View Groups Based on Title

I need to display 2 active directory groups in the Web Interface under "Add to Groups" if a user has the title is equal to Owner. If the title is something other than Owner, these groups need to be hidden. What is the best way to accomplish this?

  • Need a bit of clarity on this ask - so anyone with the Title "Owner" should be able to add people to these groups?  Is it always the same two groups?

  • Follow-up question:  And you want the visibility of these groups restricted to these people as well?

  • Yes, anyone with the owner title can see these groups. The same 2 groups should display for all owners.

  • Visibility of the 2 groups will only be available to users with the owner title.

  • I am confused about what you are asking for.  See below a screen cap.  To get here, I selected a user in the Web UI and clicked on their "Member Of" in the right pane.  I then clicked on the "Add" button in the Member Of window (you can see it there in the shadow).  At which point, I was presented the dialogue in the foreground where I can look for groups to add this user to.  I know my groups have a "GG" prefix so typed that and hit the filter button.  These are all the groups I could potentially add this user to.  Do you want this view to be filtered just to the "Owner"'s groups?  Or, show all groups BUT only include the "special" groups for Owners?

  • In your screenshot above, I want the view to be filtered by the title of the user. For example, I want RoyaltyAdmin and FinancialAccess AD groups displayed to uses with the owner title. If the user is not an owner, they will not see the RoyaltyAdmin and FinancialAccess AD groups.

  • I was able to cobble something together by creating the following. This is based on the assumption that the user's themselves will be browsing to the Admin site and adding themselves to the groups. This is not done on behalf of someone else adding another user to one of the groups.

    - A dynamic security group that is populated based on Title = 'Owner'.

    - A Managed Unit that contains the groups I want the people with a Title of 'Owner' to be able to see.

    - Two Access Templates. One of the AT's links the Dynamic Group to the Managed Unit and grants: 'Group-List Object', 'Group:Read All Properties', 'Group:Add/Remove self as member'. The other AT links Authenticated Users to the root of the domain (this allows the users the ability to see/find their own user object, along with read only access to all other user objects) and grants 'List Object' and 'Read All Properties' to Domain, OU and Users.

    This allows my TestUser2 who has a title of 'Owner' to browse to the Admin site, search for their own account in the Quick Search. They can select their account and click on Member Of. When they click the Add button and then click on the Search button with no search criteria, only the 2 groups in the Managed Unit appear and this user can add themselves to the groups.

  • Owner will see the RoyaltyAdmin and FinancialAccess AD groups, plus 17 other groups. Other users will only see the 17 other groups and not the RoyaltyAdmin and FinancialAccess AD groups.

  • Just link the first AT I mentioned above between a group that contains all other users including 'Owner' users, or all Authenticated Users, to an OU or Managed Unit that contains these 17 groups. This way all users can see these 17 groups plus the users that belong to the 'Owners' Dynamic Group can see the 2 special controlled groups that are in the 'Owner Groups' Managed Unit.