Uploaded image for project: 'Jackrabbit Oak'
  1. Jackrabbit Oak
  2. OAK-4087

Replace Sync of configured AutoMembership by Dynamic Principal Generation

    XMLWordPrintableJSON

Details

    Description

      the DefaultSyncConfig comes with a configuration option PARAM_USER_AUTO_MEMBERSHIP indicating the set of groups a given external user must always become member of upon sync into the repository.

      this results in groups containing almost all users in the system (at least those synchronized form the external IDP). while this behavior is straight forward (and corresponds to the behavior in the previous crx version), it wouldn't be necessary from a repository point of view as a given Subject can be populated from different principal sources and dealing with this kind of dynamic-auto-membership was a typical use-case.

      what does that mean:
      instead of performing the automembership on the user management, the external authentication setup could come with an auto-membership PrincipalProvider implementation that would expose the desired group membership for all external principals (assuming that they were identified as such).

      tripod, do you remember if that was ever an option while building the oak-auth-external module? if not, could that be worth a second thought also in the light of OAK-3933?

      Attachments

        1. OAK-4087_documentation.patch
          15 kB
          Angela Schreiber
        2. OAK-4087.patch
          60 kB
          Angela Schreiber

        Issue Links

          blocks

          Bug - A problem which impairs or prevents the functions of the product. OAK-4679 Backport OAK-4119, OAK-4101, OAK-4087 and OAK-4344

          • Blocker - Blocks development and/or testing work, production could not run
          • Closed
          is related to

          Epic - Created by Jira Software - do not edit or delete. Issue type for a big user story that needs to be broken down. OAK-3933 potential improvements to membership management

          • Major - Major loss of function.
          • Open

          New Feature - A new feature of the product, which has yet to be developed. OAK-2687 Introduce Dynamic Groups

          • Major - Major loss of function.
          • Resolved
          relates to

          Bug - A problem which impairs or prevents the functions of the product. OAK-5195 ExternalPrincipalConfiguration uses 'group.autoMembership' instead of 'user.autoMembership'

          • Major - Major loss of function.
          • Closed

          Improvement - An improvement or enhancement to an existing feature or task. OAK-5194 'Dynamic' Automembership should respect both User and Group Config Values

          • Major - Major loss of function.
          • Closed
          requires

          New Feature - A new feature of the product, which has yet to be developed. OAK-4101 Consider separate external (group) principal management

          • Major - Major loss of function.
          • Closed

          Activity

            People

              angela Angela Schreiber
              angela Angela Schreiber
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: