norg 3.x Credential Expiry: autoReactivate default & least‑privilege role handling

norg 3.x Credential Expiry

When upgrading from norg 2.x to 3.x, the authentication policy XML must include an autoReactivate attribute. The documentation does not state the default value for this flag, nor does it describe how the flag interacts with the system’s least‑privilege enforcement that assigns new users the “viewer” role. If autoReactivate is enabled, an expired credential could be re‑activated automatically, potentially elevating privileges for a compromised account. Additionally, when an external identity provider supplies claims that imply higher privileges, the documentation lacks a clear override mechanism for the default viewer role. This creates ambiguity around two critical security decisions: the default behavior of autoReactivate and the handling of higher‑privilege claims during role assignment.

What is the intended default value for autoReactivate in norg 3.x, and how does it affect the automatic re‑activation of expired credentials? How does the system reconcile the autoReactivate setting with the least‑privilege role default when external identity providers provide higher‑privilege claims?