[OAK-4101] Consider separate external (group) principal management

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.2.19, 1.4.7, 1.5.3, 1.6.0
• Component/s: auth-external
• Epic Link: Dynamic Membership for External Authentication
• Assignee: Angela Schreiber
• Reporter: Angela Schreiber
• Created: 08/Mar/16 18:04
• Updated: 10/Nov/16 09:45
• Resolved: 17/May/16 16:25

Description

Given the fact that user management is delegated to an external IDP provider, we might reconsider the current approach that attempts to synchronize user and particularly group and their membership into the repository.

What would left with the repository is a dedicated PrincipalProvider for external groups (and maybe even users at a later stage), making sure that

• the Subject is properly populated with Principal s upon login
• access control can still be properly setup and managed in the repository for the principals defined in the external IDP.

the consequences would be:

• external groups (and potentially) users would no longer made available to the default user management implementation. alternatively: make them available as read-only stub i.e. group-membership as defined by the IDP could no longer be changed/manipulated in the reposiotry.
• they are however exposed as principals to assert proper authentication + authorization. Note: any UI that properly reflects the fact that access control is being edited for principals (and not for users/groups) would not be affected at all; others might need to be adjusted to additionally support ac management based on the PrincipalManager

will try to come up with a POC as soon as I find some time.

Issue Links

• blocks: OAK-4679 Backport OAK-4119, OAK-4101, OAK-4087 and OAK-4344
• is related to: OAK-4301 Missing protection for system-maintained rep:externalId
• is related to: OAK-4218 Base SyncMBeanImpl on Oak API
• is required by: OAK-4087 Replace Sync of configured AutoMembership by Dynamic Principal Generation
• is required by: OAK-4385 Benchmarks: proper init of ExternalPrincipalConfiguration with dynamicMembership
• relates to: OAK-3933 potential improvements to membership management
• relates to: OAK-2687 Introduce Dynamic Groups
• relates to: OAK-4382 Test failure in ExternalGroupPrincipalProviderTest.testFindPrincipalsByHintTypeGroup
• relates to: OAK-4386 Verify that external login with dynamic membership populates subject
• relates to: OAK-4364 Initial Benchmarks for oak-auth-external
• requires: OAK-4215 Improve test-coverage for External Authentication
• supercedes: OAK-4090 Consider decoupling of group-sync from repository login