no way to unlink account/domain from ldap

[borisstoyanov]

(localcloud) SBCM5> > link domaintoldap domainid=5a155ee3-70dd-4549-9d29-4c926530a8f0 type=group  ldapdomain=cn=admins,ou=groups,dc=acs,dc=echt,dc=net accounttype=2
🙈 Error: (HTTP 530, error code 9999) Entity already exists:

User is able to link domain/account to LDAP but there's no way to remove this link if not deleting it in DB.

[yadvr]

cc @DaanHoogland any remarks?

[DaanHoogland]

@rhtyd @borisstoyanov I remember working on a similar issue for marcus or ilya. Can you revalidate @borisstoyanov can you check on latest and add some details?

[DaanHoogland]

@borisstoyanov, the idea is that you would delete an account if you no longer want the link. What is the idea of unlinking? what would the value of the account and the users in it if there is no ldap linked?

[nvazquez]

@DaanHoogland @borisstoyanov any update on this?

[DaanHoogland]

no update, what is the use of a unlinked domain or account? it would be filled with autoimported/autosynced users from ldap. Why would you want to keep those?

[nvazquez]

In my opinion unlinking a domain or account should remove access to CloudStack from LDAP accounts, what about removing those accounts' information from DB?

[DaanHoogland]

isn't removing the account/domain good enough? what is the added value of unlink?

[borisstoyanov]

if the account was created before it was linked then it should remain without the possibility to authenticate to LDAP server but native only auth. if any user was created when it was linked it should be disabled the least if not removed