Univention Bugzilla – Bug 44738
Make it possible to add further roles in UCS@school
Last modified: 2023-06-12 13:55:38 CEST
I got several questions from current customers how they could handle further staff in UCS@school on educational slaves. First of all they often misinterpret the concept of staff in UCS@school but also have the need to add users like Sozialpädagogen, Bibliotheksmitarbeiter and further people. The current workaround is to add "Domain Users" in ldap-base/ou/users but this is only possible for domain admins and not in the delegative adminstration for e.g. school admins. Furthermore they add most of the times group shares like the "lehrer"-share. So, to me the possibility to have more roles is needed in the near future of UCS@school.
The list of UCS@school user roles is hard coded and used throughout the entire code. Adding roles would mean changes everywhere. * Do I understand the scenario correct, that a "staff"-like role is needed, that is replicated to edu-slaves? * What LDAP-permissions should such a role have? * What other roles / scenarios are expected? * What's bad about group shares?
(In reply to Daniel Tröder from comment #1) > The list of UCS@school user roles is hard coded and used throughout the > entire code. Adding roles would mean changes everywhere. Sure, I know. That's why I created this feature request relatively early before the need to implement such a thing is too fierce. > > * Do I understand the scenario correct, that a "staff"-like role is needed, > that is replicated to edu-slaves? Yes, exactly. Multiple separated "staff"-like roles. > * What LDAP-permissions should such a role have? Quite the same like students. > * What other roles / scenarios are expected? Parents of course. Szenarios: Teacher and parents would like to message each other over somehow secure channels. Parents would like to access the cover plan. Parents need to add the private email address in the self-service for them self or their childrens. > * What's bad about group shares? No it's great. That is one of the main features what this staff like groups will use. They will need access to devices and share files.
(In reply to Michel Smidt from comment #2) > (In reply to Daniel Tröder from comment #1) > > * Do I understand the scenario correct, that a "staff"-like role is needed, > > that is replicated to edu-slaves? > Yes, exactly. Multiple separated "staff"-like roles. Could a single "edustaff" role with multiple groups archive the goal? > > * What other roles / scenarios are expected? > Parents of course. I totally concur.
(In reply to Daniel Tröder from comment #3) > (In reply to Michel Smidt from comment #2) > > (In reply to Daniel Tröder from comment #1) > > > * Do I understand the scenario correct, that a "staff"-like role is needed, > > > that is replicated to edu-slaves? > > Yes, exactly. Multiple separated "staff"-like roles. > Could a single "edustaff" role with multiple groups archive the goal? Yes, I guess so. Important would be that school admins can create/edit/delete this kind of users. I think we shouldn't try to anticipate all workflows for this role. For a first iteration I guess following workflows would be totaly sufficient: 1. The user can login to windows, have a home share and a "group share". 2. The user can login to a cloud file service like nextcloud and can share files with other school members. > > > > * What other roles / scenarios are expected? > > Parents of course. > I totally concur.
A customer needs something between student and teacher and I think in the last years this requirement has grown in school environments; School accompaniment for People with disabilities should be on nearly every school in Germany. These staff users need access to school network/environment but they schould not be allowed to start and stop exams. Some customer may want them to have access to the teachers shares; others may not so a flexible configuration would be the best way to solve this, also for other requirements like observing only the accompanied student and so on. I have attached a ticket of customer who actual has the problem not knowing how to solve the requirements of the school administration.