Allow user group edition from django admin interface

[hassanakbar4]

resolution_fixed type_defect | by esanchez@yaco.es

---

Current authentication middleware takes user groups from different sources and map them to django groups.

The problem is that current groups assigned to a django user are discarded and replaced with the ones coming from the external sources. So you can not assign groups to a user from the django admin interface in the common way.

---

Issue migrated from trac:360 at 2021-12-13 14:49:26 +0500

[hassanakbar4]

@esanchez@yaco.es changed component from liaison/ to ietfauth/

[hassanakbar4]

@esanchez@yaco.es changed status from new to closed

[hassanakbar4]

@esanchez@yaco.es set resolution to fixed

[hassanakbar4]

@esanchez@yaco.es commented

---

Fixed in 3b35d2e1a055eb7a80bea67a78dd1a05513d7441:

Add groups from external sources to the existing ones. Fixes #360

[hassanakbar4]

@pe@iki.fi changed status from closed to reopened

[hassanakbar4]

@pe@iki.fi changed resolution from fixed to ``

[hassanakbar4]

@pe@iki.fi commented

---

BTW, a quick comment on this and changeset:2474: replacing the group list completely instead of adding to it was a deliberate choice back when this code was written.

Currently, when e.g. an area director steps down and the iesg_login.user_level value is changed (which the secretariat knows how to do), that user gets automatically removed from the Area_Director group (when logging in next time).

After changeset:2474, this is no longer working, and a second manual step would be needed...

Perhaps the correct solution would be to keep the existing group membership only if the group is not one of those that should be automatically assigned. E.g. something like

AUTOMATIC_GROUPS=['Area_Director','Secretariat',...]
for group in user.groups:
   if group.name in AUTOMATIC_GROUPS and group.name not in group_names:
      user.groups.remove(group)

[hassanakbar4]

@esanchez@yaco.es commented

---

You are right, in that case the secretariat needs to enter the django admin interface and remove the group Area_Director from the django user.

After some thought I think your solution is the best choice we have. So, I'm going for it.

[hassanakbar4]

@esanchez@yaco.es changed status from reopened to closed

[hassanakbar4]

@esanchez@yaco.es changed resolution from ` tofixed`

[hassanakbar4]

@esanchez@yaco.es commented

---

Fixed in a28e420f33e8e9629061b900c4d02ee8b4861218:

Users only belong to automatic groups if the group is retrieved from the correct source. Fixes #360