Author Topic: Can i convert a Group (used for Access Control) to a Smart Group (Read 4260 times)

petednz · March 13, 2008, 02:22:34 am

or do I have to delete and repeat?
And can I just say that for what i need the ACL system is working wonders. Had I done it before it might have removed need for some of our reporting issues.

petednz · March 13, 2008, 03:31:30 am

Nurgh - so I actually need to go in the opposite direction. I just went down the track of setting up my groups of 'managers' who will have an ACL role as 'smart groups' cause these people are all people with 'roles' that we have captured via Custom Data - all our treasurers, memb secs, etc. Now I can see there were some we clues about not setting up as Smart Groups. But I missed them. Why?

Well, for one, Assign Users to Roles says "Select a group of contacts who should have this role when logged in to your site. Groups must be assigned the 'Access Control' type (Manage Groups » Settings) to be included in this list." It does not say - this will not work with Smart Groups.

The odd thing is I am sure on the first two i tested with I did set them up as Smart Groups and presumed that I lost that function when I applied ACL roles. But I can't backtrack to see how I did it.

Is there a way I can change Smart Groups to Regular Groups?

petednz · March 13, 2008, 03:32:20 am

And I see the issue of the benefits - for us users - of having ACLs applied to Smart Groups was canvassed here - http://forum.civicrm.org/index.php/topic,1645.0.html - is it on the wishlist?

petednz · March 13, 2008, 03:42:24 am

I'm enjoying this thread

n
Okay so the issue is when you set up New Group from Manage Groups it gets you to tick Access Control in Group Type.

I think there may need to be a warning (woops was there one? nah can't spot one) when one uses More Actions to Add Contacts to a Smart Group that the next screen says - Do Not use for Groups that will have ACL control - or some such - either that or we need a way to 'unsmart' a smart group - and my searching failed to dig that instruction out if it is there.

petednz · March 13, 2008, 03:48:01 am

Ah ha - you can't set up a Group from an Advanced Search - is this for real? I can add to a Group, I can make a Smart Group, I can tag and all sorts, but I can't actually make a Regular Group - the type I need for ACLs?

Donald Lobo · March 13, 2008, 11:12:14 am

wow. this probably holds the record for the longest self-replied thread (5). figured i'd jump in here and give u my 2 cents before u resume your monologue

in answers to your questions:

1. We have documented that ACL groups cannot be smart groups here:

http://wiki.civicrm.org/confluence/display/CRMDOC/Assign+Users+to+Roles

If you think we should doc this in other places, please make the needed changes in the wiki

2. Not sure why we dont allow folks to make a regular group from an action. Simple reason is no one has asked for it before

Can you add an issue and we'll do it in 2.1 (its trivial)

3. There is no code to convert a smart group to a regular group. However this is not too hard either.

4. ACL's applied to smart groups are a significant way off

there are a few other hurdles we need to cross before that

lobo

Chris Burgess · March 13, 2008, 12:46:10 pm

Lobo, can I please ask you to clarify that last statement?

Quote

4. ACL's applied to smart groups are a significant way off - there are a few other hurdles we need to cross before that

Do you mean that ACLs granting access rights to members of smart groups are a significant way off, or that ACLs granting access to edit contacts in smart groups are still a way off?

In http://forum.civicrm.org/index.php/topic,1645.0.html it looked like this would be addressed in 2.0, but I'm not sure if any performance changes happened.

While Pete was delivering the above monologue (alas, poor Yorick!), he set up provincial access controls on our membership using smart groups. We were pretty delighted to see that it worked!

However based on the warning in the docs relating to ACLs on smart groups ...

Quote

You can control access to contacts in a Smart Group using ACL Roles. However, this configuration is likely to cause moderate to severe performance degradation. Setting up access control on multiple Smart Groups may result in fatal errors due to exceeding the maximum allowable number of JOIN statements in MySQL.

... we wonder if we should implement a simple caching mechanism which converts these smart groups to static groups for our ACL purposes.

It would be a pity for one or two more smart-group ACLs to be the final straw that broke things!

For reference, we have about 5000 contacts in the DB currently, and about ten regional smart groups based on a custom data value which records the name of the region the contact resides within. We anticipate moving to ~20K contact entries in the near future with import of a second contact DB.

petednz · March 13, 2008, 12:49:41 pm

Ah ha - the big old yellow warning box trick you mean

I was running off this page http://wiki.civicrm.org/confluence/display/CRM/Setup+Roles+and+Access+Control+Permissions
because it actually referred to splitting the organisation geographically.

Quote

Segment access to contacts by state or province:

* Create a new smart group for each relevant state or province (e.g. Washington, Oregon, California).
* Create roles for each state (e.g. Washington Team Leaders, Oregon Team Leaders ...)
* Assign edit Washington Contacts permission to Washington Team Leaders role, etc.

Chris is worried that I used Smart Groups to create Managers

and will be in touch because of the warning in that big yellow box. In my defence, I interpreted what was said in http://forum.civicrm.org/index.php/topic,1645.0.html as meaning you had sorted it.

Quote

We'll take care of it for the 2.0 release

There is no easy solution for your current use case Sad. We need to work on ACL's a bit more and make them significantly more efficient when operation ON smart groups.

Also this bit here

Quote

In order to give you the option of controlling access to segments of your contact database, CiviCRM creates two new access control options whenever a CiviCRM group is added to your database:

* edit contacts in <group name>
* view contacts in <group name>
This applies to both regular and smart groups.

may have added to the idea that using Smart Groups was okay. And anyhow, it just seemd intuitive that the Managers group should be able to automatically update as new managers are created.

chris is suggesting the way around both issues of Smart Groups, if we need to go there, is to run a Cron job each night that would update both 'static' groups.

- ah ha, see he just beat me to it, no matter, will post anyway -
Anyhow, I felt like i made some progress.

petednz · March 13, 2008, 01:30:36 pm

Quote

2. Not sure why we dont allow folks to make a regular group from an action. Simple reason is no one has asked for it before Smiley Can you add an issue and we'll do it in 2.1 (its trivial)

Added the issue. http://issues.civicrm.org/jira/browse/CRM-2847
The point for me, from experience last night, is that it is easier to repeat the process several times in AdvSearch by setting up the (not menat to be) Smart Group and then editting the criteria (in my case changing locale but keeping everything else set the same) and then making that search result the next group.
From New Groups it was much more labour intensive.

Donald Lobo · March 13, 2008, 01:37:37 pm

Chris:

please allow pete to beat his prior record (5 posts on the same thread in a row) before you intercede

Onto the questions

1. The ACL group / role needs to be static. Making this into a smart group is in a much later 2.x / 3.x release

2. In 1.x and 2.0 an ACL can be used to grant access to a smart group. This does not scale very well with lots of ACL's as documented in the wiki (since we basically do LEFT JOIN's etc which ultimately collapse under their own weight). it depends on how many ACL's does a person have. If person X has 5 ACL's on 5 smart groups, it basically stiching together 5 different queries. So depending on how complex the queries are, it might explode mysql.

3. I think the restructuring of search in 2.1 will basically cache all smart groups as static groups, and use the static groups in future queries. The main issue will be to ensure we invalidate the cache at the right times (which might be a bit hard since a smart group could be a function of too many tables). In addition, we'd probably also have a cron job to update the cache periodically.

lobo

Chris Burgess · March 13, 2008, 01:59:55 pm

Quote

2. In 1.x and 2.0 an ACL can be used to grant access to a smart group. This does not scale very well with lots of ACL's as documented in the wiki (since we basically do LEFT JOIN's etc which ultimately collapse under their own weight). it depends on how many ACL's does a person have. If person X has 5 ACL's on 5 smart groups, it basically stiching together 5 different queries. So depending on how complex the queries are, it might explode mysql.

Thanks for that Donald. This looks like good news for us, as any single user will probably only have one (possibly two or three I would expect) ACLs for now. Which means that we probably won't have too much to worry about.

(This makes me wonder if storing the custom values which we smart group against in the same option group would make our ACL queries more efficient - I suspect it might.)

petednz · March 13, 2008, 02:05:51 pm

I know I am tired, but in my defence - I just realised I had pasted this in above without noting the issue

Quote

Create a new smart group for each relevant state or province

from here http://wiki.civicrm.org/confluence/display/CRM/Setup+Roles+and+Access+Control+Permissions with out jumping up and down and saying "the documentation made me do it" - phew, was thinking I must have gone nuts last night.

Chris Burgess · March 13, 2008, 02:59:35 pm

I hadn't spotted it until I went to click "Edit", but that page is filed in a section called "CiviCRM Documentation - OBSOLETE". It doesn't appear in the page title, but is visible near the top of the page.

Probably not as obvious as it could be - if these docs are actually out of date, perhaps we could label them more clearly as such?

Anyway, I added some pointers to the docs which discuss performance degradation and this forum thread in that page. I hope if those docs are un-obsoleted, they can be expanded further at that time.

petednz · March 13, 2008, 03:08:38 pm

Please file an issue to have Pete filed in Obsolete too.

Donald Lobo · March 13, 2008, 04:26:37 pm

Rather than filing you under "Obsolete", i think we need to promote you to "Global head of QA for CiviCRM"

You might want to start building a good team to help you out

Quite a few folks on forums these days, so u should use it as a recruiting tool.

lobo

CiviCRM Community Forums (archive)

News:

Author Topic: Can i convert a Group (used for Access Control) to a Smart Group (Read 4260 times)

petednz

Can i convert a Group (used for Access Control) to a Smart Group

petednz

Re: Can i convert a Group (used for Access Control) to a Smart Group

petednz

Re: Can i convert a Group (used for Access Control) to a Smart Group

petednz

Re: Can i convert a Group (used for Access Control) to a Smart Group

petednz

Re: Can i convert a Group (used for Access Control) to a Smart Group

Donald Lobo

Re: Can i convert a Group (used for Access Control) to a Smart Group

Chris Burgess

Re: Can i convert a Group (used for Access Control) to a Smart Group

petednz

Re: Can i convert a Group (used for Access Control) to a Smart Group

petednz

Re: Can i convert a Group (used for Access Control) to a Smart Group

Donald Lobo

Re: Can i convert a Group (used for Access Control) to a Smart Group

Chris Burgess

Re: Can i convert a Group (used for Access Control) to a Smart Group

petednz

Re: Can i convert a Group (used for Access Control) to a Smart Group

Chris Burgess

Re: Can i convert a Group (used for Access Control) to a Smart Group

petednz

Re: Can i convert a Group (used for Access Control) to a Smart Group

Donald Lobo

Re: Can i convert a Group (used for Access Control) to a Smart Group