Secondary Permissions do not respect Application Permission Field

[Elizabeth Davis]

When a staff account has a secondary permission group, the application permission fields are not respected when editing a staff account.

To replicate:
1. Have a staff permission group that only system admins can edit. For example, for PaILS, we have an Original Cataloger permission group that only Support staff can edit.
2. Apply that permission group as a Secondary Permission Group.
3. Have a local administrator account, a permission group who can create staff accounts, edit the test staff account. They should not have the ability to edit this account.

We are experiencing this in 3.9.2.

[Susan Morrison (smorrison425)]

Tested in 3.10 and experienced the same behavior.

[Britta Dorsey (bdorsey-isl)]

We are experiencing this in 3.11.2 as well.

[Mike Rylander (mrylander)]

Changing to wishlist because, while I understand the desire, the Group Application Permissions mechanism is specifically intended to restrict creation and modification of a user based on their Profile Group field.

I think either a secondary-group focused mechanism, or a separately permission-protected library setting (or, more realistically to reduce the complexity of the logic for the user, a global flag) that tells the system to treat secondary groups the same as the Profile Group, will be needed.

[Terran McCanna (tmccanna)]

So currently, if the highest level permission group is the primary, the editing will be restricted appropriately?

[Elizabeth Davis (elidavis)]

I think a global flag will work for us. We have separate permission groups for job duties, so we use the Secondary Permissions often. The higher permission groups that require support intervention are often paired with lower permission groups that don't require support intervention.

[Elizabeth Davis (elidavis)]

Terran- correct. Say a staff member has a circclerk permission group (support is not required to assign) and original cataloger (support has to assign once they take the certification quiz). If the original cataloger is in the primary it will block, but if the circclerk is in the primary, non-support staff can edit. We see it happen most often in the user buckets.