Hi, In our case we need this feature in the code. We have two kinds of provided sites. Some with a regular CM implementation and others that have another approximation. The realms provided by CM would be fine with KNL- 1325 but the others not. Those realms must be never refreshed. People when access to sakai are automatically joined to the realm but if you refresh the realm you empty the list. Is something like the sample provider implementation. Those providers uses our user types and other ldap attributes to determine if they must be in a site or not, but we don't extract the inverse query (who must be in this site). We use them to get big sites like intranet sites, faculty, etc.

So, we really need that refreshAuth don't be automatically launched, just when admin wants.

To the last comment of Juanjo I would add that the property should be in the GroupProvider api also and delegate the quey to the CM also. That way we could maintain those provided realms unchanged returning false each time the hasChanged is called.

I think we could add more efficiency to refreshAuthzGroup if we add a new method in the CM API. Something like "boolean hasChanged(realm)", by default the implementation of this method could always return true (so refresh is always called), but anyone can implement the logic of this method to return false if you know that nothing has changed and refreshAuthzGroup is not needed. This new method could be documented in the CM Integration confluence page, I think is this one: https://confluence.sakaiproject.org/display/SAKDEV/Course+Management+Integration

Make sense file a new jira to add this new method?

I understand your use case, but the original issue is that refreshAuthzGroup was inefficient and can cause users to experience longer than average page loads (performance issue). The issue in resolved these inefficiencies which is the original user story here.

I don't see the harm in allowing the refresh to be disabled. I agree there may be better solutions, but if you know that your CM integration updates only once a day at 6am and you run a quartz job to pull the changes into Sakai at 7am, why would you want any other refreshing no matter how efficient?

There is a more efficient approach to reduce the refreshAuthzGroup load see KNL-1325.