Issue: authd sometimes adds user to group which they are already part of

[adombeck]

In my test VM I see the test users added many times to the cdrom group in /etc/group. The user should be added to that group once, because it's part of the Entra group linux-cdrom, but not more than once.

[3v1n0]

Related to this, as we discussed recently, we should likely always check that the user groups are always in sync with what the database contains, as at the moment, we are not checking if a group has been removed from /etc/group from the user, adding it back.

[adombeck]

No, if an admin removed the user from a group, I don't think we should add it back

[3v1n0]

But isn't this something we want control it from the broker completely (given we'll have an option for it too)?

I would try to keep always this in sync with the database, given that when we'll use the merge strategy in nsswitch, there won't be a way to hack the group file anyways, so I'd start early to ensure that things are always in sync

[adombeck]

We had the behavior before that authd automatically synced the local groups of the user in /etc/group with the local groups it got from the broker. That was reported as a problem by multiple users on #644, because it meant that users were automatically removed from the groups which an admin added them to, so we changed that behavior.

IMO admins should have a way to add/remove users from local groups on the system itself, without changing groups in Entra.

Once we expose local groups via NSS and use the merge strategy, we should also support to remove users from those groups via authctl.