goauthentik / goauthentik/authentik
AWS SCIM Groups cannot represent or read more than 100 members
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 651
Description
## What
PUT/GET Groups cannot represent >100 members and cannot read current members (cleanup fails). Two symptoms, one AWS compatibility mode.
## Want
- PUT/GET Groups cannot represent >100 members
- Cannot read current members (cleanup fails)
- Two symptoms, one AWS compatibility mode
## Ideas this came from
- [#20410 provider/scim: AWS SCIM integration doesn't work properly with groups that contain 100+ members](https://github.com/goauthentik/authentik/issues/20410) — According to the AWS SCIM documentation, the API allows adding a maximum of 100 members in a single request: - https://docs.aws.amazon.com/singlesignon/latest/d
- [#23005 SCIM provider for AWS doesn't clean-up group members](https://github.com/goauthentik/authentik/issues/23005) — Authentik uses GET /Groups/ API call for reading current group members. According to AWS documentation, this method always returns an empty list. Thus, Authenti
Contributor guide
Research direction
Start with the SCIM Groups PUT/GET handlers and the AWS compatibility behavior described in issues #20410 and #23005. Verify the AWS limit of 100 members per request and the empty member list returned by GET /Groups/. Done means AWS Groups can represent more than 100 members and cleanup can determine current members reliably.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python
- Domain
- authentication, authorization
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 50/100