goauthentik / goauthentik/authentik

SCIM should sync on bind, unbind, and group-membership change

Open
#25,291 0 comments 0 reactions 0 assignees View on GitHub
area:backend bug bug/confirmed enhancement/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 1h
Merged PRs (30d)
644

Description

## What

SCIM should automatically sync when a user is bound/unbound or group membership changes, not wait for the next full/manual sync.

## Want

- SCIM should automatically sync when a user is bound/unbound or group membership changes, not wait for the next full/manual sync

## Ideas this came from

- [#21754 SCIM: Group membership changes do not trigger automatic sync in 2026.2](https://github.com/goauthentik/authentik/issues/21754) — When users are removed from a group that controls SCIM sync scope (via application policy bindings), a sync is not automatically triggered. This means deprovisi
- [#23645 Trigger sync of SCIM user when it's bound to SCIM application](https://github.com/goauthentik/authentik/issues/23645) — Automatically sync a user as soon as it's bound to a SCIM application. Rather than having to wait for a full sync or having to trigger a manual sync

Contributor guide

Open the contributing guide

Research direction

Start by tracing the existing SCIM synchronization flow and the code paths for user binding, unbinding, and group-membership changes. Confirm how issues #21754 and #23645 describe the missing triggers; done means each of these changes initiates the appropriate SCIM sync without waiting for a full or manual sync.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authentication, authorization, backend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
50/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.