goauthentik / goauthentik/authentik

Authentik doesn't delete SCIM users/group when uses LDAP source with 'deferred' sync trigger mode

Open
#20,411 0 comments 1 reaction 0 assignees View on GitHub
bug bug/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 2h
Merged PRs (30d)
651

Description

### Describe the bug

We use LDAP (FreeIPA) as a data source for Authentik. When the 'Outgoing Sync Trigger Mode' parameter is set to 'Deferred until end', Authentik does not delete users and groups provisioned through the SCIM provider.

The current cleanup logic is [based on pre_delete hooks](https://github.com/goauthentik/authentik/blob/version/2025.12.3/authentik/lib/sync/outgoing/signals.py#L60-L61), but these hooks [are disabled in deferred mode](https://github.com/goauthentik/authentik/blob/version/2025.12.3/authentik/sources/ldap/tasks.py#L160-L161). The SCIM provider does not implement any alternative cleanup logic for users and groups.

As a workaround, enabling 'Immediate' mode resolves the issue, but in our setup, it triggers thousands of tasks.

Some time ago, I submitted a PR that addresses this behavior: https://github.com/goauthentik/authentik/pull/19697

### How to reproduce

1. Configure an LDAP/FreeIPA source for users and groups.
2. Set the 'Outgoing Sync Trigger Mode' for the LDAP source to 'Deferred until end'.
3. Enable 'Delete Not Found Objects' for the LDAP source.
4. Add a SCIM provider (AWS in our case).
5. Provision a few groups and users with the SCIM provider.
6. Delete some of these groups/users from the LDAP source.
7. The users/groups are deleted from the Authentik database but remain in the SCIM provider. Moreover, the users stay active and can continue using their access if an alternative authentication method is available.

### Expected behavior

Users and groups provisioned with SCIM, have to be eventually deleted when they are deleted from an LDAP source. Regardless of the 'Outgoing sync trigger mode' value.

### Screenshots

_No response_

### Additional context

_No response_

### Deployment Method

Docker

### Version

2025.12.3

### Relevant log output

```shell

```

Contributor guide

Open the contributing guide

Research direction

Start with authentik/lib/sync/outgoing/signals.py and authentik/sources/ldap/tasks.py at the referenced hook logic, then review PR #19697. Trace deferred LDAP deletion through the SCIM provider and verify that users and groups removed from LDAP are eventually removed from SCIM without enabling Immediate mode.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.