicate password records (1 for each group I want to have access to) or I can create new LDAP groups that encompass both groups. \r\n\r\nDuplicating passwords across multiple groups is not a great solution because if I update it once, I have to remember to run through each instance assigned to other departments and update it.Strong potential for out of sync passwords. \r\n\r\nMaking LDAP groups works, but depending on the complexity of the roles (groups) in AD, it can result in groups like \"CustomerServiceLevel1_And_ITLevel1_And_SalesLevelI.\" Just as an aside, I have somewhere around 15 \"roles\" that each have 4 \"levels.\" This architecture makes it hard for me to manage shared passwords between roles/levels. \r\n\r\nAnother possible option is to create LDAP groups based on individual passwords instead of roles, but that's the reason I'm using a password manager so that I can assign passwords to levels/roles within my organization.\r\n\r\nJust food for thought. If there is a way to achieve what I'm trying to do that I have overlooked, please let me know! thanks! "},"comment":{"url":"https://api.github.com/repos/tildaslash/RatticWeb/issues/comments/75274455","html_url":"https://github.com/tildaslash/RatticWeb/issues/297#issuecomment-75274455","issue_url":"https://api.github.com/repos/tildaslash/RatticWeb/issues/297","id":75274455,"user":{"login":"rayvenshire","id":7368876,"avatar_url":"https://avatars.githubusercontent.com/u/7368876?v=3","gravatar_id":"","url":"https://api.github.com/users/rayvenshire","html_url":"https://github.com/rayvenshire","followers_url":"https://api.github.com/users/rayvenshire/followers","following_url":"https://api.github.com/users/rayvenshire/following{/other_user}","gists_url":"https://api.github.com/users/rayvenshire/gists{/gist_id}","starred_url":"https://api.github.com/users/rayvenshire/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rayvenshire/subscriptions","organizations_url":"https://api.github.com/users/rayvenshire/orgs","repos_url":"https://api.github.com/users/rayvenshire/repos","events_url":"https://api.github.com/users/rayvenshire/events{/privacy}","received_events_url":"https://api.github.com/users/rayvenshire/received_events","type":"User","site_admin":false},"created_at":"2015-02-20T17:02:04Z","updated_at":"2015-02-20T17:02:04Z","body":"ipernet, will you make a pull request?"}}