Block Role

1 Requirements

1.1 Description of Original Request : ILIAS 4.1

If you administrate an installation that uses RBAC often, it would be very helpful to have an easy way for stopping the inheritance of rights and taking away all rights below that node - especially when you work with several global and local roles. At the time being, you have to click too much to make all changes in the several linked role settings. And that is bad user experience :-(

I recommend to offer a select menu and checkboxes for all roles (as known from course member administration). One option of the menu could be: Break inheritance and take away all permissions of the role template.

1.2 Revision for ILIAS 4.4

Facing the bug report 6504: Permissions of a blocked role can be overwritten we suggest to make the following changes in ILIAS 4.4:

1. If a role is blocked this status is saved in the database.
2. The checkbox "Block role" is toggled (after saving).
3. All permissions on this screen (node) are greyed out (and removed like already done). They cannot be changed as long as the role is blocked.
4. The role does not appear on the permission screens of sub-objects.
5. Once the role is "unblocked" (remove toggle and save) the permissions are re-instantiated according to the existing role permissions (and templates).

2 Additional Information

• Idea / concept: Kunkel, Matthias [mkunkel] and Meyer, Stefan [smeyer]
• Interest in funding: ILIAS-Verein
• Maintainer: Meyer, Stefan [smeyer]
• Development: Feature developed by Meyer, Stefan [smeyer], Leifos

3 Discussion

Florian Suittenpointner, 3 January 2011: Great there is a first step now onto making the RBAC handling easier.
However, there is one aspect that spoils this advantage: In case you want to reset the role blocking, you still have to do as many clicks as it has been in former versions.
I'm afraid this will discourage many people from using the function because you cannot reset it in the same easy way you introduced it.
This is especially relevant for those who're not that familiar with RBAC, and they were the original target group of this feature.
Therefore, I suggest to redesign this feature in a way that blocking a role can also be reset by simply removing a mark and save.

JF 13 May 2013: We support the improvement as described under "Description ILIAS 4.4" and schedule it for ILIAS 4.4. The current checkbox in the GUI gives the user the feeling to edit a state and not to invoke an action, so we assume that most people already expected the new behaviour.
 
If anyone relies on the old "action-like" behaviour, please leave a note here.

Matthias Kunkel, Alexander Killing, Stefan Meyer, 13 June 2014: We still appreciate the second part of this request and schedule it for 4.5.

Jour Fixe 23 June 2014: We confirm the scheduling for 4.5. Permission screens should offer an additional filter that allows to hide blocked roles.

Functionality has been implemented as part of the Permission Screen Revision for ILIAS 4.1

Feature is now called Block Role.

Jour Fixe, 13 May 2013: Change as described in 1.2 will be implemented for ILIAS 4.4.

Matthias Kunkel, 19 Mar 2014: Feature has not been implemented for 4.4. I set it on the wish list for 4.5.

4 Implementation

The missing functionality of this feature has been implemented for 5.1 as a bugfix. Nevertheless, we keept this page in the features wiki to have a documentation of the changes:

1. If a role is blocked this status is saved in the database.
2. The checkbox "Block role" is toggled (after saving).
3. All permissions on this screen (node) are greyed out (and removed like already done). They cannot be changed as long as the role is blocked.
4. The role does not appear on the permission screens of sub-objects.
5. Once the role is "unblocked" (remove toggle and save) the permissions are re-instantiated according to the existing role permissions (and templates).