Uploaded image for project: 'Jackrabbit Oak'
  1. Jackrabbit Oak
  2. OAK-4845

Regression: DefaultSyncContext does not sync membership to a local group



    • Type: Bug
    • Status: Resolved
    • Priority: Critical
    • Resolution: Won't Fix
    • Affects Version/s: 1.4.7, 1.5.3
    • Fix Version/s: 1.6.0
    • Component/s: auth-external
    • Labels:


      OAK-4397 introduced a regression: it does not allow syncing to a locally existing group anymore (that does not belong to another IDP).

      Updating to 1.4.7 now gives "Existing authorizable 'X' is not a group from this IDP 'foo'.", and the group is not synced and most importantly, memberships for external users are not updated anymore. Looking at the group in JCR, it does not have a rep:externalId at all, only a rep:lastSynced.

      Code wise, this is because the rep:externalId is only ever set in createGroup(), i.e. when the external sync creates that group initially. If the group is already present locally (but not owned by another IDP!), then it won't use it due to the new isSameIDP() check, which will also fail if there is no rep:externalId property set.

      The use case is that we are defining the group locally as part of our application already (including ACs etc.) and we want certain external users be added to it, based on some some of their settings on the external IDP side. FWIW, we don't care for the syncing of properties for the group itself, just for the memberships.


        1. OAK-4845-test-lostmembership.patch
          2 kB
          Alexander Klimetschek
        2. OAK-4845.patch
          4 kB
          Alexander Klimetschek
        3. missing-commits-in-tests.patch
          2 kB
          Alexander Klimetschek

          Issue Links



              • Assignee:
                dominique.jaeggi Dominique Jäggi
                alexander.klimetschek Alexander Klimetschek
              • Votes:
                0 Vote for this issue
                2 Start watching this issue


                • Created: