[pve-devel] [PATCH access-control/manager v2] fix #3668: improving realm sync

[Thomas Lamprecht]

On 23.03.22 08:33, Thomas Lamprecht wrote:
>>> remove-vanished: [<user>];[<properties>];[acls]
>>>
>>> I.e., those three flags would replace your new mode + purge like:
>>>
>>> +--------+--------+---------------------+
>>> |  Mode  | Purge  | -> removed-vanished |
>>> +--------+--------+---------------------+
>>> | update |      0 | "" (none)           |
>>> | sync   |      0 | user                |
>>> | full   |      0 | user;properties     |
>>> | update |      1 | acl                 |
>>> | sync   |      1 | acl;user            |
>>> | full   |      1 | acl;user;properties |
>>> +--------+--------+---------------------+
>>>
>>> The selector for them could be either three check boxes on one line (similar to the
>>> privilege level radio buttons from CT restore) or even a full blown combobox with all
>>> the options spelled out.
>>>
>>> It's only slightly weird for acl, as there the "remove-vanished" somewhat implies that
>>> we import acl's in the first place, if we really don't want that we could keep
>>> "Purge ACLs" as separate option that is only enabled if "remove-vanished" "user" flag
>>> is set, put IMO not _that_ of a big problem to understand compared to the status quo.
>>>
>>> Does (any of) this make sense to you?
>> yes this sounds sensible, but i agree about the possibly confusing 'remove-vanished'
>> implication for acls. Maybe 'remove-on-vanish' ?
> sounds the same to me semantically, so see no improvement there.
> 
>> this would (semantically) decouple the 'vanished' thing from the 'removed' thing,
>> at least a little bit.
> IMO purely subjective and if a real grammar/semantic connection would be there that
> I just miss (always a possibility) it'd be to subtle.
> 
> I think that the confusion potential overall would get quite a bit reduced that getting
> this slightly confusing one newly is still a net benefit and can be easily defused with
> a short docs note.
> 


FWIW, for a user interface we can also go for a more detailed, telling approach, e.g.,
with both, field and box labels:

Remove Vanished:
Users      [ ] Remove any realm-user not included in the sync response.
ACLs       [ ] Remove the ACLs of any realm-user not included in the sync response.
Properties [ ] Remove properties not included in the sync response.

(more concise sentences welcome ;-))

For properties we could add a " Note: breaks, among other things, TFA." hint as
tooltip or just in the docs.