{"action":"created","issue":{"url":"https://api.github.com/repos/GENI-NSF/geni-ch/issues/215","labels_url":"https://api.github.com/repos/GENI-NSF/geni-ch/issues/215/labels{/name}","comments_url":"https://api.github.com/repos/GENI-NSF/geni-ch/issues/215/comments","events_url":"https://api.github.com/repos/GENI-NSF/geni-ch/issues/215/events","html_url":"https://github.com/GENI-NSF/geni-ch/issues/215","id":78377682,"number":215,"title":"disabled users can still be added/removed from projects/slices, and their SSH keys listed","user":{"login":"ahelsing","id":12136824,"avatar_url":"https://avatars.githubusercontent.com/u/12136824?v=3","gravatar_id":"","url":"https://api.github.com/users/ahelsing","html_url":"https://github.com/ahelsing","followers_url":"https://api.github.com/users/ahelsing/followers","following_url":"https://api.github.com/users/ahelsing/following{/other_user}","gists_url":"https://api.github.com/users/ahelsing/gists{/gist_id}","starred_url":"https://api.github.com/users/ahelsing/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ahelsing/subscriptions","organizations_url":"https://api.github.com/users/ahelsing/orgs","repos_url":"https://api.github.com/users/ahelsing/repos","events_url":"https://api.github.com/users/ahelsing/events{/privacy}","received_events_url":"https://api.github.com/users/ahelsing/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"MarshallBrinn","id":3009742,"avatar_url":"https://avatars.githubusercontent.com/u/3009742?v=3","gravatar_id":"","url":"https://api.github.com/users/MarshallBrinn","html_url":"https://github.com/MarshallBrinn","followers_url":"https://api.github.com/users/MarshallBrinn/followers","following_url":"https://api.github.com/users/MarshallBrinn/following{/other_user}","gists_url":"https://api.github.com/users/MarshallBrinn/gists{/gist_id}","starred_url":"https://api.github.com/users/MarshallBrinn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MarshallBrinn/subscriptions","organizations_url":"https://api.github.com/users/MarshallBrinn/orgs","repos_url":"https://api.github.com/users/MarshallBrinn/repos","events_url":"https://api.github.com/users/MarshallBrinn/events{/privacy}","received_events_url":"https://api.github.com/users/MarshallBrinn/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/GENI-NSF/geni-ch/milestones/19","html_url":"https://github.com/GENI-NSF/geni-ch/milestones/1.12","labels_url":"https://api.github.com/repos/GENI-NSF/geni-ch/milestones/19/labels","id":1119948,"number":19,"title":"1.12","description":null,"creator":{"login":"ahelsing","id":12136824,"avatar_url":"https://avatars.githubusercontent.com/u/12136824?v=3","gravatar_id":"","url":"https://api.github.com/users/ahelsing","html_url":"https://github.com/ahelsing","followers_url":"https://api.github.com/users/ahelsing/followers","following_url":"https://api.github.com/users/ahelsing/following{/other_user}","gists_url":"https://api.github.com/users/ahelsing/gists{/gist_id}","starred_url":"https://api.github.com/users/ahelsing/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ahelsing/subscriptions","organizations_url":"https://api.github.com/users/ahelsing/orgs","repos_url":"https://api.github.com/users/ahelsing/repos","events_url":"https://api.github.com/users/ahelsing/events{/privacy}","received_events_url":"https://api.github.com/users/ahelsing/received_events","type":"User","site_admin":false},"open_issues":1,"closed_issues":0,"state":"open","created_at":"2015-05-20T05:19:16Z","updated_at":"2015-05-20T05:19:21Z","due_on":null,"closed_at":null},"comments":3,"created_at":"2015-05-20T05:19:21Z","updated_at":"2015-05-20T05:19:51Z","closed_at":null,"body":"You can still add/remove a disabled user from a project/slice. And you can still list their public SSH keys.\r\n\r\nThis means that the public SSH keys for a disabled user can be added to resources, and they can access those resources.\r\n\r\nAt a very minimum, we should forbid listing the keys for a disabled user. I'd also like to forbid adding them to a project or slice.\n\n _Imported from trac ticket [#215](http://trac.gpolab.bbn.com/chapi/ticket/215),  created by ahelsing on 01-22-2014 at 15:45, last modified: 05-23-2014 at 12:27_\n"},"comment":{"url":"https://api.github.com/repos/GENI-NSF/geni-ch/issues/comments/103763581","html_url":"https://github.com/GENI-NSF/geni-ch/issues/215#issuecomment-103763581","issue_url":"https://api.github.com/repos/GENI-NSF/geni-ch/issues/215","id":103763581,"user":{"login":"MarshallBrinn","id":3009742,"avatar_url":"https://avatars.githubusercontent.com/u/3009742?v=3","gravatar_id":"","url":"https://api.github.com/users/MarshallBrinn","html_url":"https://github.com/MarshallBrinn","followers_url":"https://api.github.com/users/MarshallBrinn/followers","following_url":"https://api.github.com/users/MarshallBrinn/following{/other_user}","gists_url":"https://api.github.com/users/MarshallBrinn/gists{/gist_id}","starred_url":"https://api.github.com/users/MarshallBrinn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MarshallBrinn/subscriptions","organizations_url":"https://api.github.com/users/MarshallBrinn/orgs","repos_url":"https://api.github.com/users/MarshallBrinn/repos","events_url":"https://api.github.com/users/MarshallBrinn/events{/privacy}","received_events_url":"https://api.github.com/users/MarshallBrinn/received_events","type":"User","site_admin":false},"created_at":"2015-05-20T05:19:51Z","updated_at":"2015-05-20T05:19:51Z","body":"I'll grab this. As Aaron points out, this can't really be done in the guards or MethodContext which only deal with the caller. \r\n\r\nHere's what I plan to do:\r\n\r\nIf you ask for any method to modify a disabled user or any list CONTAINING a disabled user (per Aaron's list below), it should fail.\r\n\r\nIf you ask for a list of members of slices or projects, disabled users should not appear AT ALL in the response (even for operators),\r\n\r\nShould still be able to call get_public_member_info and get_identifying_member_info on disabled users (so that you can print log messages they wrote, e.g.)\r\n\r\nThe call to get SSH keys should exclude any disabled user from its response.\r\n\r\nNeed to make sure that enable users still works with any changes we make here.\r\n\r\n\n\n_Trac comment by mbrinn (github user: MarshallBrinn) on 01-23-2014 at 09:57_\n"}}