Local category roles (for categorie administrators) seem to mess up with ILIAS-ADConnect-Plugin

[fheibel]

Hi, we seem to have Issues within ILIAS-categories with local roles (with protected rights and unprotected rights). I will try to describe the issue, when trying to reproduce it:

1. Create a category with a special local administrative role (for example for category administrators)
2. Log in as lecturer/course administrator who owns this special role. -> Create ADConnect-meeting
3. Ad course members/meeting members -> make sure meeting is available -> entering room -> no problem
4. Logoff
5. Login as Meeting member -> Error message: "ilObjectException thrown with message "Kein Zugriffsrecht" Stacktrace:

   8 ilObjectException in /srv/www/.../Services/Object/classes/cl

   ass.ilObjectGUI.php:2017

   7 ilObjectGUI:checkPermission in /srv/www/.../Services/Object/classes/class.ilObject2GUI.php:463

   6 ilObject2GUI:checkPermission in /srv/www/...Customizing/global/plugins/Services/Repository/RepositoryObject/AdobeConnect/classes/class.ilObjAdobeConnectGUI.php:193

   5 ilObjAdobeConnectGUI:performCommand in /srv/www/.../Services/Repository/classes/class.ilObjectPluginGUI.php:143

   4 ilObjectPluginGUI:executeCommand in /srv/www/.../Services/UICore/classes/class.ilCtrl.php:188

   3 ilCtrl:forwardCommand in /srv/www/.../Services/Repository/classes/class.ilObjPluginDispatchGUI.php:38

   2 ilObjPluginDispatchGUI:executeCommand in /srv/www/.../Services/UICore/classes/class.ilCtrl.php:188

   1 ilCtrl:forwardCommand in /srv/www/.../Services/UICore/classes/class.ilCtrl.php:150

   0 ilCtrl:callBaseClass in /srv/www/.../ilias.php:21"

This a variation:

1. Create a category with two special local administrative role (for example for category managers and local lecturers)
2. Log in as lecturer/course administrator who owns both of these special roles. -> Create ADConnect-meeting
3. make sure meeting is available -> entering room -> "Meeting is not available" (no other error messages)

And this may be the same issue: As ILIAS-system administrator I can't delete meetings created by lecturers/course administrators who own this role (s.a.) I should have the right to delete everything. Lecturers/course administrators who own this role can delete meetings created by themself and other lecturers who own the same category role.

This is not only the case with one special category role. It seems to happen with every category role we've got in our system and with every lecturer who's been assigned to a role like that.

Thank you for your help!

[mjansenDatabay]

I can't reproduce this with the steps you provided.

Scenario:

• Category (created by 'root') -- Local Role 'Category Admin' (created by 'root', who assigned 'mjansen' to this role) -- Course (created by 'mjansen', he is 'Course Administrator' and 'Category Admin') --- Adobe Connect Object (created by 'mjansen')

Now 'mjansen' assigned 'student1' as 'Course Member' to the course.

With 'student1' I am able to enter the Adobe Connect object.

[bogenschlag]

We are having a hard time (reliably) reproducing the exact failure scenario ourselves. Sometimes everything works fine, sometimes not. We are quite definitely seeing problems though, where users somehow seem to manage creating "broken" Connect objects in ILIAS. And it only seems to happen in combination with local category roles. We are still investigating.

[fheibel]

Should I send you an role-export.zip from one of the category admin roles?

[bogenschlag]

If we can reproduce this on a (cloned) test installation, would you be interested in temporary admin access there?

[mjansenDatabay]

The "delete" issue (mentioned in the first comment) should be fixed with the latest commit. The "delete" permission was coupled to the assignent of a local Adobe Connect object role (xavc_member or xavc_admin), why ever (conceptual nonsense).

[bogenschlag]

Thanks for the feedback—we will investigate further.