[jira] [Created] (OAK-9803) Extend DynamicSyncHandler to allow for dynamic groups

["Angela Schreiber (Jira)" <ji...@apache.org>]

Angela Schreiber created OAK-9803:
-------------------------------------

             Summary: Extend DynamicSyncHandler to allow for dynamic groups
                 Key: OAK-9803
                 URL: https://issues.apache.org/jira/browse/OAK-9803
             Project: Jackrabbit Oak
          Issue Type: Improvement
          Components: auth-external
            Reporter: Angela Schreiber
            Assignee: Angela Schreiber


since OAK-4391 _oak-auth-external_ comes with a dynamic membership option that limits the synchronization of external identities to users and their group membership (see https://jackrabbit.apache.org/oak/docs/security/authentication/external/dynamic.html for documentation).
while the feature meets the need to compute a set of principals for permission evaluation upon repository login, it has proven to cause some confusion when it comes to user management and discovering user-group relationship, which can be obtained from the principal management API (but no longer reflected in the repository's user management. reasoning: external identities are managed elsewhere and the repository is no longer in charge).

with the introduction of the {{DynamicMembershipService}} interface (see OAK-9462), we would be able to improve that by optionally synchronizing external groups as dynamic (similar to the _everyone_ group) if dynamic membership flag is turned on.

cc: [~insuafer]



--
This message was sent by Atlassian Jira
(v8.20.7#820007)