unsetting ACLs from (new) REST API doesn't work

[baszoetekouw]

I'm trying to remove an ACL by using the REST API. The current connection looks like this:

curl -u user:pass -H "Content-type: application/json" --data-binary '' -v -X GET https://serviceregistry.surfconext.nl/janus/app.php/api/connections/1995.json

gives

{
    "allowAllEntities": false,
    "allowedConnections": [
        {
            "id": 490,
            "name": "https://my-acc.utsp.utwente.nl/shibboleth"
        }
    ],
...

I'm trying to reset this using:

curl -u user:pass -H "Content-type: application/json" --data-binary '{ "allowedConnections": [] }' -v -X PUT https://serviceregistry.surfconext.nl/janus/app.php/api/connections/1995.json

This results in a "201 Created", but the ACLs are unchanged:

{
    "allowAllEntities": false,
    "allowedConnections": [
        {
            "id": 490,
            "name": "https://my-acc.utsp.utwente.nl/shibboleth"
        }
    ],
...

I would expect the allowedConnections list to be empty, instead.

Similarly, when the allowedConnections has multiple entries:

{
    "allowAllEntities": false,
    "allowedConnections": [
        {
            "id": 490,
            "name": "https://my-acc.utsp.utwente.nl/shibboleth"
        },
        {
            "id": 532,
            "name": "https://data.3tu.nl/saml/metadata"
        },
        {
            "id": 1046,
            "name": "https://attribute-viewer.aai.switch.ch/shibboleth"
        },
        {
            "id": 1047,
            "name": "https://attribute-viewer.aai.switch.ch/interfederation-test/shibboleth"
        }
    ],
...

Now, trying to replace this list by a single entry using

curl -u user:pass -H "Content-type: application/json" --data-binary '{ "allowedConnections": [{"id": 1709}] }' -v -X PUT https://serviceregistry.surfconext.nl/janus/app.php/api/connections/1995.json

gives

{
    "allowAllEntities": false,
    "allowedConnections": [
        {
            "id": 532,
            "name": "https://data.3tu.nl/saml/metadata"
        },
        {
            "id": 1046,
            "name": "https://attribute-viewer.aai.switch.ch/shibboleth"
        },
        {
            "id": 1047,
            "name": "https://attribute-viewer.aai.switch.ch/interfederation-test/shibboleth"
        },
        {
            "id": 1709,
            "name": "https://smartsecureyourself.mindgame.eu"
        }
    ],
...

So, randomly one of the entities in the ACL list was replaced by the new one I specified...

I would expect a PUT request with a allowedConnections list would replace the entire list (even if it is empty), regardless of the original list.

[baszoetekouw]

Verified on test2