Arvados

16387-batch-update-deactivated-user @ 95e9d44b567a92664939f0f89bd45eedd6db67ab -- developer-run-tests: #1833

Tom Clegg wrote:

16387-batch-update-deactivated-user @ 95e9d44b567a92664939f0f89bd45eedd6db67ab -- developer-run-tests: #1833

Ok, so the logic is, remote users are not subject to the check "must unsetup to deactivate", but remote users are not allowed to call "activate" to reactivate themselves.

The one case this breaks is the case where you are using your remote identity to log into a federated cluster, and that federated cluster has a clickthrough agreement. In that case, you have to "sign" the agreement and then you can self-activate.

However most (all?) federations are in a trusted configuration (either using LoginCluster, or NewUsersAreActive is true, or ActivateUsers is true for that cluster) they go directly to 'active' which skips signing the clickthrough agreement.

Workbench2 also currently doesn't support displaying clickthrough agreements.

It's worth noting that ApiClientAuthorization#validate does this:

        if user.is_active && !remote_user['is_active']
          user.unsetup
        end

So I think it would be less disruptive for batch_update simply turn is_active=false into "unsetup" eg

      if u.is_active && !attrs['is_active']
        u.unsetup
      end
      u.update_attributes!(nullify_attrs(attrs))
      @objects << u

It might make sense to disallow self activate when LoginCluster is set (and ClusterID != LoginCluster).

How about just changing the new rule from "if uuid belongs to remote" to "if uuid belongs to remote LoginCluster"? (...then can't self-activate, and can change to is_active=false in a batch update)

I'm wary of changing more than we need to in a bugfix slated for a patchlevel release.

Tom Clegg wrote:

How about just changing the new rule from "if uuid belongs to remote" to "if uuid belongs to remote LoginCluster"? (...then can't self-activate, and can change to is_active=false in a batch update)

I'm wary of changing more than we need to in a bugfix slated for a patchlevel release.

Ok, that works.

16387-batch-update-deactivated-user @ eddba1916c4667a3de89f632b2b840dbc1d281fc -- developer-run-tests: #1834

Tom Clegg wrote:

16387-batch-update-deactivated-user @ eddba1916c4667a3de89f632b2b840dbc1d281fc -- developer-run-tests: #1834

This LGTM