authentication: introduce a group sync flag for plugins.

- we'll skip any syncing on plugins which simply don't get any group information
- we let plugins define if they wish to sync groups
- prevent from odd cases in which someone sets user groups as syncing, and using regular
plugin. In this case memebership of that group would be wiped, and it's generaly bad behaviour.

rhodecode/authentication/base.py

@@ -77,7 +77,6 b' class hybrid_property(object):'
         self.fdel(instance)
 
 
-
 class LazyFormencode(object):
     def __init__(self, formencode_obj, *args, **kwargs):
         self.formencode_obj = formencode_obj
@@ -106,6 +105,8 b' class RhodeCodeAuthPluginBase(object):'
         "lastname": "last name",
         "email": "email address",
         "groups": '["list", "of", "groups"]',
+        "user_group_sync":
+            'True|False defines if returned user groups should be synced',
         "extern_name": "name in external source of record",
         "extern_type": "type of external source of record",
         "admin": 'True|False defines if user should be RhodeCode super admin',
@@ -114,6 +115,7 b' class RhodeCodeAuthPluginBase(object):'
         "active_from_extern":
             "True|False\None, active state from the external auth, "
             "None means use definition from RhodeCode extern_type active value"
+
     }
     # set on authenticate() method and via set_auth_type func.
     auth_type = None
@@ -412,8 +414,9 b' class RhodeCodeAuthPluginBase(object):'
             new_hash = auth.get('_hash_migrate')
             if new_hash:
                 self._migrate_hash_to_bcrypt(username, passwd, new_hash)
+            if 'user_group_sync' not in auth:
+                auth['user_group_sync'] = False
             return self._validate_auth_return(auth)
-
         return auth
 
     def _migrate_hash_to_bcrypt(self, username, password, new_hash):
@@ -538,16 +541,19 b' class RhodeCodeExternalAuthPlugin(RhodeC'
             # enforce user is just in given groups, all of them has to be ones
             # created from plugins. We store this info in _group_data JSON
             # field
+
+            if auth['user_group_sync']:
             try:
                 groups = auth['groups'] or []
                 log.debug(
                     'Performing user_group sync based on set `%s` '
-                    'returned by this plugin', groups)
+                        'returned by `%s` plugin', groups, self.name)
                 UserGroupModel().enforce_groups(user, groups, self.name)
             except Exception:
                 # for any reason group syncing fails, we should
                 # proceed with login
                 log.error(traceback.format_exc())
+
             Session().commit()
         return auth
 
@@ -671,7 +677,7 b' def authenticate(username, password, env'
                 environ=environ or {})
 
         if plugin_cache_active:
-            log.debug('Trying to fetch cached auth by %s', _password_hash[:6])
+            log.debug('Trying to fetch cached auth by `...%s`', _password_hash[:6])
             plugin_user = cache_manager.get(
                 _password_hash, createfunc=auth_func)
         else:

rhodecode/authentication/plugins/auth_crowd.py

@@ -267,6 +267,7 b' class RhodeCodeAuthPlugin(RhodeCodeExter'
             'firstname': crowd_user["first-name"] or firstname,
             'lastname': crowd_user["last-name"] or lastname,
             'groups': crowd_user["groups"],
+            'user_group_sync': True,
             'email': crowd_user["email"] or email,
             'admin': admin,
             'active': active,

rhodecode/authentication/plugins/auth_headers.py

@@ -212,6 +212,7 b' class RhodeCodeAuthPlugin(RhodeCodeExter'
             'firstname': safe_unicode(firstname or username),
             'lastname': safe_unicode(lastname or ''),
             'groups': [],
+            'user_group_sync': False,
             'email': email or '',
             'admin': admin or False,
             'active': active,

rhodecode/authentication/plugins/auth_jasig_cas.py

@@ -154,6 +154,7 b' class RhodeCodeAuthPlugin(RhodeCodeExter'
             'firstname': safe_unicode(firstname or username),
             'lastname': safe_unicode(lastname or ''),
             'groups': [],
+            'user_group_sync': False,
             'email': email or '',
             'admin': admin or False,
             'active': active,

rhodecode/authentication/plugins/auth_ldap.py

@@ -460,6 +460,7 b' class RhodeCodeAuthPlugin(RhodeCodeExter'
                 'lastname': safe_unicode(
                     get_ldap_attr('attr_lastname') or lastname),
                 'groups': groups,
+                'user_group_sync': False,
                 'email': get_ldap_attr('attr_email') or email,
                 'admin': admin,
                 'active': active,

rhodecode/authentication/plugins/auth_pam.py

@@ -136,6 +136,7 b' class RhodeCodeAuthPlugin(RhodeCodeExter'
             'lastname': lastname,
             'groups': [g.gr_name for g in grp.getgrall()
                        if username in g.gr_mem],
+            'user_group_sync': True,
             'email': email,
             'admin': admin,
             'active': active,

rhodecode/authentication/plugins/auth_rhodecode.py

@@ -100,6 +100,7 b' class RhodeCodeAuthPlugin(RhodeCodeAuthP'
             "firstname": userobj.firstname,
             "lastname": userobj.lastname,
             "groups": [],
+            'user_group_sync': False,
             "email": userobj.email,
             "admin": userobj.admin,
             "active": userobj.active,

rhodecode/authentication/plugins/auth_token.py

@@ -111,6 +111,7 b' class RhodeCodeAuthPlugin(RhodeCodeAuthP'
             "firstname": userobj.firstname,
             "lastname": userobj.lastname,
             "groups": [],
+            'user_group_sync': False,
             "email": userobj.email,
             "admin": userobj.admin,
             "active": userobj.active,