search

tractoai / ytsaurus-identity-sync

Application for synchronisation YTsaurus users and groups with Microsoft Entra ID (previously Azure Active Directory) and LDAP identity sources
Other
3 stars 3 forks source link

Enable possibility to ban synced users #43

Open l0kix2 opened 2 months ago

l0kix2 commented 2 months ago

Currently if you ban managed user, identity-sync will unban it on next iteration. This must be fixed with some extra parameter in adsync user state so it could distinguish extranlly banned users from users banned by its own code.

zlobober commented 2 months ago

Maybe we can simply say that the automation never unbans any user? What are the normal scenarios when it is useful to automatically unban somebody?

l0kix2 commented 2 months ago

We ban them for week for example before deleting, so if user is back again (was deleted by accident or some other unexpected error) we unban him. But of course we can only ban and never unban and if such accidental removal happens we will have to unban manually

zlobober commented 2 months ago

I think it is just fine to always unban manually, as the expected rate of erroneously banned users is low. This would be much simpler than introducing various kinds of bans.

l0kix2 commented 2 months ago

Yes, ok, makes sense