[
https://issues.apache.org/jira/browse/OAK-6144?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16006485#comment-16006485
]
Manfred Baedke commented on OAK-6144:
-------------------------------------
Thx [~anchela],
I agree that better test coverage is needed.
But in the first place I'd like to see if the contract for ExternalIdentity
makes sense and can be agreed on. The notion of an "inactive external identity"
should be a way for the IDP to say: "Yes, I can resolve the given identity
reference, but please don't use it, because I consider it disabled". So the
consumers should treat inactivity of an identity like they are currently
treating absence of an identity, and they should treat activity like they are
currently treating presence. But it's just a hint by the IDP which can be
ignored without breaking the contract ([~tripod]: so you are right, new package
version should be 2.3.1).
If all can agree that this should be the contract, I'll happily expand the test
coverage.
bq. I am wondering why the ExternalIdentity.isActive is only affects the
SynchronizationMBean implementation and not by the default SyncHandler.
bq. is there a similarity between ExternalIdentity.isActive() and
User.isDisabled()? this also goes in the direction wrt clarifying what 'active'
really means. Somehow I get the impression that it has pretty much the same
intention: the identity exists but is disabled, which presents sync and login
Yes, the DefaultSyncContext still ignores the flag, I failed to mention that.
IMO it should map disable inactive users and enable active users. Thoughts?
> ExternalIdentity should have a method indicating if an identity is actually
> active
> ----------------------------------------------------------------------------------
>
> Key: OAK-6144
> URL: https://issues.apache.org/jira/browse/OAK-6144
> Project: Jackrabbit Oak
> Issue Type: New Feature
> Components: auth-external
> Reporter: Manfred Baedke
> Assignee: Manfred Baedke
> Attachments: oak-6144-1.patch
>
>
> The interface ExternalIdentityProvider currently offers the method
> getIdentity(ExternalIdentityRef) to resolve a reference to an external
> Identity, but there is no way to tell if the external identity is considered
> active by the identity provider. The ability to resolve the reference doesn't
> mean that the resulting identity may actually be used for authentication or
> authorization.
> If ExternaIIdentity isn't able to express this difference, it's hard to come
> up with a sensible implemenation of e.g.
> SynchronizationMBean#purgeOrphanedUsers(), because the ability to resolve a
> reference to an external identity doesn't mean that the corresponding Oak
> user is still valid.
> A new method ExternalIdentiy#isActive() would allow us to clearly define the
> notion of an "orphaned user".
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
