I'm using the REST API Plugin to configure "team-internal" MUCs that are set to members-only. When a new user should be added to the channel, I send an update request to the REST API. The problem is that the Role update is implemented such that all roles are revoked first and requested roles are then re-added afterwards, which makes the server temporarily kick all users. While they're being re-added with the "member" role afterwards, their XMPP clients display a message saying that they have been removed from the channel due to an affiliation change, and they have to manually re-join all members-only channels.
I tracked down the problem to the method org.jivesoftware.openfire.plugin.rest.controller.MUCRoomController#setRoles. This method would have to read the list of current roles and compute a diff that it then needs to apply, instead of wiping and re-applying everything.
I'd be happy to help, provided that a potential PR is welcome and has the chance of being merged in a not-too-distant future (otherwise, I'd have to implement a workaround...)
Using Openfire 4.0.3.
PRs are definitely welcome and if accepted, such a change would get a new REST API plugin release made.