[OAK-9803] Extend DynamicSyncHandler to allow for dynamic groups

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.46.0
• Component/s: auth-external
• Assignee: Angela Schreiber
• Reporter: Angela Schreiber
• Created: 14/Jun/22 12:35
• Updated: 21/Dec/22 03:39
• Resolved: 10/Aug/22 16:18

Description

since OAK-4391 oak-auth-external comes with a dynamic membership option that limits the synchronization of external identities to users and their group membership (see https://jackrabbit.apache.org/oak/docs/security/authentication/external/dynamic.html for documentation).
while the feature meets the need to compute a set of principals for permission evaluation upon repository login, it has proven to cause some confusion when it comes to user management and discovering user-group relationship, which can be obtained from the principal management API (but no longer reflected in the repository's user management. reasoning: external identities are managed elsewhere and the repository is no longer in charge).

with the introduction of the DynamicMembershipService interface (see OAK-9462), we would be able to improve that by optionally synchronizing external groups as dynamic (similar to the everyone group) if dynamic membership flag is turned on.

cc: Jose Antonio Insua

Issue Links

• relates to: OAK-9799 Optional validator to mark external users/groups as protected
• requires: OAK-9865 DefaultSyncContext: extract method to get external group from ExternalIdentityRef
• Testing discovered: OAK-9867 AutoMembershipProvider.isMember must not ignore 'includeInherited' flag
• Testing discovered: OAK-9871 AutoMembershipPrincipals.getAutoMembership must resolved inherited groups
• Testing discovered: OAK-9839 DefaultSyncConfig.enforceDynamicMembership is not reflected in OSGi configuration
• links to: GitHub Pull Request #648