goauthentik / goauthentik/authentik

AWS SCIM Groups cannot represent or read more than 100 members

Open
#25,330 0 comments 0 reactions 0 assignees View on GitHub
bug bug/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 2h
Merged PRs (30d)
651

Description

## What

PUT/GET Groups cannot represent >100 members and cannot read current members (cleanup fails). Two symptoms, one AWS compatibility mode.

## Want

- PUT/GET Groups cannot represent >100 members
- Cannot read current members (cleanup fails)
- Two symptoms, one AWS compatibility mode

## Ideas this came from

- [#20410 provider/scim: AWS SCIM integration doesn't work properly with groups that contain 100+ members](https://github.com/goauthentik/authentik/issues/20410) — According to the AWS SCIM documentation, the API allows adding a maximum of 100 members in a single request: - https://docs.aws.amazon.com/singlesignon/latest/d
- [#23005 SCIM provider for AWS doesn't clean-up group members](https://github.com/goauthentik/authentik/issues/23005) — Authentik uses GET /Groups/ API call for reading current group members. According to AWS documentation, this method always returns an empty list. Thus, Authenti

Contributor guide

Open the contributing guide

Research direction

Start with the SCIM Groups PUT/GET handlers and the AWS compatibility behavior described in issues #20410 and #23005. Verify the AWS limit of 100 members per request and the empty member list returned by GET /Groups/. Done means AWS Groups can represent more than 100 members and cleanup can determine current members reliably.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python
Domain
authentication, authorization
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
50/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.