{"action":"created","issue":{"url":"https://api.github.com/repos/coreos/etcd/issues/3709","repository_url":"https://api.github.com/repos/coreos/etcd","labels_url":"https://api.github.com/repos/coreos/etcd/issues/3709/labels{/name}","comments_url":"https://api.github.com/repos/coreos/etcd/issues/3709/comments","events_url":"https://api.github.com/repos/coreos/etcd/issues/3709/events","html_url":"https://github.com/coreos/etcd/issues/3709","id":112054443,"number":3709,"title":"we should return role details when revoke and grant users","user":{"login":"yichengq","id":2976232,"avatar_url":"https://avatars.githubusercontent.com/u/2976232?v=3","gravatar_id":"","url":"https://api.github.com/users/yichengq","html_url":"https://github.com/yichengq","followers_url":"https://api.github.com/users/yichengq/followers","following_url":"https://api.github.com/users/yichengq/following{/other_user}","gists_url":"https://api.github.com/users/yichengq/gists{/gist_id}","starred_url":"https://api.github.com/users/yichengq/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yichengq/subscriptions","organizations_url":"https://api.github.com/users/yichengq/orgs","repos_url":"https://api.github.com/users/yichengq/repos","events_url":"https://api.github.com/users/yichengq/events{/privacy}","received_events_url":"https://api.github.com/users/yichengq/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/coreos/etcd/labels/area/usability","name":"area/usability","color":"bfe5bf"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2015-10-19T00:56:55Z","updated_at":"2016-03-17T15:47:04Z","closed_at":"2016-03-06T03:07:09Z","body":"It is not consistent with what we do when we get one user or list all users:\r\n\r\n```\r\ngithub.com/coreos/etcd/client.(*httpAuthUserAPI).GetUser\r\n>>> {\"user\":\"userA\"}\r\n\r\ngithub.com/coreos/etcd/client.(*httpAuthUserAPI).GrantUser\r\n>>> {\"user\":\"userA\",\"roles\":[\"roleA\",\"roleB\"]}\r\n\r\ngithub.com/coreos/etcd/client.(*httpAuthUserAPI).GetUser\r\n>>> {\"user\":\"userA\",\"roles\":[{\"role\":\"roleA\",\"permissions\":{\"kv\":{\"read\":[\"/roleA/path1/*\",\"/roleA/path2/*\"],\"write\":[]}}},{\"role\":\"roleB\",\"permissions\":{\"kv\":{\"read\":null,\"write\":null}}}]}\r\n\r\ngithub.com/coreos/etcd/client.(*httpAuthUserAPI).RevokeUser\r\n>>> {\"user\":\"userA\",\"roles\":[\"roleA\"]}\r\n```\r\n\r\nfound from #3702 \r\nfollow #3278 \r\n\r\n@raoofm @MSamman @ark76r"},"comment":{"url":"https://api.github.com/repos/coreos/etcd/issues/comments/197941222","html_url":"https://github.com/coreos/etcd/issues/3709#issuecomment-197941222","issue_url":"https://api.github.com/repos/coreos/etcd/issues/3709","id":197941222,"user":{"login":"mitake","id":1173955,"avatar_url":"https://avatars.githubusercontent.com/u/1173955?v=3","gravatar_id":"","url":"https://api.github.com/users/mitake","html_url":"https://github.com/mitake","followers_url":"https://api.github.com/users/mitake/followers","following_url":"https://api.github.com/users/mitake/following{/other_user}","gists_url":"https://api.github.com/users/mitake/gists{/gist_id}","starred_url":"https://api.github.com/users/mitake/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mitake/subscriptions","organizations_url":"https://api.github.com/users/mitake/orgs","repos_url":"https://api.github.com/users/mitake/repos","events_url":"https://api.github.com/users/mitake/events{/privacy}","received_events_url":"https://api.github.com/users/mitake/received_events","type":"User","site_admin":false},"created_at":"2016-03-17T15:47:04Z","updated_at":"2016-03-17T15:47:04Z","body":"@ark76r sorry for my late reply. I need to comment on many opinions and questions from you :) So I'd like to comment on the locking overhead you concern at first.\r\n\r\nOverhead of locking auth metadata isn't required. Because every follower can do auth based on its replica of the metadata. Of course it would introduce inconsistent state of the auth. However, actual checking of each request is done by a leader node (based on a token attached to the requests), it must always have the latest auth metadata.\r\n\r\nTherefore, auth info update and checking is processed during ordinal raft request sequence. So we don't need locking mechanisms and its overhead."}}