[pve-devel] [PATCH access-control 1/2] fix #3668: realm sync: add 'remove-vanished' parameter to delete non-existing users

[Thomas Lamprecht]

On 27.10.21 14:57, Dominik Csapak wrote:
> this way, users can use the 'non-full' mode to provide local
> information (like tfa keys), but still remove the users not present in
> the ldap anymore.

ps. missing an patch for pve-docs, in any case...
https://d7.work.tlmp.it:8006/pve-docs/chapter-pveum.html#pveum_ldap_sync

The amount of sync related options is a bit confusing/crowded already now,
so did you thought about just expanding the value set of the `full` property
for that (possibly renaming it to "sync mode" or the like)?

Albeit purge and this new one could be chosen independently, that wouldn't make
the list of choises easier..
> 
> Signed-off-by: Dominik Csapak <d.csapak at proxmox.com>
> ---
>  src/PVE/API2/Domains.pm | 5 +++--
>  src/PVE/Auth/Plugin.pm  | 7 +++++++
>  2 files changed, 10 insertions(+), 2 deletions(-)
> 
> diff --git a/src/PVE/API2/Domains.pm b/src/PVE/API2/Domains.pm
> index 9c2b254..55bb7ae 100644
> --- a/src/PVE/API2/Domains.pm
> +++ b/src/PVE/API2/Domains.pm
> @@ -279,10 +279,11 @@ my $update_users = sub {
>      my $users = $usercfg->{users};
>  
>      my $oldusers = {};
> -    if ($opts->{'full'}) {
> -	print "full sync, deleting outdated existing users first\n";
> +    if ($opts->{'full'} || $opts->{'remove-vanished'}) {
> +	print "deleting outdated existing users first\n";
>  	foreach my $userid (sort keys %$users) {
>  	    next if $userid !~ m/\@$realm$/;
> +	    next if !$opts->{full} && defined($synced_users->{$userid});
>  
>  	    $oldusers->{$userid} = delete $users->{$userid};
>  	    if ($opts->{'purge'} && !$synced_users->{$userid}) {
> diff --git a/src/PVE/Auth/Plugin.pm b/src/PVE/Auth/Plugin.pm
> index 1413053..27d6294 100755
> --- a/src/PVE/Auth/Plugin.pm
> +++ b/src/PVE/Auth/Plugin.pm
> @@ -64,6 +64,13 @@ my $realm_sync_options_desc = {
>  	type => 'boolean',
>  	optional => '1',
>      },
> +    'remove-vanished' => {
> +	description => "Only for non-full mode. If set, removes users that are not"
> +	    ." present in the current synced data.",
> +	type => 'boolean',
> +	optional => '1',
> +	default => '0',
> +    },
>      'enable-new' => {
>  	description => "Enable newly synced users immediately.",
>  	type => 'boolean',
>