User Management UI fails to list users when any user as no role-assignement

[rhafer]

When accessing the user management list on a system that has at least one user without an assigned role, the UI fails to list any user.

Howto reproduce

1. start ocis with demo users

   IDM_ADMIN_PASSWORD=admin ocis/bin/ocis init --insecure true
   PROXY_ENABLE_BASIC_AUTH=true IDM_CREATE_DEMO_USERS=true IDM_ADMIN_PASSWORD=admin ocis/bin/ocis server
   

2. FInd user id for einstein

   curl -k -u admin:admin 'https://localhost:9200/graph/v1.0/users/einstein' | jq '.id'
   "4c510ada-c86b-4815-8820-42cdf82c3d51"
   

3. Find assignment ids for the (replace the account_uuid accordingly):

   curl -k -u admin:admin 'https://localhost:9200/api/v0/settings/assignments-list' -X POST -d '{"account_uuid":"4c510ada-c86b-4815-8820-42cdf82c3d51"}' -H "Content-Type: application/json" | jq '.assignments | .[].id'
   "341a1d9e-6845-4f63-ad44-de3fa7d40ef2"
   "7f9d838b-a0de-4be5-9b4a-6706a0471f25"
   "a4a6ca98-bdd5-43e7-a286-d50b63f6b3a0"
   "af6afbd1-989b-4137-b968-07d62a73fc41"
   

4. remove assignment

   curl -k -u admin:admin 'https://localhost:9200/api/v0/settings/assignments-remove' -X POST -d '{"id":"af6afbd1-989b-4137-b968-07d62a73fc41"}' -H "Content-Type: application/json" | jq '.'
   

   repeat for all assignments that were listed
5. login as user "admin" an try to access user management

The list of users is empty now. On the web console you should see a 400 error for one of the assignment-list queries, arguably the settings service should return a 404 there (I'll file an issue in ocis for that), but still the UI should list the user and probably deal with errors returned for some of the users.

Note: It is perfectly ok for a user to have not role assigned before that user logs in for the first time. And this will especially happen when connecting to external authentication systems.

cc @janackermann

[tbsbdr]

@kulmann P2 or p3? I'd rate it as P2 as it would most likely appear with external idp -> enterprise usecases

[kulmann]

@kulmann P2 or p3? I'd rate it as P2 as it would most likely appear with external idp -> enterprise usecases

Agreed, P2