Allow user group edition from django admin interface

[ietf-svn-bot]

owner:esanchez@yaco.es resolution_fixed type_defect | by esanchez@yaco.es

---

Current authentication middleware takes user groups from different sources and map them to django groups.

The problem is that current groups assigned to a django user are discarded and replaced with the ones coming from the external sources. So you can not assign groups to a user from the django admin interface in the common way.

---

Issue migrated from trac:360 at 2022-03-04 01:00:42 +0000

[ietf-svn-bot]

@esanchez@yaco.es changed component from liaison/ to ietfauth/

[ietf-svn-bot]

@esanchez@yaco.es changed status from new to closed

[ietf-svn-bot]

@esanchez@yaco.es set resolution to fixed

[ietf-svn-bot]

@esanchez@yaco.es commented

---

Fixed in 2cdc041:

Add groups from external sources to the existing ones. Fixes #360

[ietf-svn-bot]

@pe@iki.fi changed status from closed to reopened

[ietf-svn-bot]

@pe@iki.fi changed resolution from fixed to ``

[ietf-svn-bot]

@pe@iki.fi commented

---

BTW, a quick comment on this and changeset:2474: replacing the
group list completely instead of adding to it was a deliberate
choice back when this code was written.

Currently, when e.g. an area director steps down and the
iesg_login.user_level value is changed (which the secretariat
knows how to do), that user gets automatically removed from the
Area_Director group (when logging in next time).

After changeset:2474, this is no longer working, and a second
manual step would be needed...

Perhaps the correct solution would be to keep the existing group
membership only if the group is not one of those that should
be automatically assigned. E.g. something like

AUTOMATIC_GROUPS=['Area_Director','Secretariat',...]
for group in user.groups:
   if group.name in AUTOMATIC_GROUPS and group.name not in group_names:
      user.groups.remove(group)

[ietf-svn-bot]

@esanchez@yaco.es commented

---

You are right, in that case the secretariat needs to enter the django admin interface and remove the group Area_Director from the django user.

After some thought I think your solution is the best choice we have. So, I'm going for it.

[ietf-svn-bot]

@esanchez@yaco.es changed status from reopened to closed

[ietf-svn-bot]

@esanchez@yaco.es changed resolution from `` to fixed

[ietf-svn-bot]

@esanchez@yaco.es commented

---

Fixed in 81bcb71:

Users only belong to automatic groups if the group is retrieved from the correct source. Fixes #360