[
https://issues.apache.org/jira/browse/OAK-6144?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16065174#comment-16065174
]
Manfred Baedke commented on OAK-6144:
-------------------------------------
[~anchela],
Thanks for your comments. I attached oak-6144-3.patch, trying to address all
issues you mentioned except the missing general documentation (currently
working on it) and the following two issues I'd ask you to elaborate on:
1. ExternalIdentity#isActive() throwing ExternalIdentityException
If an error occurs when calling the IDP, I'd like to tell the consumer. I don't
know about the desired error handling in unknown consumer implementations. The
other option would be to silently consider the questionable entities active - I
don't see why this would be preferable.
2. no additional tests in DynamicSyncContextTest
The main thing to test would be that dynamic membership treats inactivity like
absence. When looking into DynamicSyncContextTest, I did not find any tests
regarding non-existing resp. removed users. Are we totally lacking test
coverage here or am I missing something?
> ExternalIdentity should have a method indicating if an identity is actually
> active
> ----------------------------------------------------------------------------------
>
> Key: OAK-6144
> URL: https://issues.apache.org/jira/browse/OAK-6144
> Project: Jackrabbit Oak
> Issue Type: New Feature
> Components: auth-external
> Reporter: Manfred Baedke
> Assignee: Manfred Baedke
> Attachments: oak-6144-1.patch, oak-6144-2.patch
>
>
> The interface ExternalIdentityProvider currently offers the method
> getIdentity(ExternalIdentityRef) to resolve a reference to an external
> Identity, but there is no way to tell if the external identity is considered
> active by the identity provider. The ability to resolve the reference doesn't
> mean that the resulting identity may actually be used for authentication or
> authorization.
> If ExternaIIdentity isn't able to express this difference, it's hard to come
> up with a sensible implemenation of e.g.
> SynchronizationMBean#purgeOrphanedUsers(), because the ability to resolve a
> reference to an external identity doesn't mean that the corresponding Oak
> user is still valid.
> A new method ExternalIdentiy#isActive() would allow us to clearly define the
> notion of an "orphaned user".
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
