grouper-ws delete member should give error when deleting from composite groups

> Thanks for the detailed explanation. That clears up my confusion. Sorry I did not see the doc on delete member. I was searching the wiki
> and the listserv for the resultCode and got no hits. I think it would be very helpful to have a single place that documents all of the
> resultCodes so it is easy to find an explanation by searching for the code in the wiki.

The response code docs are linked from the operation on the wiki under "response codes". I look at the docs and they aren't very good, but it at least gives you the list of possible codes 

https://wiki.internet2.edu/confluence/display/GrouperWG/Delete+Member

> If I query for members of a composite group, I will see the subjects I was trying to delete

You need to limit that query to IMMEDIATE members, and you will not see the subject you want to delete...

> it looks like a composite group can have no members of its own, so an attempt to execute a deleteMember on a composite group should
> just fail.

Yes, that makes sense, I would be ok with that if people don't have objections... to remove the factor group of the composite you would do a groupSave, and not a deleteMember, so it would be fine with me...

Regards,
Chris

Sent: Wednesday, March 18, 2009 4:35 PM
Subject: RE: Meaning of SUCCESS_WASNT_IMMEDIATE resultCode?

Chris,
Thanks for the detailed explanation. That clears up my confusion. Sorry I did not see the doc on delete member. I was searching the wiki and the listserv for the resultCode and got no hits. I think it would be very helpful to have a single place that documents all of the resultCodes so it is easy to find an explanation by searching for the code in the wiki.

I can live with the existing convention now that I understand what to look for and what it means. On a more philosophical level, I would argue that in the case of a composite group, the rationale for a "success" status does indeed break down. If I query for members of a composite group, I will see the subjects I was trying to delete. That is different from the case where the subjects do not exist in the group at all. I think that in the case I described, the delete operation should return a successValue of "F" and a result code that indicates an error because I am attempting an operation that is just not allowed. I think it would also be idempotent because no matter how many times I attempt the same operation, I will get an "F". Based on my experimentation, it looks like a composite group can have no members of its own, so an attempt to execute a deleteMember on a composite group should just fail.

Paul Gazda

________________________________________
Sent: Wednesday, March 18, 2009 12:14 PM
Subject: RE: Meaning of SUCCESS_WASNT_IMMEDIATE resultCode?

Yes, I understand that this is confusing...

All grouper delete member operations (WS, client, GSH, API) only delete immediate (or direct) memberships:

https://wiki.internet2.edu/confluence/display/GrouperWG/Delete+Member

"Delete member will delete or replace the membership of a group. This affects only direct memberships, not indirect memberships. If the user is in an indirect membership, this is still a success"

There are two outcomes from deleting a member from a group and the member is not already a member. And I am talking about immediate members here.

1. There is an error, since the caller was expecting the member to be a member
2. It is ok, the end result is that the member is not a member, so who cares if the operation did anything or not, the end justifies the means

With web services, it is good to have operations be idempotent, so that if the same operation is transmitted twice, the end result (T|F not the result code or warnings or whatever) is the same. If you go with #1, I suggest that the operation is not idempotent, but with #2 it is. Currently grouper WS uses the second option.

In your case, it breaks down, because you think the member is a member of the group, and you think it is something that should be able to be deleted, but in fact, it is not, and you are not notified.

I do have the return code: SUCCESS_WASNT_IMMEDIATE_BUT_HAS_EFFECTIVE, but maybe either that is not working, or it doesn't work for composites... would something like that work?

1. Having the return code be SUCCESS _WASNT_IMMEDIATE_BUT_HAS_EFFECTIVE, and that would include composite memberships (I think of effective as anything but immediate... but do other people need to know if it is because of composite or group as a member)? Also, in the DB, there are other distinctions in the table data
2. or making another set of return codes: SUCCESS _WASNT_IMMEDIATE_BUT_HAS_COMPOSITE
3. or using resultcode2 to put information about this if it is not already used...
4. or leave as it is... 

Thanks,
Chris

Sent: Wednesday, March 18, 2009 2:56 PM
Subject: [grouper-users] Meaning of SUCCESS_WASNT_IMMEDIATE resultCode?

I'm attempting to delete subjects from a composite group. When I do so, I get a successValue of "T", a resultCode of "SUCCESS_WASNT_IMMEDIATE" and the subjects are not deleted. I find this confusing because the operation was not a success. I'm pretty sure it is trying to tell me that I should be deleting the subjects from the composite member groups rather than the parent group, but it doesn't seem like it should be giving me either a successValue of "T" or a resultCode that starts with "SUCCESS". Can someone help me understand what the SUCCESS_WASNT_IMMEDIATE code is supposed to mean in this situation? Thanks.

Paul Gazda