Grouper Developers Forum

[Tom Zeller <>]

> Maybe I'm wrong about all this but I feel like replace should be the default

Oh, another reason I defaulted to add-then-delete rather than replace
is because, in my opinion, it makes auditing easier.

For example, for an ldap server with an audit log which produces ldif,
it is easier to see what was changed via add-then-delete than replace,
since replace "hides" the previous value in the audit log. You know,
if someone calls and says "hey I can no longer access X" and
authorization is based on an attribute value, it should be
straightforward to grep a log file for when the appropriate
authorization attribute value was deleted. This is obviously quite
subjective.