[
https://issues.apache.org/jira/browse/OAK-4825?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15534196#comment-15534196
]
Alexander Klimetschek commented on OAK-4825:
--------------------------------------------
One important piece is missing: updating memberships. When users are removed,
they are automatically removed from groups. If they get disabled, one has to
explicitly update their memberships (remove on disable and add on re-enable).
Tried to do this in a new version: [^OAK-4825-c.patch]
Note that this makes it quite clear that OAK-4845 and the safe handling removal
of lost groups requires to set the {{rep:externalId}} on previously local only
groups (solution #2 in my [comment
here|https://issues.apache.org/jira/browse/OAK-4845?focusedCommentId=15533952&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-15533952].
Otherwise with solution #1 it would remove all group memberships, even pure
local ones, that could not be reinstated later if the user comes back in the
external IDP.
> Support disabling of users instead of removal in DefaultSyncHandler
> -------------------------------------------------------------------
>
> Key: OAK-4825
> URL: https://issues.apache.org/jira/browse/OAK-4825
> Project: Jackrabbit Oak
> Issue Type: Improvement
> Components: auth-external
> Reporter: Alexander Klimetschek
> Attachments: OAK-4825-b.patch, OAK-4825-c.patch, OAK-4825-doc.patch,
> OAK-4825.patch
>
>
> The DefaultSyncHandler by default will remove (local) users when they are no
> longer active in the external system aka no longer provided by the
> ExternalIdentityProvider. It would be useful to have an option to _disable_
> users instead of removing them completely.
> This is good for use cases that need to keep the user's data around in the
> JCR and can't just delete it. Also, we have seen cases where the user is only
> temporarily removed from the external identity system (e.g. accidentally
> removed from group that maps them to the JCR system and quickly added back),
> where a full removal can do unnecessary operations.
> (Note: There is an [option in the SyncContext
> interface|https://github.com/apache/jackrabbit-oak/blob/trunk/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/SyncContext.java#L38]
> to suppress purging completely, aka they won't be removed nor disabled, and
> the JMX sync commands such as
> [purgeOrphanedUsers()|https://github.com/apache/jackrabbit-oak/blob/trunk/oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/jmx/Delegatee.java#L256]
> "use" it. However, the JCR users look like "valid" users then locally. Even
> if the authentication is done completely through the IDP and will fail
> properly for these missing users, it can be difficult for other uses like
> administration, monitoring, other application code to detect that such a user
> is not active anymore.)
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
