Eligibility and DB - technical discussion

Thursday 3 Jul 2025, 14:00 → 15:00 Europe/Zurich

31/S-027 (CERN)

1 Eligibility & DB - technical discussion

Speakers: Abel Cabezas Alonso (CERN), Alessandro Di Girolamo (CERN), David Collados Polidura (CERN), Ignacio Coterillo Coz (CERN), Paolo Tedesco (CERN)

Situation as seen from the Service side

• Given the way the current resource portal logic works, all the constraints that are checked and enforced before an account is created (in terms of eligibility and access) are ignored when the account is transferred to a new owner either actively or because of resource inheritance.
• This can result in a non elegible user receiving a resource they shouldn't have access to in the Needs Action state, where said user can assume ownership, archive the result, or trigger a deletion.
  • Detailed Resource States
  • https://gitlab.cern.ch/authzsvc/libraries/dotnet/Cern.AuthorizationService.Model/-/blob/master/Cern.AuthorizationService.Model/ResourceStates/ActionRequiredStateManager.cs#L13-15
• In the case of the Oracle service, these kind of ownership transfer will be blocked on the service side returning an error. This error is ignored by the. Resource Portal, which keeps re-trying the owner change effectively blocking subsequent actions as the execution attempts are linear.