goauthentik / goauthentik/authentik
Authentik doesn't delete SCIM users/group when uses LDAP source with 'deferred' sync trigger mode
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 651
Description
### Describe the bug
We use LDAP (FreeIPA) as a data source for Authentik. When the 'Outgoing Sync Trigger Mode' parameter is set to 'Deferred until end', Authentik does not delete users and groups provisioned through the SCIM provider.
The current cleanup logic is [based on pre_delete hooks](https://github.com/goauthentik/authentik/blob/version/2025.12.3/authentik/lib/sync/outgoing/signals.py#L60-L61), but these hooks [are disabled in deferred mode](https://github.com/goauthentik/authentik/blob/version/2025.12.3/authentik/sources/ldap/tasks.py#L160-L161). The SCIM provider does not implement any alternative cleanup logic for users and groups.
As a workaround, enabling 'Immediate' mode resolves the issue, but in our setup, it triggers thousands of tasks.
Some time ago, I submitted a PR that addresses this behavior: https://github.com/goauthentik/authentik/pull/19697
### How to reproduce
1. Configure an LDAP/FreeIPA source for users and groups.
2. Set the 'Outgoing Sync Trigger Mode' for the LDAP source to 'Deferred until end'.
3. Enable 'Delete Not Found Objects' for the LDAP source.
4. Add a SCIM provider (AWS in our case).
5. Provision a few groups and users with the SCIM provider.
6. Delete some of these groups/users from the LDAP source.
7. The users/groups are deleted from the Authentik database but remain in the SCIM provider. Moreover, the users stay active and can continue using their access if an alternative authentication method is available.
### Expected behavior
Users and groups provisioned with SCIM, have to be eventually deleted when they are deleted from an LDAP source. Regardless of the 'Outgoing sync trigger mode' value.
### Screenshots
_No response_
### Additional context
_No response_
### Deployment Method
Docker
### Version
2025.12.3
### Relevant log output
```shell
```
Contributor guide
Research direction
Start with authentik/lib/sync/outgoing/signals.py and authentik/sources/ldap/tasks.py at the referenced hook logic, then review PR #19697. Trace deferred LDAP deletion through the SCIM provider and verify that users and groups removed from LDAP are eventually removed from SCIM without enabling Immediate mode.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100