...
- an administrator at the ./managers level can grant admin bits on otherwise-locked down folders at the levels below. Bad. So, the owners of the ./managers level will not have the administrative bit turned on. The account of the director of CSS will have admin bits, so they can act to fix anything that might go wrong.
- groups of individual kerberos ids as in the original example should be replaced with an acl that contains those names. To wit, "othomas, goguen, jfw" would be assigned a list like "css-managers-help-admin"; then when membership changes, it's just the acl that is changed in one place, and its effects ripple throughout the system without further intervention.
- similarly, we replace the principal of the director and the fbc with a list named for the role, populated by the principal of the incumbent. To wit, css-director now holds 'jfw' but soon won't.
Folder | Subfolder | (more folders)" | Read-Write Permissions would be granted | Admin permissions |
|---|---|---|---|---|
managers/ |
|
| css-managers, css-tl | css-director |
| help/ |
| css-managers, css-tl | css-managers-help-admin |
|
| callcenter/ | fbaars, goguen, othomas, css-director, abdenna | css-managers-help-admin |
|
| n42service/ | legand, goguen, othomas, css-director, abdenna | css-managers-help-admin |
|
| mgr/ | goguen, othomas, css-director, abdenna | css-managers-help-admin |
| software |
| css-managers, css-tl | css-managers-software-admin |
|
| swrt/ | bowser, jmhunt, css-director, abdenna | css-managers-software-admin |
|
| vsls/ | jmhunt, css-director, abdenna | css-managers-software-admin |
|
| mgr/ | jmhunt, css-director, abdenna | css-managers-software-admin |
| tcp/ |
| css-managers, css-tl | css-managers-tcp-admin |
|
| dcad/ | jlreed, jfw, css-director, abdenna | css-managers-tcp-admin |
|
| usability/ | jlreed, jfw, css-director, abdenna | css-managers-tcp-admin |
|
| pubs/ | cwood, jfw, css-director, abdenna | css-managers-tcp-admin |
|
| training/ | kkibbee, jfw, css-director, abdenna | css-managers-tcp-admin |
|
| atic/ | maryz, jfw, css-director, abdenna | css-managers-tcp-admin |
|
| mgr/ | jfw, css-director, abdenna | css-managers-tcp-admin |
| security/ |
| css-managers, css-tl | css-managers-security-admin |
|
| mgr/ | tjm, css-director, abdenna | css-managers-security-admin |
| hq/ |
| css-managers, css-tl | css-managers-hq-admin |
|
| mgr/ | css-director, abdenna | css-managers-hq-admin |
| homepage/ |
| css-managers, css-tl | css-managers-homepage-admin |
|
| mgr/ | lisanti, css-director, abdenna | css-managers-homepage-admin |
| ditr/ |
| css-managers, css-tl | css-managers-ditr-admin |
|
| desktop/ | chuckk, pepsikid, ndpope, css-director, abdenna | css-managers-ditr-admin |
|
| admin-it/ | chuckk, pepsikid, ndpope, css-director, abdenna | css-managers-ditr-admin |
|
| mgr/ | ndpope, css-director, abdenna | css-managers-ditr-admin |
| mgrsonly/ |
| css-managers-list | css-managers-all-admin |
...