Group Permission: Users View Allow - not show LDAP synced user about snipe-it HOT 3 OPEN

Hmm I followed your steps and I'm not able to reproduce this issue. I can see all the synced users. 🤔

from snipe-it.

Well,
I spent some time and found the problem. But not a solution.

More explanations are needed...

The problem is that the query that retrieves the users on the webUI: checks the company_id and is related to inheriting it.

select `users`.`activated`, `users`.`created_by`, `users`.`address`, `users`.`avatar`, `users`.`city`, `users`.`company_id`, ` users`.`country`, `users`.`created_at`, `users`.`deleted_at`, `users`.`department_id`, `users`.`email`, `users`.`employee_num`, `users` .`first_name`, `users`.`id`, `users`.`jobtitle`, `users`.`last_login`, `users`.`last_name`, `users`.`locale`, `users`.` location_id`, `users`.`manager_id`, `users`.`notes`, `users`.`permissions`, `users`.`phone`, `users`.`state`, `users`.`two_factor_enrolled` , `users`.`two_factor_optin`, `users`.`updated_at`, `users`.`username`, `users`.`zip`, `users`.`remote`, `users`.`ldap_import`, ` users`.`start_date`, `users`.`end_date`, `users`.`vip`, `users`.`autoassign_licenses`, (select count(*) from `assets` where `users`.`id` = `assets`.`assigned_to` and `assets`.`assigned_type` = 'App\Models\User' and `assets`.`company_id` = 1) as `assets_count`, (select count(*) from `licenses` inner join `license_seats` on `licenses`.`id` = `license_seats`.`license_id` where `users`.`id` = `license_seats`.`assigned_to` and `licenses`.`deleted_at` is null and `licenses` .`company_id` = 1) as `licenses_count`, (select count(*) from `accessories` inner join `accessories_users` on `accessories`.`id` = `accessories_users`.`accessory_id` where `users`.`id ` = `accessories_users`.`assigned_to` and `accessories`.`company_id` = 1) as `accessories_count`, (select count(*) from `consumables` inner join `consumables_users` on `consumables`.`id` = ` consumables_users`.`consumable_id` where `users`.`id` = `consumables_users`.`assigned_to` and `consumables`.`company_id` = 1) as `consumables_count` from `users` where `users`.`company_id` = 1 and `users`.`deleted_at` is null order by `first_name` asc limit 20 offset 0`

So this test user and 4-5 manually added users in the beginning have the same company_id.
The others don't have any company_id. And the company_id is not obtained from LDAP.
All LDAP users that sync come without a company_id. If I fix them manually later, they remember the company_id and on the next sync, the company_id remains saved.
On the other hand: In the ADserver, the "Company" field is entered in all users, but I think it is not involved in the synchronization. (this can be checked later, but is not important)

The super user doesn't depend on company_id inheriting.
The super user can see all company_id's

the simple solution I can think of is to allow defined users (AND GROUPS!) to be able to participate in two or more companies.
So that they can see everything that depends on company_id.
It doesn't sound very logical, but company_id is also not used in the right way.

But why two or more companies in the first place?
The problem I was trying to solve is that:
We have an asset that is ours, but we proved to a different company to use them for support purposes. These are tablets that have specific software.
So I assigned a specific user from the support department who should be able to manage these devices and only see them.
Because restriction in the level of department_id is not working as we expect...

And now we need to add a user who can see all users and assets - of all "companies" -
The auditors in this case.
But without being able to touch them. I.e. only with read rights.

And in this situation, there is no way to add it in both "companies"...

Side issue: (1 blue arrow)
The test user, even though he doesn't have the right to export and even though he only sees 5(8?) users - because they are from the same company - ... when he clicks the "Export" button in the people tab - it exports all users ... ?! ...?! ... Yes.. all users are visible in the file.

from snipe-it.

Are there plans to fix permissions in version 7?

-_- for now "Full Multiple Companies Support" is disabled and we hope the support guy doesn't mess things up...

from snipe-it.