Re: [yaco-liaison-tool] From Field in Liaison Tool

[Glen <[e-mail]>]

Hi Emilio -

On 1/31/2011 9:28 AM, "Emilio A. Sánchez López" wrote:
> I'll understand that secretariat staff has to be able to perform any
> action on the system. However, the fact that they can impersonate any
> user does not seem a good idea. In that case you will not be able to
> know if the user X made some change of was a staff user impersonating X.
> But this is only my opinion :)

Unfortunately, that turns out not to be the case.  We have many 
situations in which IETF leaders expect us to be able to do things "on 
their behalf" - including cast and/or clear ballot positions, post 
comments, etc.

> I see in other parts of the idtracker that the secretariat staff can
> access some features but always as their user. For example, they can add
> comments to a draft, but they can not add a comment as if they were
> another person. Henrik knows the tool better than myself so correct me
> if I'm wrong.

Where such situations exist, that is a deficiency that should be 
corrected - and where those situations exist, I generally have to go in 
to the database by hand to "fix" the record(s) in question.  And those 
deficiencies in no way change the fact that IETF leaders expect us to be 
able to do those things, whether right or wrong, alas.

> I think that are mainly two options to address this. One, as you said,
> is to make sure that this requirement is spelled out and then each new
> tool developed will need to allow a user from secretariat act as any
> other user.

Agreed.  The secretariat needs to be more involved in the review of all 
the IETF contracts that go out; alas, such is outside of my purview, but 
I hope those in command will consider this going forward.

> And two, modify the auth system so any secretariat user will be able to
> "jump" from one user to another and perform actions as this user
> transparently to the system. This has the advantage that old code will
> work properly and new code don't need to implement any special functions
> to allow that change for the secretariat members. The disadvantage, of
> course, is that the system will log actions as the "fake" member instead
> of the secretariat user.

That sounds a bit overwhelming from a usage standpoint, but I will defer 
to others on that.

> Leaving aside this second option, in the case of the liaison tool I see
> some ways of solving the issue:
> * Allow to edit the name of the submitter when the user is in the
> secretariat group placing a text input.
> * Allow to select the submitter when the user is in the secretariat
> group placing a select box.
> * Inserting a previous view in which the secretariat member selects
> which user he/she wants to impersonate.

Thank you for taking the time to reply.  It looks like Alexa also 
replied to you (I didn't see that when I sent my reply) so it sounds 
like she and you have this well in hand.

Best,
Glen