dhis2-users team mailing list archive

[Lars Helge Øverland <larshelge@xxxxxxxxx>]

Hi,

one learning from Kenya is that "local concerns" such as assignment of
services (datasets) and classification (group assignment) of facilities
should be decentralized to district managers as they can perform this task
more efficiently and with a better understanding of their local area.

We now increasingly see that facility users start entering data online
themselves and decentralizing management of facility user accounts would be
a good idea. This comes with a few challenges however as we want to provide
them the ability only to create users with "less" authority than what they
have themselves. We have now implemented a solution for this in trunk which
implies that a user can issue a user role to a new user if:

- The current user has the ALL authority OR the issued user role authority
group is a subset of the aggregated authorities of the current user (i.e.
the current user has all of the authorities he wants to issue to another
user.)

- The issued user role is NOT among the current user's user roles (i.e. the
current user can not issue his own user roles to another user.)

The latter rule is there e.g. because we don't want districts users to
create new district users, rather to create facility users only.

This solution means that it is now sensible to allow district and province
users access to the user module. Just to keep you informed...


Lars