<div dir="ltr">Why would the permission-mapping resource need to be modified by tooling? <div><br></div><div>The purpose of the named permission-set is that that becomes the resource automatically manipulated, the permission mappings should not need to be manipulated as they either will or will not already reference the permission-set and that should be automatically changed.</div><div><br></div><div>Regards,</div><div>Darran Lofthouse.</div><div><br><br><div class="gmail_quote"><div dir="ltr">On Fri, 23 Mar 2018 at 17:21 Farah Juma <<a href="mailto:fjuma@redhat.com">fjuma@redhat.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">A solution to part of the problem mentioned in WFCORE-3596 that was discussed is to introduce the concept of named permission sets. In particular, instead of having a permission-mapping reference permissions, it would instead reference named permission-sets. This would allow the provisioning tool to be able to add/remove permissions to/from a default permission-set based on the presence/absence of a specific subsystem when generating the default configuration. However, as Alexey pointed out, this doesn't solve the problem of knowing which permission-mapping a permission-set should be added to when attempting to preserve user configuration changes for patching, version updates, etc. <br><div><br></div><div>Thanks,</div><div>Farah</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Mar 23, 2018 at 11:55 AM, Alexey Loubyansky <span dir="ltr"><<a href="mailto:alexey.loubyansky@redhat.com" target="_blank">alexey.loubyansky@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>While this is addressed mainly to the Elytron team, it seems like we would appreciate opinions from other colleagues since we are basically stuck discussing possible ways to resolve <a href="https://issues.jboss.org/browse/WFCORE-3596" target="_blank">https://issues.jboss.org/browse/WFCORE-3596</a></div><div><br></div><div>The description in the jira is pretty brief assuming people know what that is about, since it's been raised before multiple times. Here is what it is about <span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">fundamentally</span>.</div><div><br></div><div>If a configuration model (of a subsystem or any other component) includes a list of configurable units (let's assume XML elements for simplicity) that don't have any identity (unique id/name/path/etc) this is a big problem for supporting patching and version updates preserving user configuration changes. Or simply customizing the default config model using a tool. By a big problem I mean it's simply not going to work reliably.</div><div><br></div><div>As a simple exercise that demonstrates the issue, imagine you have two configs each of which includes a list of these configurable units that have no identity. Now try to identify the difference between the two lists. Or merge them with one overwriting the other. Basically components w/o an identity can not be manipulated. You can only add them but not modify or even remove (unless their index in the list is a constant value of course).</div><div><br></div><div>I don't think I've seen any issue of this kind in our (WF/EAP) configs except for the Elytron's permission-mapping's. (If somebody knows such components please let me know).<br></div><div>If I misunderstand the Elytron config model or approaching this from a wrong angle, please let me know.</div><div><br></div><div>Question for the Elytron team: is the problem I am describing clear? Do you admit it as a problem?</div><div><br></div><div>Thanks,</div><div>Alexey</div></div>
</blockquote></div><br></div>
</blockquote></div></div></div>