Managing CalGroup Privileges

A knowledge base article about Managing CalGroup Privileges provided by the UC Berkeley IT Service Hub - Knowledge Portal

Managing CalGroup Privileges

Administrative privileges should be given to groups instead of directly to individuals. Using Admin Privilege groups allows you to more easily track, grant, and revoke privileges in your groups.

CalGroups has a rule that applies the permission from an enclosing folder to its sub folders. This means if you have admin privileges over a folder, you also have admin privileges over its sub folders.

Table of Contents

View Privilege Holders for Group or Folder

  1. Navigate to a group or folder.
  2. Click on the grey Privileges tab.
  3. Privilege holders are listed one per row under Entity name in the lower grey portion of the screen.
  4. A black checkmark in a column means the entity holds that privilege directly.
  5. A grey checkmark means the entity holds that privilege indirectly.
  6. To see an entity's Privileges in more detail, click on the Actions button and select Edit Membership and Privileges.
Direct vs Indirect Privileges:

Direct privileges are assigned specifically to an individual or group. Indirect privileges are inherited (e.g., a member of an Admin group has indirect privileges over the groups that the Admin group manages).

Create Admin Privilege Group

Any group may be assigned admin privileges over another group. CalNet recommends that you create admin groups specifically for that purpose.

  1. First, create a group following the instructions in the CalGroups User Guide.
  2. Be sure to be clear when naming your group so it is obvious it is an administrative group. (Example: [Department Name] Admins).

Assign Admin Privilege Group

Once you have created an Admin group, you must assign it the appropriate privileges over your folder or specific groups.

  1. Navigate to the folder or group you want to manage.
  2. Click the Privileges tab.
  3. Click Add Entities.
  4. Search for your newly created Admin group.
  5. Select the checkmarks for the privileges you wish to grant (Admin, Update, Read, etc.).
  6. Click Add.

Add Privilege Holder to Group

To grant a user administrative rights, simply add them as a member of your Admin Privilege group.

  1. Navigate to your Admin Privilege group.
  2. Click Add Members.
  3. Search for the person by name or UID.
  4. Click Add.

View/Edit User Settings

You can view all the privileges a specific user holds within your folder space.

  1. Within the Privileges tab, locate the user.
  2. Click the Actions gear icon next to their name.
  3. Select Edit Membership and Privileges to see a breakdown of direct and inherited rights.

Assign Global Privileges

Global privileges apply to all groups within a folder. If you want a group of admins to be able to manage everything in your departmental folder:

  1. Navigate to the top-level folder for your department.
  2. Follow the steps in Assign Admin Privilege Group at this folder level.
  3. Check the "Inherit" box to ensure these rights flow down to all sub-folders and groups.

Privilege Definitions

Privilege Description
Admin Allows user to grant privileges to others and delete the group/folder.
Update Allows user to change group attributes (description, naming) and manage membership.
Read Allows user to see the group exists and view its members.
OptIn / OptOut Allows users to join or leave the group themselves (if enabled).
View Basic permission to see that the group/folder exists in the hierarchy.

For further assistance, please contact calnet-admin@berkeley.edu or visit the CalGroups Integration Guide.