Commit d631cc5f authored by Brian Long's avatar Brian Long
Browse files

externalize only groups that the user should belong to

parent 0a10b06c

pom.xml

+0 −1
Original line number Diff line number Diff line
@@ -47,7 +47,6 @@ 
		<tomcat-rad.version>10-2.2</tomcat-rad.version>

		<aps.tomcat.opts.base>-Dspring.main.allow-circular-references=true \

			-Dhibernate.dialect=org.hibernate.dialect.PostgreSQLDialect \

			-Dauth-ext.oauth.enabled=true \

			-Dauth-ext.external.id=keycloak \

			-Dauth-ext.sync.group.translate.patterns=aps-admin \

			-Dauth-ext.sync.group.translate.replacements=Superusers \

src/main/java/com/inteligr8/activiti/auth/service/GroupSyncService.java

+10 −9
Original line number Diff line number Diff line
@@ -182,6 +182,9 @@ public class GroupSyncService { 
            } else {

                String oidcGroup = this.apsGroupNameToOidcGroup(group.getName());



                if (oidcGroups.remove(oidcGroup)) {

                    this.logger.trace("User already belongs to APS group mapped to by OIDC group: {}: {} => {}", user.getExternalId(), oidcGroup, group.getName());

                    

                    if (this.externalizeMatchingInternalGroups) {

                        this.logger.warn("Classifying internal APS group as external: {} => {}", group.getName(), this.externalIdmSource);

                        // register the group as external
@@ -191,8 +194,6 @@ public class GroupSyncService { 
                        // internal role already existed and the user is already a member

                    }

                    

                if (oidcGroups.remove(oidcGroup)) {

                    this.logger.trace("User already belongs to APS group mapped to by OIDC group: {}: {} => {}", user.getExternalId(), oidcGroup, group.getName());

                    continue;

                } else if (!this.syncInternalGroups) {

                    this.logger.trace("Internal APS group membership sync disabled; not considering removal of user from APS group: {} => {}", user.getExternalId(), group.getName());