Spaces admin claims "Managed by the identity provider" for any unclaimed /spaces directory — without asking the IdP #715

New issue

Closed

opened 2026-09-24 03:49:48 +00:00 by Cordy · 0 comments

Cordy commented

2026-09-24 03:49:48 +00:00

Owner

Found by Nikola during the #690 cleanup (v0.6.263, files-bao). The old synthesized dirs (test5, qa656, Fall 1-3, ...) still read "Managed by the identity provider", but id.c0rdyceps.ch has no groups with those names — verified in Keycloak.

Root cause: mergeSpaceDirs (spaces_union.go) marks every backend /spaces directory that no app-owned record claims as Managed: true, and the UI renders managed as "Managed by the identity provider" (spcManaged). The label is an assumption, never a lookup: orphaned folders (pre-#690 synthesized dirs, groups since deleted in the IdP, hand-created dirs) get attributed to the IdP that never heard of them.

Why this matters beyond the dogfood: at a customer, an orphaned folder would carry a false compliance-relevant attribution ("the IdP manages this") when in fact nobody manages it — the exact edge case an auditor or admin needs surfaced, not papered over.

Expected: three honest states in the inventory:

App-owned record → Owned by X · group Y · app-managed (shipped in #690).
Directory whose name matches a directory group Cairn can actually see (live IdP admin client listing, or the known-names fallback) → "Managed by the identity provider".
Directory matching nothing → an honest orphan label, e.g. "Folder in storage — no managing group found", so admins know it is claimable/cleanable rather than IdP-owned.

When the live IdP listing errors (outage), fail toward the old attribution rather than mass-flagging orphans.

Found by Nikola during the #690 cleanup (v0.6.263, files-bao). The old synthesized dirs (`test5`, `qa656`, `Fall 1-3`, ...) still read "Managed by the identity provider", but id.c0rdyceps.ch has **no groups with those names** — verified in Keycloak. **Root cause:** `mergeSpaceDirs` (spaces_union.go) marks every backend `/spaces` directory that no app-owned record claims as `Managed: true`, and the UI renders `managed` as "Managed by the identity provider" (`spcManaged`). The label is an assumption, never a lookup: orphaned folders (pre-#690 synthesized dirs, groups since deleted in the IdP, hand-created dirs) get attributed to the IdP that never heard of them. **Why this matters beyond the dogfood:** at a customer, an orphaned folder would carry a false compliance-relevant attribution ("the IdP manages this") when in fact *nobody* manages it — the exact edge case an auditor or admin needs surfaced, not papered over. **Expected:** three honest states in the inventory: 1. App-owned record → `Owned by X · group Y · app-managed` (shipped in #690). 2. Directory whose name matches a directory group Cairn can actually see (live IdP admin client listing, or the known-names fallback) → "Managed by the identity provider". 3. Directory matching nothing → an honest orphan label, e.g. "Folder in storage — no managing group found", so admins know it is claimable/cleanable rather than IdP-owned. When the live IdP listing errors (outage), fail toward the old attribution rather than mass-flagging orphans.