[AAD] Decouple PAI internal resource from external user/groups

[mzmssg]

In current AAD, we have a strong requirement that every vc need a dedicated group, which means resource acl depends on external user/groups. This issue is to decouple them.

Design

Current user/group model:

New user/group model:

From implementation, basically, we will move virutal cluster out of user and into group schema: users belong to some groups, and groups define resource.

User schema(generated/updated from aad):

Key	Value	Description
username	String
email	String
group List	String array
password	String
extension	Map	virtualCluster: vc1, vc2

Group schema(maintained by admin):

Key	Value	Description
groupName	String
externalName	String
extension	Map	groupType: vc/admin/stroage acls: { virtualClusters: vc1, vc2, storageConfigs: storageConfig1, storageConfig2, admin: true/false, etc }

Login: only groups with vc access could login.

Items:

• redesign user/group schema
• job submission: submit,delete
• user management: add/delete user, password change
• group management: add/delete group
• vc management: add/delete vc
• new api: update group acls
• migrate existing schema to new schema
• adapt webportal
• fix unit test (doing)
• update storage logic with new schema
• TBD