goauthentik / goauthentik/authentik
SCIM should sync on bind, unbind, and group-membership change
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 644
Description
## What
SCIM should automatically sync when a user is bound/unbound or group membership changes, not wait for the next full/manual sync.
## Want
- SCIM should automatically sync when a user is bound/unbound or group membership changes, not wait for the next full/manual sync
## Ideas this came from
- [#21754 SCIM: Group membership changes do not trigger automatic sync in 2026.2](https://github.com/goauthentik/authentik/issues/21754) — When users are removed from a group that controls SCIM sync scope (via application policy bindings), a sync is not automatically triggered. This means deprovisi
- [#23645 Trigger sync of SCIM user when it's bound to SCIM application](https://github.com/goauthentik/authentik/issues/23645) — Automatically sync a user as soon as it's bound to a SCIM application. Rather than having to wait for a full sync or having to trigger a manual sync
Contributor guide
Research direction
Start by tracing the existing SCIM synchronization flow and the code paths for user binding, unbinding, and group-membership changes. Confirm how issues #21754 and #23645 describe the missing triggers; done means each of these changes initiates the appropriate SCIM sync without waiting for a full or manual sync.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication, authorization, backend
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 50/100