Want user and group list for silo admins

[askfongjojo]

This is related to SCIM but not really tied to SCIM. Currently, the only way a silo or project admin can see the list of existing users and groups is via the picklists on the Add User or Group popup page in Access Control (when they select which entities to be granted access to a silo or project).

With SCIM, there will likely be more utility of such UIs since the use case often involves importing users and groups ahead of time and confirming their existence in the rack to debug IDP-side import issues.

[askfongjojo]

@benjaminleonard: Inclusion of last updated timestamp will be useful. It is not returned by the API currently.

[askfongjojo]

There is currently no admin API to list the members of a group. We'll need oxidecomputer/omicron#2051.

[benjaminleonard]

So this would be a full list of users including those not already assigned to that silo?

In that case it's an interesting UX pattern. My initial thought was that including them within the "Silo Access" page feels strange since they're not part of the Silo but maybe that just requires copy/UX finessing.

[david-crespo]

No, it would be silo-scoped. We would not list users across silos.

[benjaminleonard]

Aren't we giving every user a silo viewer role by default anyway? What's the difference between the silo access list and the full list that the add user listbox. Users that belong to an included group (that aren't enumerated currently) and users that have had that all roles removed?

[askfongjojo]

I just confirmed that users see all the users and groups in their silo whether they have a silo role (viewer or higher permissions) or not. This is not necessarily a bug although it's a bit unexpected to me.

The main use cases for a user/group UI are around debugging access issue when the permissions are granted via group-role associations:

• Silo or project admin checks if certain users are missing from a group on the Oxide side, if those users have been added to the IDP side but still don't have access to the Oxide silo or project. The output helps inform whether it has to do with failed SCIM updates or something else.
• Silo or project admin checks if new groups created in the IDP have already been imported into Oxide so that they can add them to a project or silo. Having group details (e.g. members) besides group name allows the admin to know if they have confidence that the users have been imported and can use the silo/project in question.
• Silo or project admin looks for additional user details to know if the person has been disabled (there is a new "active" flag sync-ed from IDP) or whether they have the right person (scim now captures user display name as well). We can either display these extra details in the "Add user" list box, or have a separate UI for it.

[david-crespo]

Ben and I talked about this yesterday. Ben didn't realize that you don't currently see the list of users in the access page (except in the listbox on the form, as you said) because you only see entities that have roles explicitly assigned to them, and that's almost always groups rather than users. So we will be adding tabs to the access page for users and groups (Ben has designs on the way), and you can click a group to see the users in that group.