Removing user from auto-provisioned Service Group is not persisted after Service Group change

[baszoetekouw]

After the implementation of #1384, CO admins can remove the "auto-provision" checkbox from a Service Group, in order to remove users from the group.

However, if that happens, and after that the Service group is edited, the group in the CO is returned to auto-provision state and all member are back.
This is probably unexpected for the CO admin.

To reproduce:

• create auto-provisionign service group
• connect Service to CO
• in CO, edit group, remove auto-provision
• in CO, remove user from group
• in Service, edit description of the Service Group
  result: in the CO all CO ,member will be member of the group again.

[oharsta]

Confirmed and agree that is somewhat strange behaviour. What would the desired behaviour be? Without making it too complex preferably.

[logan-life]

Confirmed, reproduced with one caveat:

If you edit the Application Description and uncheck auto-provision then the members are not re-added to the application group. This is checked by default, so editing the application description isn't really the thing that is causing the behavior. It's editing the application description and leaving the checkbox ticked that causes the behavior.

So it seems that what is happening here is that the auto-provision checkbox from the application side has more "priority" than the auto-provision checkbox from the collaboration side.

---

Auto-provision checkbox is available in two places:

1. Home > Application > Application Group - Auto Provisioning yes/no
2. Home > Organization > Collaboration > Group - Auto Provisioning yes/no

---

My feeling is that the CO should have priority here. That is, a decision made by the CO admin to not auto-provision members to an application group should override the desire of the application group to auto-provision members.

In this scenario, the expected behavior would be:

In application, create auto-provisioning application group
Connect Application to CO
in CO, edit group, remove auto-provision
in CO, remove user from group
in Application, edit description of the Service Group and leave the auto-provision checked
result: in the CO all CO member will not be a member of the application group, and neither will future members.

In essence, unchecking the auto-provision box on the CO side should override whatever setting is present on the application side.

Thoughts welcome!