You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When viewing the access groups that a user is a member of in one's profile on people.mozilla.org, the group name for the mozillians groups strips the leading mozilliansorg_ prefix from the name
as a result, though the names look nicer, they aren't usable for purposes of access control.
For example if in my RP I grant access to the access group dinopark-preview-access, the users in that mozillians group don't have access. I have to instead grant access to mozilliansorg_dinopark-preview-access
The case where this is affecting me is that in rolling out federated access to AWS for all of our AWS accounts, each AWS account holder needs to create AWS roles and grant access to the access groups that they want for each role. If they go to people.mozilla.org (the only place users can see access groups) to see what groups they're part of to inform what groups they should grant access to, if they add an LDAP group everything is fine. If they add a mozillians group it will just silently not work.
Can we change how the mozillians groups are visualized to show the actual group name?
Ideas for how to do this could be
Show both the actual mozillians group name in the same visual style of the LDAP groups as well as a hyperlinked and prefix-stripped name as we have now in the mozillians section
Show the real group name hyperlinked instead of the stripped name
Show the stripped name with an icon that when clicked reveals the real name of the group (that has some tooltip that explains what's going on)
The text was updated successfully, but these errors were encountered:
When viewing the access groups that a user is a member of in one's profile on people.mozilla.org, the group name for the mozillians groups strips the leading
mozilliansorg_
prefix from the nameas a result, though the names look nicer, they aren't usable for purposes of access control.
For example if in my RP I grant access to the access group
dinopark-preview-access
, the users in that mozillians group don't have access. I have to instead grant access tomozilliansorg_dinopark-preview-access
The case where this is affecting me is that in rolling out federated access to AWS for all of our AWS accounts, each AWS account holder needs to create AWS roles and grant access to the access groups that they want for each role. If they go to people.mozilla.org (the only place users can see access groups) to see what groups they're part of to inform what groups they should grant access to, if they add an LDAP group everything is fine. If they add a mozillians group it will just silently not work.
Can we change how the mozillians groups are visualized to show the actual group name?
Ideas for how to do this could be
The text was updated successfully, but these errors were encountered: