To get full access to the Kademi Hub existing customers can login here, or new customers can register here.
A GroupRole is a well known identifier for a set of permissions. It is assigned to a Group to give that group the permissions which the role conveys. For example the "Administrator" role will have a very broad set of permissions, while "Content Author" will have a reduced set. The actual permissions will depend on application configuration. Note: when referring here to "the principal" we are talking about the user which is having its permissions calculated, and is a member of a group with a grouprole A GroupRole can be attached to a protected resource in one of three ways - if a repository is specified then that is what the permissions apply to - otherwise, if an organsiation is specified that that is the applicable object - otherwise, ie if nothing is explicitly stated, then the applicable organisation is inferred from the user's group membership. Ie whatever organisation their membership is on
Group: Database Entities
Implements: Serializable, Auditable, PortableId
Properties
| Property | Returns | Description |
|---|---|---|
| auditOrg | Organisation | The organisation that changes to this role assignment are audited against, taken from the grantee group. Not persisted, and reading it loads the group. |
| grantee | Group | The group the role is granted to. Never null, and loaded lazily. Every member of the group receives the role's permissions, so permissions are never granted to an individual profile through this record. |
| id | long | Generated primary key of the role assignment. Zero until the record has been saved. |
| repository | Repository | Restricts the role to a single repository, which takes precedence over the organisation when it is set. Leave it null for a role that applies to an organisation rather than to one piece of content. Loaded lazily. |
| roleName | String | The well known name of the role being granted, such as Administrator or Content Author. Never null. What the name actually permits is decided by application configuration rather than by anything stored here. |
| withinOrg | Organisation | Restricts the role to a single organisation. When it is null the role instead applies within whichever organisation the user's group membership is on, which is how one role record can cover many organisations. Loaded lazily. |
Methods
getId()
Returns: long
Generated primary key of the role assignment. Zero until the record has been saved.
getRoleName()
Returns: String
The well known name of the role being granted, such as Administrator or Content Author. Never null. What the name actually permits is decided by application configuration rather than by anything stored here.
getGrantee()
Returns: Group
The group the role is granted to. Never null, and loaded lazily. Every member of the group receives the role's permissions, so permissions are never granted to an individual profile through this record.
getWithinOrg()
Returns: Organisation
Restricts the role to a single organisation. When it is null the role instead applies within whichever organisation the user's group membership is on, which is how one role record can cover many organisations. Loaded lazily.
getRepository()
Returns: Repository
Restricts the role to a single repository, which takes precedence over the organisation when it is set. Leave it null for a role that applies to an organisation rather than to one piece of content. Loaded lazily.
portableId()
Returns: String
A stable identifier for this role assignment that survives being copied between accounts, built from the grantee group's name and the role name. Reading it loads the grantee group.
getAuditOrg()
Returns: Organisation
The organisation that changes to this role assignment are audited against, taken from the grantee group. Not persisted, and reading it loads the group.
© 2025 Kademi Ltd