Just-in-time provisioning of directory users (ported from exio's
External.resolve/2): a directory user signing in for the first time
gets a macaw_auth_users row, with source the directory's name and no
password, and at every later sign-in the directory's word replaces the
row's roles and display name. The directory is the authority on who is
in which group, so a user removed from an admin group loses the role at
their next sign-in, not whenever someone remembers to edit the row.
Two refusals keep identities apart:
- a row with the username that another source owns (a local user, or
another directory's) is never taken over (
:username_taken): a directory that happens to have anownerentry doesn't become the localowner; - a disabled row stays refused (
:disabled), whatever the directory says, and is left as it is.
Summary
Functions
The row for a directory user the source name accepted, made or
refreshed: {:ok, record} or {:error, :username_taken | :disabled | :invalid_username}.
Functions
@spec directory_user(module(), String.t(), map()) :: {:ok, Macaw.Auth.Native.UserRecord.t()} | {:error, :username_taken | :disabled | :invalid_username}
The row for a directory user the source name accepted, made or
refreshed: {:ok, record} or {:error, :username_taken | :disabled | :invalid_username}.