Is your feature request related to a problem? Please describe.
Moving a device to another organization can leave configuration templates and provisioned credentials from its previous organization attached to its configuration.
This affects existing VPN client templates and is also relevant to certificate generator templates introduced by the GSoC X.509 work. Stale VpnClient or DeviceCertificate relations can keep previous-organization credentials in the rendered configuration context.
Describe the solution you'd like
Depend on the organization_changed signal introduced in openwisp/openwisp-users#559.
When a Device changes organization, reconcile its Config.templates synchronously in the same transaction:
- Remove templates owned by organizations other than the destination organization.
- Preserve shared generic templates.
- Remove shared VPN-client and certificate-generator templates because their provisioned credentials are bound to the previous organization.
- Ensure removed VPN-client and certificate-generator templates delete their related
VpnClient and DeviceCertificate rows and revoke generated certificates.
- Apply the destination organization required templates using the existing required-template behavior.
- Ensure
Config.get_vpn_context() and Config.get_cert_context() cannot expose credentials whose template is no longer assigned.
- Reuse the existing device organization checksum dependency to mark the configuration modified after the final reconciliation.
Add regressions for model, admin, and REST organization changes. Cover organization-specific, shared generic, shared VPN-client, and shared certificate-generator templates. Cover certificate revocation and absence of stale context after the move.
Describe alternatives you've considered
Rotating credentials for retained shared VPN-client and certificate-generator templates would preserve more assignments, but is substantially more complex and risks tenant-bound credential leakage. Requiring users to explicitly reassign these credential-bearing templates is safer.
A controller-only organization-change hook would duplicate logic needed by other OpenWISP applications. This follow-up should use the generic openwisp-users signal.
Additional context
Depends on openwisp/openwisp-users#559.
Related to #1334, #1050, and #1358.
Follow-up of GSoC X.509 Certificate Generator Templates work in #1378.
Is your feature request related to a problem? Please describe.
Moving a device to another organization can leave configuration templates and provisioned credentials from its previous organization attached to its configuration.
This affects existing VPN client templates and is also relevant to certificate generator templates introduced by the GSoC X.509 work. Stale
VpnClientorDeviceCertificaterelations can keep previous-organization credentials in the rendered configuration context.Describe the solution you'd like
Depend on the
organization_changedsignal introduced in openwisp/openwisp-users#559.When a
Devicechanges organization, reconcile itsConfig.templatessynchronously in the same transaction:VpnClientandDeviceCertificaterows and revoke generated certificates.Config.get_vpn_context()andConfig.get_cert_context()cannot expose credentials whose template is no longer assigned.Add regressions for model, admin, and REST organization changes. Cover organization-specific, shared generic, shared VPN-client, and shared certificate-generator templates. Cover certificate revocation and absence of stale context after the move.
Describe alternatives you've considered
Rotating credentials for retained shared VPN-client and certificate-generator templates would preserve more assignments, but is substantially more complex and risks tenant-bound credential leakage. Requiring users to explicitly reassign these credential-bearing templates is safer.
A controller-only organization-change hook would duplicate logic needed by other OpenWISP applications. This follow-up should use the generic openwisp-users signal.
Additional context
Depends on openwisp/openwisp-users#559.
Related to #1334, #1050, and #1358.
Follow-up of GSoC X.509 Certificate Generator Templates work in #1378.