nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

remove all role/group assignment of a user

TSuser_Kumar

Hello all:

is there any way to remove all the role assignment/group assignment of a user at one go without deleting the user?

The idea is to retain the user and clean up all their role/group assignments.

I have checked iwaccess which is requiring to parse branch/role one by one.

I require a way to delete all the role assignment/branch assignment at one go.

Thank you.

Find more posts tagged with

Comments

Adam Stoller

Well, it depends.

If you only use TeamSite groups - then you could, carefully, edit the IWHOME/conf/tsgroups.xml file and remove all entries for that user and then run iwreset.

If you use a mixture of TeamSite and OS / AD groups - then it is more difficult because you'd have to get the user removed from those groups, and then run iwreset.

In addition, after doing either of the above, running iwaccess (with the appropriate flag[s]) to see if there's anything left over that needs to be cleaned up would be reasonable.

You could also probably script something that navigated all the branches and workareas and checked the access rights to remove any entry associated with the user - but again, if you're using OS / AD groups for access rights you'll probably still have issues to be dealt with outside of TeamSite.

If you just remove the user entry from IWHOME/conf/roles/tsusers.xml - and you're just using TS groups, you should also be okay; but if you're using OS / AD groups you may run into issues with workflows that reference those groups for things like GroupTasks.

In short, it can be done, but it may not be a one-step quick-and-easy process.

TSuser_Kumar

Thank you Fish.

Even I was thinking the same.

TSuser_Kumar

But Ghoti,

Is there any way to atleast remove all the role permissions of an particular user at one go?

Adam Stoller

If you cannot find an option in iwaccess to do it all at once (not looking right now) - then the simple answer is "no - unless you build a script to do it".

nipper

You could probably combing the output of:

iwaccess all-permission-entries-of-user
options for all-permission-entries-of-user
<user>
<user> -verbose

List all the permission entries that <user> has on the server or on
some branch or store on the server. Specify -verbose for extended
information.

With the input of:

iwaccess remove-permission-entry
options for remove-permission-entry
<vpath> -user <user> -role <role>
<vpath> -group <group> -role <role>

Remove a permission entry from the branch, store, or server,
specified by <vpath>, to revoke from <user> or <group> the
permission to perform the operations associated with <role>.

And get it done. Not 1 stop shopping, but it should not be onerous.

Note: iwaccess all-roles-of-user just lists the roles and not on what branches, so that doesn't help

Adam Stoller

Another alternative (since we're throwing these things out there instead of letting you figure it out yourself):

iwaccess export-permission-entries file
edit file to remove entries for user
iwaccess import-permission-entries file

However - this only works if the user is explicitly assigned a role on a branch. It won't work if the user is a member of a group that was assigned a role on a branch -- then you need to look back at my previous responses regarding that.

TSuser_Kumar

thank you all.

Is it possible to remove the entries from a file which is storing this branch list and role corresponding to this branch list ?

if so which file is actually storing the branch list with its corresponding role list?

Adam Stoller

TSuser_Kumar wrote:
thank you all.

Is it possible to remove the entries from a file which is storing this branch list and role corresponding to this branch list ?

if so which file is actually storing the branch list with its corresponding role list?

That's what the export / import feature of iwaccess provides - there is no such file under normal operation.

TSuser_Kumar

Thank you Ghoti.

my intension is to clear all the roles of all the users.

so, in that case do I need to import a blank file with xml structure or do I need to have all the branch values mentioned with not having the user id and group id?

In general, if i need to import role files with zero role specification for all users do I need to import a blank xml structured file?

Adam Stoller

Please READ the documentation

If you import a completely blank document, it will probably fail - which is a good thing because otherwise you'd have effectively wiped out ALL access to ALL branches.

I'd strongly suggest you make sure you have a good clean backup of the entire server before you do anything.