[
https://issues.apache.org/jira/browse/OAK-6144?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16017370#comment-16017370
]
Manfred Baedke commented on OAK-6144:
-------------------------------------
[~anchela],
bq. if the intention of the 'active' flag is indeed similar to the disabling of
users
It's similar, but it need not be the same. The reason why the issue came up is
simply that the concept of a disabled user also existed on the external
identity server, in which case we obviously should have a mapping. That we
don't have the concept of a disabled Oak group is an arbitrary decision - the
external identity server may have something like that and we really should be
able to handle it. Moving the method to ExternalUser is an option that makes
sense if we decide that a disabled external group may always be ignored be the
SyncHandler. I'm not sure is this makes sense. Deleting the Oak group would be
more consistent with the original idea.
bq . may i ask you extend the patch to show the effect for DefaultSyncContext
and also for the DynamicSyncContext extension
Yes, as soon as the functionality is defined so we know what to test.
> ExternalIdentity should have a method indicating if an identity is actually
> active
> ----------------------------------------------------------------------------------
>
> Key: OAK-6144
> URL: https://issues.apache.org/jira/browse/OAK-6144
> Project: Jackrabbit Oak
> Issue Type: New Feature
> Components: auth-external
> Reporter: Manfred Baedke
> Assignee: Manfred Baedke
> Attachments: oak-6144-1.patch
>
>
> The interface ExternalIdentityProvider currently offers the method
> getIdentity(ExternalIdentityRef) to resolve a reference to an external
> Identity, but there is no way to tell if the external identity is considered
> active by the identity provider. The ability to resolve the reference doesn't
> mean that the resulting identity may actually be used for authentication or
> authorization.
> If ExternaIIdentity isn't able to express this difference, it's hard to come
> up with a sensible implemenation of e.g.
> SynchronizationMBean#purgeOrphanedUsers(), because the ability to resolve a
> reference to an external identity doesn't mean that the corresponding Oak
> user is still valid.
> A new method ExternalIdentiy#isActive() would allow us to clearly define the
> notion of an "orphaned user".
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
