E-Groups Training. Carmen Barandela (GS/AIS) Pawel Grzywaczewski (IT/OIS) For support: or 77777

Transcription

1 E-Groups Training Carmen Barandela (GS/AIS) Pawel Grzywaczewski (IT/OIS) For support: or 77777

2 Overview What are CERN e-groups? What can you do with e-groups? Static e-groups Dynamic e-groups Audit information Manage groups for one member Manage owner/admin Posting restrictions Archives Where you can use e-groups? Web services

3 What are CERN e-groups? Official CERN group management Human Resources lists (organic units, roles...) Mailing lists Access rights management Integrated with CERN single sign-on Support for CERN external accounts E-groups training - 3

4 CERN authentication E-groups training- 4

5 What is an e-group? A set of persons and/or accounts Can contain Persons registered at CERN External addresses Computing accounts Other groups E-groups training - 5

6 Who manages an e-group? A group is managed by one owner Additional administrators can be defined Same privileges as the owner Ownership needs to be transmitted to someone else when owner leaves CERN A group s behaviour can be configured with a number of settings E-groups training - 6

7 What can you do with E-Groups? Create mailing lists All E-Groups have an address E-Groups can optionally have an archive Read message archives online or offline with Outlook and common RSS clients E-groups training - 7

8 What can you do with E-Groups? Create user groups to set access permissions on file directories, web sites Indico EDMS and other applications using CERN authentication E-groups training - 8

9 Subscribe/Unsubscribe Subscribe to the e-group Depends on the self-subscription policy Unsubscribing yourself is always possible E-groups training - 9

10 Static e-groups When you create a static list you must define policies for Self-subscription Users can(not) self-subscribe Privacy Users can(not) see the member list Owners/admins specify the list of members Manually Import members from file List must be kept up-to-date over time E-groups training - 10

11 Self-Subscription Policy Self-Subscription Policy Closed: This option means that only the owner and the administrators can subscribe new members. e-group Members: This option means that only other specified e-group members are allowed to subscribe new members. Registered Users: This option means that CERN users can only subscribe themselves. Open: This option allows any user to subscribe new members. Options Open, Registered Users and e-group Members can be combined with owner approval. Advises Ideal for access rights management Ideal for mailing lists in the scope of a Organization Unit or Experiment Mailing lists Only when you want completely open subscription This option requires the approval of the owner or admins E-groups training - 11

12 Privacy Policy Privacy Policy e-group Owner/Admins: This option means that only the owner and the administrators can see the members list. e-group members: This option means that only e-group members can see the members list. CERN registered users: This option means that only CERN users can see the members list. Advises Access rights management Access rights management and Mailing lists Organic Units e.g. GS-AIS-FPF Open: This option allows any user to see the members list. E-groups training - 12

13 Owner & Administrators Why do we need one owner and administrators? One person must be attached and responsible for the resource (e-group). What happens when the owner is about to leave CERN? The owner receive a mail asking to transfer the ownership otherwise the resource (e-group) will be transferred to the supervisor. E-groups training - 13

14 Owner & Administrators Owner and administrators have the same rights Administrator e-group can be newly created or an existing e-group Consider the possibility to use the same administrator e-group for all your e-groups E-groups training - 14

15 Members See all the members (name, type, login, mail, comments) If the privacy policy permits it Add/remove members If you have administrator rights E-groups training - 15

16 Add a New Member Four types of members Add a new member using the person s address or username or the e-group name or use the search screen E-groups training - 16

17 IMPORT/EXPORT members Content of the imported file has the right format: - Every member is a new line address@domain.ch username@cern.ch A,barandel Carmen.barandela@gmail.com Add comments: member to be added, comments Must be a text file Presentation title - 17

18 IMPORT/EXPORT members Presentation title - 18

19 Filtering Members E-groups training - 19

20 Filtering Members Filtering by Name, Surname Person Id Organic Unit E-groups training - 20

21 Addresses All addresses associated with group Visibility depends on privacy policy Contained e-groups are expanded All s are shown E-groups training - 21

22 Dynamic E-Groups Members defined by criteria Criteria can be defined using a list of predefined fields like age, at CERN (Y/N), building, department, experiment (e.g. Atlas ), nationality, sex (M/F), status ( FELL, STAF ) E-groups training - 22

23 Dynamic E-Groups List of members updated once per day If somebody leaves/joins the section, retires, leaves CERN etc. The list does not have to be updated as it is automatically synchronized with the HR database during the night E-groups training - 23

24 Dynamic e-groups Some criteria are not accessible appear under Restricted in a different color HR decides on the accessibility. E-groups training - 24

25 Dynamic e-groups Several conditions are connected with AND e.g. one e-group with all CERN Staff from the PH department (CERN-PH-STAFF) has two criteria one to define the Status as Staff and another to define the Department as PH To connect groups with OR create two separate lists and integrate them in a static one e.g. one e-group with all CERN Staff and Fellows (CERN- STAFF-FELLOWS) has CERN-STAFF and CERN- FELLOWS as e-group members E-groups training - 25

26 Audit Information E-groups training - 26

27 Manage groups for one member Manage groups memberships for one for member any given user for all e-groups you own or administrate Unsubscribe from any e-group you are on Support for CERN external accounts You can see and manage where your e- groups are being used as members E-groups training - 27

28 Manage owner/admin Manage Change groups the for ownership one member for all e-groups you own or administrate Can be used to transfer ownership before a person leaves CERN Change the administrator group for all e-groups you own or administrate Set the same administrator e-group for all or several of your e-groups E-groups training - 28

29 Outline Posting restrictions for e-groups Overview of archive Enabling/disabling archive Reading messages and searching for messages Posting messages from web interface E-groups directory What happens when a group is deleted? Where can you use e-groups? Web services

30 Why do we use posting restrictions? Groups do have a mail address: groupname@cern.ch By default only owner and admins can post messages Posting restrictions: Only authorized people can post Reduce amount of SPAM E-groups training - 30

31 Posting restrictions Mail properties tab in e-groups quick demo E-groups training - 31

32 Archives Access to archives Archiving messages Search functionality Keywords. Subject, sender, content of the message, attachments Search scopes for main experiments Post messages from web interface Announcements E-groups training - 32

33 Enabling/disabling archives Mail properties tab in e-groups View archives Grant people access to the site After disabling an archive messages will stay on the server they are not deleted. E-groups training - 33

34 Archive site Structure of archive site B: Announcements added by group owner/admins C: Last messages received by the group D: View archives sorted by months E: Number of messages in the thread E-groups training - 34

35 Archive permissions By default owner, admins and members can access an archive In e-groups application click in a tab Mail properties on the link Manage access to archive Grant access to the archive Users/groups added to Web Visitors can read contents on the page and post messages. E-groups training - 35

36 Where you can check latest messages? Archive page latest messages are listed Using Outlook Connect to Outlook link on the archive page RSS Feeds Connect using RSS feed readers: Mozilla Firefox, Internet Explorer, etc. Only recent messages available E-groups training - 36

37 Search archives Search using main e-groups archive page Search from the archive Search the site Search all mail archives To find a message it has to be indexed first at the moment it takes up to 1 hour. E-groups training - 37

38 Search archives Possibility to search all archives you have access to Scopes for main experiments: Alice, Atlas, CMS, LHCb. Show latest messages messages from last 30 days to which you have access. E-groups training - 38

39 What happens when a group is deleted? Only the owner can re-create a group with the same name in the first 30 days If an archive existed, the contents of the archive are preserved Since group members are now undefined (group is deleted), usually nobody can access the archive anymore (by default, only the group members had access to the archive) If other groups were granted access to the archive, they still have access to the archive Recreating a group with same name will restore access to the archive E-groups training - 40

40 Where can you use e-groups? Granting access to web sites E-groups training - 42

41 Where can you use e-groups? Granting access to DFS folders \\cern.ch\dfs E-groups training - 43

42 Where can you use e-groups? Restricting access to linux machines based on e-group s membership Following entry in /etc/ldap.conf: nss_base_passwd OU=Users,OU=Organic Units,DC=cern,DC=ch?one?memberOf=CN=vo box-access-testing,ou=egroups,ou=workgroups,dc=cern,dc=ch E-groups training - 44

43 Where can you use e-groups? Granting access to INDICO events E-groups training - 45

44 Where can you use e-groups? Granting access to manage virtual machines E-groups training - 46

45 Where can you use e-groups? An e-group can be responsible for devices in LANDB E-groups training - 47

46 Where can you use e-groups? Define your SVN repository access based on e-group s membership. VC-librarians-<your_project>; containing all the librarians, people responsible for the administration. VC-users-<your_project> automatically created e-group containing all the users from the authz file. E-groups training - 48

47 Web services A programmatic interface (API) is available to automate or script the management or e- groups Useful to synchronize the membership of an e- group with an external data source You can use your regular personal account or a "Service Provider" account E-groups training - 49

48 Web services CERN Yachting Club Membership of CERN Yachting Club is stored in Oracle database. Each night membership is synchronized from Oracle to E-groups using PowerShell script which is stored on DFS. E-groups training - 50

49 Thank You! Should you have any question please contact