OpenConext / OpenConext-Invite

Apache License 2.0
3 stars 3 forks source link

Add ability to give inviter authority to change role expiration date and invite detail when creating role. #236

Open phavekes opened 2 months ago

phavekes commented 2 months ago

This issue is imported from pivotal

See images
oharsta commented 1 month ago

@MarliesRikken Question about the screenshot (copied from Pivotal).

Image

If the "Allowed changing of details" is checked, is the Inviter also allowed the change the expiration date of the role in the invitation? And the rationale behind this story is to differentiate between only changing the expiration date versus changing all the details for invitations send by inviters? Note that inviters can change the expiration date of a Guest Role (once an invitation is accepted) regardless of the details of the role. Does the last privilege also depends on the selected options when the role was created? I would recommended agains that, as it would make things overly complex.

MarliesRikken commented 1 month ago

Since the expiration dates of a role for a single user can always be changed, including 'allow override of expiration date' does not make sense in the current situation.

Feedback from the institution is that they want to prevent inviters from changing an end-date to 'very far into the future' or 'indefinite'.

I would suggest we discuss this scenario again in the next Invite session: How can we best give tools to prevent inviter misuse in the form of overextending the expiry dates?

phavekes commented 1 month ago

Let's test the current usage, and change this later