Task #2827

nesting groups requires schema change*

Added by Rob Nahf over 11 years ago. Updated over 8 years ago.

In Progress
Target version:
Start date:
Due date:
% Done:


Estimated time:
0.00 h
Product Version:
Story Points:


If we are supporting nested groups for the purpose of inheriting the access rights of a parent group, the Group datatype needs an isMemberOf element for efficiently building subjectInfo from a given subject.

Currently the parent group references the subgroup using hasMember element, but there is not a reference from the subgroup to the parent group. This is problematic because the starting point for building the SubjectInfo for a certificate is typically a Person subject. the Person.isMemberOf element allows traversal to Groups that they are directly members of, but if those groups are subgroups of other Groups, there's no reference to them.

CN.getSubjectInfo needs to traverse every registered group and subgroup to pick up parent Groups for a particular person (even if there aren't any, it needs to check).


#1 Updated by Rob Nahf over 11 years ago

  • Priority changed from Normal to Immediate
  • Category set to Documentation
  • Subject changed from nesting groups requires schema change to nesting groups requires schema change*
  • Assignee set to Dave Vieglais

#2 Updated by Dave Vieglais over 11 years ago

This does indeed appear to be a significant deficiency in the schema design, and precludes the use of nested groups.

Since this is a schema change, it will be necessary to defer until after initial release, which in turn implies that we should not directly support nested groups, however I do not believe there are any checks against groups containing group subjects.

#3 Updated by Dave Vieglais over 11 years ago

  • Target version changed from Sprint-2012.19-Block.3.2 to Sprint-2012.29-Block.4.3
  • Priority changed from Immediate to Normal

Deferring this issue until after public release. It does not appear to block any required functionality.

#4 Updated by Robert Waltz over 11 years ago

  • Milestone changed from CCI-1.0.0 to CCI-1.1

#5 Updated by Chris Jones over 11 years ago

  • Target version changed from Sprint-2012.29-Block.4.3 to Sprint-2012.37-Block.5.3

#6 Updated by Dave Vieglais over 11 years ago

  • translation missing: en.field_remaining_hours set to 0.0
  • Target version deleted (Sprint-2012.37-Block.5.3)
  • Milestone changed from CCI-1.1 to None

This issue will require fairly wide spread changes.

Need to discuss and develop detailed specifications before implementing if necessary.

#7 Updated by Robert Waltz over 10 years ago

  • Parent task set to #3755

#8 Updated by Robert Waltz about 10 years ago

  • Estimated time set to 0.00
  • Parent task changed from #3755 to #2829

#9 Updated by Ben Leinfelder over 9 years ago

  • Status changed from New to In Progress
  • Start date set to 2014-07-09

What's the verdict - will v2 support nested Groups?

#10 Updated by Robert Waltz over 9 years ago

  • Target version set to CCI-2.0.0

#11 Updated by Ben Leinfelder over 8 years ago

  • Parent task deleted (#2829)
  • % Done changed from 0 to 30
  • Category changed from Documentation to d1_schemas

Pushing this to backlog - not a 2.0 critical change nor a feature that is being asked for by users. IRC discussion with MBJ, DV, BRL and CJ.

Also available in: Atom PDF

Add picture from clipboard (Maximum size: 14.8 MB)