I think you misinterpreted me, The old User Federation SPI forces the developer to write all the import code themselves. The old User Federation SPI does not have any synchronization callbacks, methods or interfaces other than validateAndProxy(), the logic of which the user has to write themselves too.
On 18 August 2016 at 20:30, Bill Burke <bburke@redhat.com> wrote:
On 8/18/16 4:59 AM, Stian Thorgersen wrote:
> Bill,
>
> Are you planing to have an option to allow import of users with the
> new user federation SPI? I'm not convinced we should completely remove
> this option.
>
The only callback that does not exist in the new SPI is
validateAndProxy(). With the current federation SPI, the developer
implements everything themselves for import. There are no
synchronization APIs/SPIs either.
Sounds like we're removing built-in features around synchronization just to make the user have to do everything themselves.
If the user can only be authenticated via LDAP, an offline mode is not possible. In other words, if LDAP does not expose the password of a user (so it can be imported), then offline mode is not possible. It would only be possible if the user has logged in at least once, then the validated password could be imported.> Some use-cases I could imagine:
>
> * Allow users to authenticate even if LDAP server is down
Our current LDAP provider will not work if LDAP is down, even with the
import :)
Yes, I know. However, the fact that we don't currently support it doesn't mean we shouldn't in the future.