This is for a site with external provided participants:
RealmService cachs provided user information. Unless an attempt is made to edit the realm, the cached image won't be refreshed. It will then become out-dated when the provided realm info changes.
Worksite setup generates the participant list following two steps: First, it gets all participant info (list A) from CourseMangementService (which is the most up-to-date info from provider) and marks those participants "unremoveable". Secondly, it gets other users (list B) from RealmService and by removing those provided users, the remaining users are marked as not provided.
If a user just got dropped from the external provider, this user is not in list A but because of caching, he is still in list B. Hence this mysterious user will be marked as removeable.
So we got two problem here:
1) our realm information is a little old;
2) worksite setup uses newer information and trusts is over our internally held older information, then does the wrong thing when showing it.
First trial is to make WS use the internal information, augmented as to fields, not users, with CM info from provider.
Then we work on getting the realm grants list refreshed.