nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

iwgroups -- anyone in production??

jed

Curious if anyone is extensively using iwgroups in a production environment (especially in solaris). Has the switch been pretty transparent after all the initial migration work? Any gotchas or issues? Are command line users confused with the way it does permission spoofing?

(We are in the process of evaluting a switch to 6.5 w/ iwgroups.)

Thanks for any insight.
~jed

--
Jed Michnowicz
jedm@sun.com
Content Management Engineer
Sun Microsystems

Find more posts tagged with

Comments

Adam Stoller

We're in the process of upgrading to 6.5 and we are using TS groups within the upgrade process.

The couple of things that I've noticed are:
1. The iwgroup CLT will not read through symlinks -- bug # 58412 -- part of our release process involves wanting to have a "groups.xml" file that is a symlink to one of "groups.DEV", "groups.TEST", or "groups.PROD" [depending on which server/environment we're on/in] - and we can't do that right now.

2. iwgroup requires root access to use - for querying -- feature request # 57864 -- part of our workflow process involves looking up group information for a given user and we can't do this unless we run the command as 'root' - and that's kind of limiting for our processes which are intended to be run as the logged-in user.

3. iwgroup does not provide gid information in output (I think a bug was filed for this, but I don't have any tracking for it) -- this is particularly important when trying to take an existing backing store and from a system where you used OS groups and move it to a new system where you are going to use TS groups and you need to use iwidmap to fix the entries. (there's a thread on this within this forum with more details on this)

Generally, however, we like the idea of using tsgroups because it should get around the problem of the 16-group limitation *and* it puts control of the ts-groups into our TS-administrator rather than having to go through the IT folks (who, in this case, are nice and generally responsive - but they shouldn't be needed for this).

--fish
Senior Consultant, Quotient Inc.
http://www.quotient-inc.com

skip11

Hi fish,

you write: iwgroup requires root access to use - for querying

how about adding them ? If only root can add them, then that's a major minus for me.

a quick check just confirms it. iwgroup CANNOT be run as any user but root, though the permissions
on the binary are 555, and the owner of the tsgroups.xml is a non root user (same user running the CLT)

works ok with sudo though.

bummer.

Regards,

R.Barger
Credit Suisse Group
Zurich, Switzerland

Adam Stoller

I didn't mention that [root required to use iwgroup for administration purposes] because I didn't see it as a major hurdle for me - as we aren't expecting users to be able to administrate that aspect of the system.

--fish
Senior Consultant, Quotient Inc.
http://www.quotient-inc.com

carnix

We're using it in production, but it's a Windows 2003 box (TS 6.5 SP2). It mostly works fine.

The catch I've found is it makes adding a new user that much more difficult. We're using the roles files instead of LDAP, but we do use people's AD accounts. But, you still have to add the users to the iwglobal OS group so they have permissions in the workareas. Then, you have to add them to whatever iwgroups via the CLT (or XML file, but I use the CLT because it's much easier to deal with in my opinion).

What I would LOVE is a tool that can plug into the Administration tab where you can select user roles that can do A) Add the user to groups in the XML file (I guess via a CGI CLT interface) and

(this is the tricky one) add the user to the OS group too. I guess using .NET this is possible... maybe.

I created a Perl CGI that can read and display the XML file. No problem there. If can even take input (from master users only) that can add or remove a user from a group. But, what I haven't been able to do yet is make existing groups populate into a dropdown so they're selectable (it's all manually typed, which is fine I guess), and I can't figure out (and what I really need to know) how to add it as a new item to the Administration page...

Anyone know how to do that?

Michael Langford, Webmaster - CARE USA
151 Ellis Street, Atlanta, GA, 30303
http://www.care.org/

smenon

Wait for TS 6.7.0.. User management and group management (for TeamSite Groups only) and controlling who has permissions to manage groups etc, is all out of the box functionality in TeamSite 6.7.0. And as you guessed, this functionality will be available via the Admin tab.

--Sunil Menon
Sr. Product Manager
Interwoven, Inc.

carnix

Très bon!
So, when is 6.7 scheduled for release?
-mike

Michael Langford, Webmaster - CARE USA
151 Ellis Street, Atlanta, GA, 30303
http://www.care.org/

reddyl

I think it is sechduled for 1st quater of 2006.

jonwood

Hi Jed,

We're on solaris 9 and moved to TS 6.5sp1 with iwgroups in june `05. Writing the script to migrate backingstores wasn't too bad. We haven't seen any issues related to iwgroups (the we could prove in court Smiley Wink

) but you're right about the permission spoofing being a bit of a pain.

Any command line tools that got group info from ls output need updating. You can use iwattrib command to get the group of an individual file/folder, but for the most part, all browsing on the command line is obscured by the permissions spoofing. For example, if the file owner,group are owner1:group1, you'll see owner1:iwglobal instead. Note that the GUI shows the correct group, group1.

Can't think of anything else that was a gotcha.

- Jon

DaveDeutsch

Do you mean "tsgroups"? If so, I love the flexibility of them. However updating the file (in our installation) has caused TeamSite to cease working. We need to bounce the server (Wintel) everytime we add a user to a group. Obviously something is corrupted in this process. We are opening a ticket with Interwoven to take a look.