Tokens are revoked when assigning a role to a group

[Dolph Mathews]

Bug 1170186 changed user role assignments such that they do not revoke the user's tokens. After that patch merged, it was caught in code review that group role assignments result in the same behavior (mass token revocation). This behavior is unnecessary and should be removed for the same reasons as cited in the above bug.

[Lin Hua Cheng (lin-hua-cheng)]

Dolph: I think the first description was correct. Assigning user to a group, also revokes the user's token.

For the case of assigning a role to a group, I haven't test this case yet if it will revokes the group member's token.

[Dolph Mathews (dolph)]

Hmm, both scenarios are worth testing!

[Lin Hua Cheng (lin-hua-cheng)]

Validated that assigning role to a Group does not revoke the token of the members.

However, revoking roles from a User or Group revokes the tokens. Is that the expected behavior?

[Dolph Mathews (dolph)]

Yes, as a consequence of changing the user's source of authorization, existing tokens are revoked.

[Lin Hua Cheng (lin-hua-cheng)]

I think you can just close this bug.

Assigning role to User/Group does not revoke the token.

Revoking role fromUser/Group revoke the token.

The behavior seems right from security perspective. If you're revoking access, you want that to be effective immediately. And adding grants does not need to be effective immediately, so revoking token is not necessary.

[Dolph Mathews (dolph)]

Thanks for looking into it! If you have any new tests to assert the above, they'd be appreciated.