"GroupModifiedEvent" missing when user is automatically removed from group

What version of UAA are you running?

Version 76.5.0

How are you deploying the UAA?

We are using the BOSH release: https://github.com/cloudfoundry/uaa-release/releases/tag/v76.5.0

What did you do?

Created a new group with "zoneid: uaa". Added user with "origin: uaa" to the group. This produces a "GroupModifiedEvent" as expected. Manual removal of the user writes a "GroupModifiedEvent", too.

When the user logs in, he is automatically removed from the group (relevant coding for this should be https://github.com/cloudfoundry/uaa/blob/develop/server/src/main/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthAuthenticationManager.java#L247-L259). We have configured an external OAuth provider. @torsten-sap can provide more details on this automatic action.

The problem for us is that the automatic removal from the group does not log a "GroupModifiedEvent". We would like to see this event for debugging and operation purposes.

What did you expect to see? What goal are you trying to achieve with the UAA?

We expected to see a "GroupModifiedEvent" as specified in https://docs.cloudfoundry.org/running/managing-cf/uaa-audit-requirements.html#scim-admin-events.

What did you see instead?

There was no "GroupModifiedEvent" logged.

Start in server/src/main/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthAuthenticationManager.java around lines 247-259, where the automatic group removal is described. Compare that path with manual removal and the SCIM admin-event requirement, then verify that automatic removal produces a GroupModifiedEvent in the audit output.