Support for subgroups?

[miketwo]

It appears that the program doesn't support subgroups on the Google side.

We have a group of [email protected] that's made up of several direct members and a few subgroups -- things like [email protected] and [email protected]. Google allows you to add groups to groups in this way.

Unfortunately, these subgroups are not flattened out and included when running a sync. I am unsure if this is by design (to prevent infinite loops) or if the program is unaware of the subgroups. Has anyone else run into this?

The workaround is to directly use the subgroups when assigning permissions, but it would be significantly more convenient to use the "ubergroup" instead. I'm hoping for some insight from someone familiar with the program/APIs before diving in myself to see.

[awinecki]

I've encountered the same problem. My current Google groups (corresponding to AWS permission sets) is like this:

• AWS-NonProduction-FullAdmin
• AWS-NonProduction-ViewOnly
• AWS-Production-FullAdmin
• AWS-Production-ViewOnly
• AWS-Sandbox-FullAdmin
• AWS-Sandbox-ViewOnly

Now, for administrators and operations, I would like to have a google group [email protected]. And I could configure once what permissions ops people get by just adding [email protected] to specific permission sets (e.g. here I'd give them admin rights).

And for developers, I'd like to have a [email protected] group, which has limited access. For example, FullAdmin on Sandbox AWS account, but the rest would be ReadOnly.

With support for subgroups, I could just add a new developer to a single Google group and that would handle all AWS permissions.

Right now, however, I need to add each dev to the right groups, which is:

• More labour (especially when doing permission changes on a global scope – consider having to click through 300 developers, adding them to the right groups)
• Error prone (you can accidentally give a developer FullAdmin rights to Production in such a setup)

Just wanted to share my case to demonstrate how such a feature would be useful. Otherwise, this is a great project! Extremely useful already!

[mbrg]

+1

[ChrisPates]

So as of v2.0.2, nested groups are ignored (they were failing with a panic). I'll be looking at how best to address this is a feature branch.

Since IdentityStore doesn't support nested groups, I'm leaning toward recursing into nested groups and adding them to the top level group, being synced.

[ChrisPates]

Merging with duplicate issue 386