Improve IAMService user to CS conversion

[maxnoe]

• Handle nested groups
• Filter groups by vo name
• Filter groups by having voms.role label
• Add tests

BEGINRELEASENOTES

*Core
FIX: Improve VOMS2CSAgent to handle nested groups and only sync groups that have the voms.role label
ENDRELEASENOTES

Closes #8487

[maxnoe]

@chaen the CI failure here seems unrelated to me

[aldbr]

@maxnoe is that ready to be reviewed now?

[maxnoe]

I would be happy about a review, yes, but I left it on draft as I also wanted to test it in our integration test environment but didn't have a chance yet.

[chaen]

I've just tried it against our prod server, and I see discrepencies, but I did not yet dig down in it

[maxnoe]

I've just tried it against our prod server, and I see discrepencies, but I did not yet dig down in it

There is an additional filter now to only create entries for groups that are actually voms roles. I would expect that you now get less roles attached to users, but the roles that are no longer attached do not correspond to real voms roles in the iam server.

[chaen]

There's definitely something off with the logic as it starts adding people without a single voms role to our default group

[maxnoe]

There's definitely something off with the logic as it starts adding people without a single voms role to our default group

ok, thanks, I will dig into that next week

[maxnoe]

There's definitely something off with the logic as it starts adding people without a single voms role to our default group

Where should this filtering happen?

The IAMService class getUsers() method according to the test correctly returns a list of all users, with most of them having 0 voms roles.

Should getUsers() already filter out users with no roles? Or should that happen later?

[chaen]

oos sorry I pushed by mistake, I'll fix my mess