Skip to content

objectClasses

Jump to bottom
Rüdiger Beck edited this page Aug 30, 2021 · 14 revisions

Overview

This diagram shows which files/commands create AD Objects, and what sophomorixRole(s) and sophomorixType(s)can be attributed to the objectClass:

Workflow

Devices and their sophomorixRole

At the moment, the sophomorixRole for devices is used only for display purposes (show all printers, ...) and to add a group for a printer Later it might be used for other purposes.

Every line in <school.>devices.csv has a sophomorixRole in Field 9 which ist added to the computeraccount in AD:

  • For every device: A dnsNode (and a dnsZone)
  • If a sophomorixRole Field 9 leads to a computer account:
    • A computer Account (objectclass=computer) with the sophomorixRole <FIELD9>

To find out which sophomorixRole exist and which leads to a computer account see:

sophomorix-samba --show-roletype

Groups and their sophomorixType

The important sophomorix group types explained:

sophomorixType=adminclass

  • These are administration-software classes and are created when students are imported from a <school>.students.csv-file .
  • The groupname ist the first field of the <school>.students.csv-file
  • For the school <school> they are prefixed with <school>-, to avoid name collisions with other schools.
  • For the default-school the prefix is omitted.
  • The status of classes can be: P=Permanent (deletable by --kill only), M=Managed (deletable if empty by sophomorix-class commands)

sophomorixType=extraclass

  • These are additional classes created with sophomorix-extraclass command.
    • Users created in the extraclass have status M and are students.

sophomorixType=teacherclass

  • These is the group that is created when teachers are imported from a <school>.teachers.csv-file .
  • The groupname ist forced to <school>-teachers.
  • For the default-school the prefix is omitted.

sophomorixType=project

  • These are addtional groups created by an administrator
  • project membership can be managed by admins of the project:
    • sophomorixMembers
    • sophomorixAdmins
    • sophomorixMemberGroups
    • sophomorixAdminGroups
  • The groupname of a project is forced to begin with p_
  • a project has a share directory with acces to its members
  • a project can provide additional quota:
    • sohomorixAddQuota (increases quota on SMB-shares for members)
    • sohomorixAddMailQuota (increases mail quota for members)
  • a project can provide mail stuff:
    • sophomorixMailAlias (create mail alias for members)
    • sophomorixMailList (create maillist for the group with members)

sophomorixType=sophomorix-group

  • These are addtional groups created by an administrator
  • Members are managed by an administrator ONLY
  • NO share directory
  • The groupname can be anything, but not allowed to begin with p_ (reserved for projects)
  • a sophomorix-group can provide additional quota:
    • sohomorixAddQuota (increases quota on SMB-shares for members)
    • sohomorixAddMailQuota (increases mail quota for members)
  • a sophomorix-group can provide mail stuff:
    • sophomorixMailAlias (create mail alias for members)
    • sophomorixMailList (create maillist for the group with members)

Overview of all groups and their sophomorixType

  • every group created by sophomorix has an AD attribute sophomorixType.
  • The attribute sophomorixType is automatically assigned to the groups by sophomorix

Overview of Group-Types created by sophomorix:

sophomorixType created for sophomorixRole/Type Description Example
adminclass Role: student class of students <s-><any-class-name>
teacherclass Role: teacher group of teachers <s->teachers
project --- teacher-picked members p_<any-name>
sophomorix-group --- admin-picked members <any name>
room All device roles group of devices <any name>
printer Role: printer group of a printer dnsNode name of device
admins Role:schooladministrator power over one school <s->admins
school Role: all user roles one group for each school
powergroup teacher,student,globaladministrator power over all schools global-admins,global-teachers, ...
alladmins Type: admins hirachical members all-admins
allinternetaccess Type: internetaccess hirachical members all-internet
allwifiaccess Type: wifiaccess hirachical members all-wifi
allwebfilter Type: webfilter hirachical members all-webfilter
allintranetaccess Type: intranetaccess hirachical members all-intranetaccess
allprinting Type: printing hirachical members all-printing
ouclass Type: adminclass students of a school <s->students
allclass all-students, all-teachers
allschool all users of all schools "SCHOOLS"

<s>: schoolname

Managementgroups:

They are special groups. As members they have only users (not other groups). They change dynamically to allow/disallow the members certain actions defined by usermembership.

sophomorixType Description
internetaccess members have internetaccess
wifiaccess members can use wifi infrastructure
webfilter members use webfilter
intranetaccess members have intranetaccess
printing members can print
alladmins

Users and their sophomorixRole

sophomorixRole

  • every user created by sophomorix has an AD attribute sophomorixRole.

Existing Roles:

sophomorixRole Description
teacher Teacher with administrative acces to students
student student
examuser user in an exam
globaladministrator Administrator, access to all schools
schooladministrator Administrator access to one school
globalbinduser user for a bind to AD to access all schools
schoolbinduser user for a bind to AD to access all schools

Proposed Roles:

Rolle Beschreibung
guestteacher limited teacher ??
powerstudent student with more power ??
janitor student-like, but equal to teachers

Creating a new Role

Todo

Clone this wiki locally