how to configure a manager of groups

[Khai Do]

Hello.  I have a use case where I would like to setup a user account that is a manager of a group of users.  The manager should be able to modify the group's account profile and preferences but the this manager cannot change settings for any other groups.  I do not want the manager to be able to manage gerrit or any of the projects.  Is there a way in the Gerrit ACL system for me to setup this configuration?

[Shawn Pearce]

No. A user cannot be given access to modify another user's profile or
preferences.

[Khai Do]

Could you please provide some ideas on how to add this functionality to gerrit?  Maybe a special "Group Managers" group that has admin permission over other groups?  Is this even something that upstream Gerrit would be interested in or would it be better as a plugin?  

[David Ostrovsky]

Am Freitag, 18. Juli 2014 11:42:14 UTC+2 schrieb Khai Do:

Could you please provide some ideas on how to add this functionality to gerrit?  Maybe a special "Group Managers" group that has admin permission over other groups?  Is this even something that upstream Gerrit would be interested in or would it be better as a plugin?  

Actually there is a plugin already for what you are trying to achieve, well, almost: [1].

You would need to extend this plugin (or create your own) to operate on normal

users and not only on non interactive users.

[1] https://gerrit-review.googlesource.com/#/admin/projects/plugins/serviceuser

[David Pursehouse]

What settings do you want to let this group edit?

Maybe I am being unimaginative but I can't imagine any use case where it
would be desirable to let someone edit other users' profiles.

[Khai Do]

We have setup a "Third Party CI" group.  The group contains user accounts (all bots) that trigger on our Gerrit repo but run tests externally and report back to our Gerrit.  

Here's an example: https://review.openstack.org/#/c/107486/

You will notice that "XenServer CI" and "turbo-hipster" are accounts in the "Third Party CI" group.  The Third Party CI group is starting to become pretty large for us so we want to give a specific person (gerrit user) permission to manage that group.   

[Khai Do]

I tried the service user plugin.  It seems exactly what we need because all of our third party accounts are basically non-interactive user accounts.  The only problem I'm having now is that I would like to use this with Gerrit 2.8.x but plugin (master) doesn't build against Gerrit 2.8.x :(    Anybody know whether this can be easily back ported to 2.8?

[David Ostrovsky]

Am Freitag, 18. Juli 2014 16:26:53 UTC+2 schrieb Khai Do:

I tried the service user plugin.  It seems exactly what we need because all of our third party accounts are basically non-interactive user accounts.  The only problem I'm having now is that I would like to use this with Gerrit 2.8.x but plugin (master) doesn't build against Gerrit 2.8.x :(    Anybody know whether this can be easily back ported to 2.8?

This would be very hard to backport to 2.8. Serviceuser plugin is using

advanced GWT plugin integration feature that allows plugins to contribute

entire GWT screens and not only dialogs.

Besides that it relies on REST API and other resources that were moved

from core to gerrit-plugin-gwtui. While everything is possible, you would

need to backport dozen of non trivial changes, to start with: [1], [2], [3].

I would suggest not to do that.

Upgrade to 2.9 that was released today and you are done ,-)

[1] https://gerrit-review.googlesource.com/51540

[2] https://gerrit-review.googlesource.com/52757

[3] https://gerrit-review.googlesource.com/52583