Uploaded image for project: 'Jackrabbit Oak'
  1. Jackrabbit Oak
  2. OAK-4101

Consider separate external (group) principal management

    XMLWordPrintableJSON

Details

    • New Feature
    • Status: Closed
    • Major
    • Resolution: Fixed
    • None
    • 1.2.19, 1.4.7, 1.5.3, 1.6.0
    • auth-external
    • None

    Description

      Given the fact that user management is delegated to an external IDP provider, we might reconsider the current approach that attempts to synchronize user and particularly group and their membership into the repository.

      What would left with the repository is a dedicated PrincipalProvider for external groups (and maybe even users at a later stage), making sure that

      • the Subject is properly populated with Principal s upon login
      • access control can still be properly setup and managed in the repository for the principals defined in the external IDP.

      the consequences would be:

      • external groups (and potentially) users would no longer made available to the default user management implementation. alternatively: make them available as read-only stub i.e. group-membership as defined by the IDP could no longer be changed/manipulated in the reposiotry.
      • they are however exposed as principals to assert proper authentication + authorization. Note: any UI that properly reflects the fact that access control is being edited for principals (and not for users/groups) would not be affected at all; others might need to be adjusted to additionally support ac management based on the PrincipalManager

      will try to come up with a POC as soon as I find some time.

      Attachments

        1. OAK-4101_test.patch
          106 kB
          Angela Schreiber
        2. OAK-4101.patch
          71 kB
          Angela Schreiber

        Issue Links

          blocks

          Bug - A problem which impairs or prevents the functions of the product. OAK-4679 Backport OAK-4119, OAK-4101, OAK-4087 and OAK-4344

          • Blocker - Blocks development and/or testing work, production could not run
          • Closed
          is related to

          Bug - A problem which impairs or prevents the functions of the product. OAK-4301 Missing protection for system-maintained rep:externalId

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Improvement - An improvement or enhancement to an existing feature or task. OAK-4218 Base SyncMBeanImpl on Oak API

          • Major - Major loss of function.
          • Closed
          is required by

          Improvement - An improvement or enhancement to an existing feature or task. OAK-4087 Replace Sync of configured AutoMembership by Dynamic Principal Generation

          • Major - Major loss of function.
          • Closed

          Improvement - An improvement or enhancement to an existing feature or task. OAK-4385 Benchmarks: proper init of ExternalPrincipalConfiguration with dynamicMembership

          • Major - Major loss of function.
          • Closed
          relates to

          Epic - Created by Jira Software - do not edit or delete. Issue type for a big user story that needs to be broken down. OAK-3933 potential improvements to membership management

          • Major - Major loss of function.
          • Open

          New Feature - A new feature of the product, which has yet to be developed. OAK-2687 Introduce Dynamic Groups

          • Major - Major loss of function.
          • Resolved

          Test - A new unit, integration or system test. OAK-4382 Test failure in ExternalGroupPrincipalProviderTest.testFindPrincipalsByHintTypeGroup

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Closed

          Test - A new unit, integration or system test. OAK-4386 Verify that external login with dynamic membership populates subject

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Closed

          Task - A task that needs to be done. OAK-4364 Initial Benchmarks for oak-auth-external

          • Major - Major loss of function.
          • Closed
          requires

          Epic - Created by Jira Software - do not edit or delete. Issue type for a big user story that needs to be broken down. OAK-4215 Improve test-coverage for External Authentication

          • Major - Major loss of function.
          • Closed
          supercedes

          Task - A task that needs to be done. OAK-4090 Consider decoupling of group-sync from repository login

          • Major - Major loss of function.
          • Resolved

          Activity

            People

              angela Angela Schreiber
              angela Angela Schreiber
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: