DEV Community: Query Filter

gradle-108

Query Filter — Thu, 03 Sep 2026 20:16:33 +0000

gradle-107

Query Filter — Thu, 03 Sep 2026 17:21:09 +0000

gradle-106

Query Filter — Thu, 03 Sep 2026 17:18:31 +0000

ubject: Citi Desktop Migration Inquiry: Group Aggregation / Collapsible Menus for comet-nam

Hi Team,

To align with our business and customer operating models, the NAM team needs to configure comet-nam across 14 distinct functional groups (e.g., Cash, Converts, Delta One, Pilot Group 1, Support, etc.).

However, under the current 1-application-per-group setup, provisioning each group as an independent entry creates significant visual clutter on the Citi Desktop Launcher panel (spanning 14+ standalone cards for a single platform):

(See generated layout preview below for visual impact)

Key Questions:

Launcher Aggregation Pattern: We noticed OneTouch successfully reduced Launcher clutter by consolidating multiple entries. How was this configured within the AppD portal / launcher manifests?

Hierarchical Expansion: Ideally, we want comet-nam to appear as a single root entry on the Launcher with an expandable chevron/arrow that unfolds into the 14 targeted group entries (comet-nam [Pilot Group 1], comet-nam [Cash], etc.) upon user interaction.

Is this hierarchical grouping supported natively in the portal, and what is the recommended pattern to achieve this? I suspect it might be a GUI configuration setting in the application manifest.

Thanks,

Leonid

gradle-105

Query Filter — Thu, 03 Sep 2026 16:12:12 +0000

gradle-104

Query Filter — Tue, 01 Sep 2026 18:57:57 +0000

gradle-103

Query Filter — Tue, 01 Sep 2026 17:27:52 +0000

MEMORANDUM

TO: Management

FROM: Leonid Spektor

DATE: September 1, 2026

SUBJECT: Architectural Assessment & Trade-off Analysis: Citi Desktop Onboarding & Atom Group Provisioning

Executive Summary

Onboarding our application suite to Citi Desktop introduces a structural constraint: the platform supports only one Atom Group per registered application in AppDirectory.

To map our existing 14 production user groups (~767 users across North America) into this paradigm, we have identified two viable onboarding strategies. Both options introduce operational trade-offs between application metadata management and ongoing access governance. Management decision is required to select the path forward.

Key Technical Constraint

Citi Desktop limits each AppDirectory application entry to a single bound Atom Group. Because our current access model relies on 14 distinct functional production groups (e.g., Group A, Group B, Group C), a direct 1:1 mapping within a single AppDirectory application entry is not natively supported by the platform.

Evaluation of Onboarding Options

Option 1: Application-Level Segmentation (14 AppDirectory Applications)

Create 14 separate AppDirectory application entries, where each entry differs solely by its associated Atom Group binding.

Pros:
Preserves all 14 existing functional Atom groups as-is without re-provisioning users.
Eliminates manual user re-keying and bulk entitlement migration risks.
Avoids ongoing dual-maintenance of user group memberships.
Cons:
High application clutter within the AppDirectory catalog.
Violates Atom team platform recommendations.
Increases administrative overhead during global configuration updates or application releases across 14 entries.

Option 2: Group Consolidation (2 AppDirectory Applications: Pilot & Prod)

Consolidate the existing 14 groups into 2 newly provisioned Atom Groups ([PILOT] and [PROD]), mapping to 2 corresponding AppDirectory application entries. This mirrors the approach currently being trialed by the EMEA team.

Pros:
Aligns with the Atom architecture team’s recommended deployment pattern.
Keeps the AppDirectory catalog clean and manageable (2 entries instead of 14).
Cons:
Initial Migration Risk: Requires mapping ~767 users into the new consolidated groups. Manual entry carries a high error rate and will require a dedicated QA validation cycle.
Long-Term Operational Overhead: Future user lifecycle events (onboarding, offboarding, role changes) will require updates across both legacy functional groups and the new Desktop groups.
Redundancy: Legacy functional groups must still be maintained if relied upon outside of Citi Desktop.

Comparative Trade-off Matrix

Metric	Option 1: 14 AppDirectory Apps	Option 2: Consolidated Pilot/Prod Groups
Catalog Maintenance	High (14 app records to maintain)	Low (2 app records to maintain)
Initial Implementation Effort	Low (configuration-only in AppD)	High (user mapping, entitlement migration, QA)
Data Entry / Error Risk	Low (no user migration)	High (~767 users to map without automated tooling)
Ongoing User Lifecycle Support	Low (uses existing user entitlements)	High (dual-group maintenance upon joins/moves/leaves)
Atom Architectural Alignment	Non-Standard	Standard

Recommendation & Next Steps

Short-Term Priority: If Option 2 is selected, we strongly advise against manual user entry. We should engage the Atom support team immediately to request programmatic API or bulk CSV/scripting mechanisms to migrate the 767 users cleanly and reduce QA verification time.
Decision Required: Management selection between accepting Application Catalog Maintenance (Option 1) versus Ongoing Access Maintenance & Migration QA (Option 2).

gradle-102

Query Filter — Mon, 31 Aug 2026 20:58:51 +0000

Guidance Request: Provisioning New Atom Groups for Citi Desktop (PROD)

Hi [Recipient Name/Team],

The Citi Desktop NAM team requires your guidance on creating and configuring new Atom groups for the PROD environment.

We would like to replicate the existing naming conventions and grouping structure currently used for Atom Launcher. For context, our current 14 PROD groups consist of 767 users structured as follows:

Group Name	User Count
Cash	113
Converts	10
Default	61
Delta One	31
Derivative	86
DEV	8
Market Data Backup group	2
Misc Desks	191
Pilot Group 1	25
Pilot Group 2	7
Pilot Group 3	6
QA	168
Retail	5
Support	54
Total	767

Once our NAM team has Admin access, then we will add the new Atom groups and map the 767 users (we have the complete user list ready) to their appropriate groups out of the 14.

Could you please elaborate on the recommended process and any required approvals to proceed with this setup? Specifically:

Is there a script, API, or bulk import mechanism available, or will each user need to be hand-mapped individually?

Thanks,

Leonid and the NAM Team

gradle-101

Query Filter — Mon, 31 Aug 2026 20:57:54 +0000

Subject: Guidance Request: Provisioning New Atom Groups for Citi Desktop (PROD)Hi [Recipient Name/Team],The Citi Desktop NAM team requires your guidance on creating and configuring new Atom groups for the PROD environment.We would like to replicate the existing naming conventions and grouping structure currently used for Atom Launcher. For context, our current 14 PROD groups consist of 767 users structured as follows:Group NameUser CountCash113Converts10Default61Delta One31Derivative86DEV8Market Data Backup group2Misc Desks191Pilot Group 125Pilot Group 27Pilot Group 36QA168Retail5Support54Total767Once our NAM team has Admin access, then we will add the new Atom groups and map the 767 users (we have the complete user list ready) to their appropriate groups out of the 14.Could you please elaborate on the recommended process and any required approvals to proceed with this setup?Thanks,Leonid and the NAM Team

gradle-87

Query Filter — Wed, 26 Aug 2026 15:56:28 +0000

Conclusions & Recommendations

EMEA Alignment Monitoring: The Comet NAM team must closely track the EMEA Atom group creation process to determine if a parallel strategy should be adopted for the NAM region.

User Segmentation: Identify and categorize users into three distinct groups: Support, Pilot, and Production.

Phased Rollout Strategy:

Grant early access to Citi Desktop PROD to the Support group (or a designated subset of initial "champions").

Allow this initial cohort to navigate the learning curve and establish operational best practices before cascading knowledge to the Pilot and Production groups.

Open Action Item for NAM

Group Assessment: Confirm whether NAM currently maintains corresponding user groups, or if action is required to build new groups and/or consolidate existing ones into the target 3-group structure.

gradle-86

Query Filter — Wed, 26 Aug 2026 15:12:45 +0000

Here is the updated and consolidated summary, incorporating the details from the Zoom AI email recap:

Group Restructuring & Migration Strategy

Group Split: Restructuring existing ATOM groups into three distinct categories: Production, Pilot, and Support.

Pilot Group: Merging 3 pilot groups into 1 single group containing 23 users.

Support Group: Remaining unchanged at 62 users (includes RMC team members, onshore/offshore, and NAM support). All existing prod users will be imported as-is to prevent access loss.

Migration Sequence: Leonid recommended a phased rollout starting with Support users first, who can act as "champions" to test the installation and assist Pilot and Production users later.

Access Rules: Clarified that users without explicit prod needs (e.g., Guramrit) should not be added to prod access groups.

Technical & Active Directory (AD) Challenges

Cross-Domain Issue: Creating single AD groups faces hurdles due to members residing in different domains (NAM vs. non-NAM). An incident needs to be raised to resolve cross-domain user management.

Change Task: A change task is required to create the new ATOM groups (prod and pilot).

Teams Discussion Clarifications

Atom Group vs. Visibility in Launch Info:

Atom Group (NGD Agent): Controls which machines download/install a given version (e.g., releasing to Group A downloads only for Group A).

Visibility (Citi Desktop Menu): Controls icon visibility in the menu. If an app is visible but not downloaded by NGD, it displays as greyed out with a "not installed" tooltip.

Group Cleanup: Groups not mapped to AppDynamics configurations must be handled separately with the ATOM Support team once migration completes.

Next Steps & Action Items

Guramrit: Create new AD groups for prod and pilot, and add all 23 pilot users to the pilot group.

Guramrit: Raise an incident for cross-domain AD group creation.

Guramrit: Raise a change task for new ATOM groups, considering whether to set them up for UAT first before production.

Guramrit / Team: Consult Vijaya regarding the support group migration approach (champions vs. full group install) and resend Guramrit's clarification email to Anuj/Sumit.

Meeting Follow-up: Reschedule the check-in call once Vijaya is available to address outstanding implementation questions.

gradle-85

Query Filter — Tue, 25 Aug 2026 16:50:57 +0000

To complete the Immersive Labs Java Path Traversal exercise, follow these step-by-step instructions.Step 1: Walk Through the Demo ExploitSwitch to the Preview tab or click Demo Exploit Vulnerability on the preview/testing UI.Observe how providing a path like ../../../../etc/passwd allows reading files outside the designated avatar directory.Step 2: Understand the Vulnerability in AvatarServlet.javaIn lines 33–38:JavaString basePath = req.getServletContext().getRealPath("avatar");
Path path = Paths.get(basePath, filename);
File file = path.toAbsolutePath().toFile();
Paths.get(basePath, filename) resolves relative path sequences like ../. Without canonicalization checks, an attacker can traverse outside basePath.Step 3: Remediate the VulnerabilityTo fix path traversal, verify that the normalized/canonical target path still starts with the base path prefix before serving the file.Open Code Editor $\rightarrow$ src/main/java/com/immersivelabs/fitness/servlet/AvatarServlet.java.Locate the doGet method around line 33.Replace lines 33–45 with the following secure path validation logic:Java// Get the base path where all avatars live
String basePath = req.getServletContext().getRealPath("avatar");
Path baseDirPath = Paths.get(basePath).toAbsolutePath().normalize();

// Join with the provided filename and normalize path traversal sequences
Path targetPath = Paths.get(basePath, filename).toAbsolutePath().normalize();

// Verify target path remains inside baseDirPath
if (!targetPath.startsWith(baseDirPath)) {
    resp.setStatus(HttpServletResponse.SC_FORBIDDEN);
    return;
}

File file = targetPath.toFile();

if (!file.exists() || file.isDirectory()) {
    resp.setStatus(HttpServletResponse.SC_NOT_FOUND);
    return;
}

gradle-84

Query Filter — Tue, 25 Aug 2026 16:50:35 +0000

To complete the Immersive Labs Java Path Traversal exercise, follow these step-by-step instructions.Step 1: Walk Through the Demo ExploitSwitch to the Preview tab or click Demo Exploit Vulnerability on the preview/testing UI.Observe how providing a path like ../../../../etc/passwd allows reading files outside the designated avatar directory.Step 2: Understand the Vulnerability in AvatarServlet.javaIn lines 33–38:JavaString basePath = req.getServletContext().getRealPath("avatar");
Path path = Paths.get(basePath, filename);
File file = path.toAbsolutePath().toFile();
Paths.get(basePath, filename) resolves relative path sequences like ../. Without canonicalization checks, an attacker can traverse outside basePath.Step 3: Remediate the VulnerabilityTo fix path traversal, verify that the normalized/canonical target path still starts with the base path prefix before serving the file.Open Code Editor $\rightarrow$ src/main/java/com/immersivelabs/fitness/servlet/AvatarServlet.java.Locate the doGet method around line 33.Replace lines 33–45 with the following secure path validation logic:Java// Get the base path where all avatars live
String basePath = req.getServletContext().getRealPath("avatar");
Path baseDirPath = Paths.get(basePath).toAbsolutePath().normalize();

// Join with the provided filename and normalize path traversal sequences
Path targetPath = Paths.get(basePath, filename).toAbsolutePath().normalize();

// Verify target path remains inside baseDirPath
if (!targetPath.startsWith(baseDirPath)) {
resp.setStatus(HttpServletResponse.SC_FORBIDDEN);
return;
}

File file = targetPath.toFile();

if (!file.exists() || file.isDirectory()) {
resp.setStatus(HttpServletResponse.SC_NOT_FOUND);
return;
}