News for hackers. Stuff that matters.

A comment on Ask HN: How To: Store and share passwords in a company?. Parent comment

Re:Ask HN: How To: Store and share passwords in a company? by egamirorrim on Sunday September 01, 2024 @04:07PM (#41419925)
OOI do you ever use SCIM for something really granular? I have a service where people can be one of 5 roles and then have access to 1..30 named 'workspaces' - all that we'd like to control with policy on our side not vendor side

I think it's unsuitable for SCIM because I'd have to create 5*30 AD groups?

[ Parent | on HN ]
Re:Ask HN: How To: Store and share passwords in a company? by jitl on Sunday September 01, 2024 @08:36PM (#41421526)
Users can be in more than one group right? Or they might have a different role per workspace?
[ Parent | on HN ]
Re:Ask HN: How To: Store and share passwords in a company? by deltaknight on Monday September 02, 2024 @03:31AM (#41423358)
Honestly I’ve worked in places with many 1000s of AD groups. At some point, that’s just what fine grained access control means, I’m not sure there’s much point in trying to prematurely optimise for fewer groups.

Of course, if there’s a way to simplify the access (like are there truly 5 roles or in practice do people end up bucketed in to 2/3), or if you can configure one role group with the user is always in and group per workspace that’s always ideal, but that might well come back to bite you.

[ Parent | on HN ]