Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bugfix: Do not stop syncing if user was deleted and therefore no longer member of the group #219

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

jjheinon
Copy link

Bugfix: Do not stop syncing if user was deleted and therefore no longer member of the group

Issue #, if available:

Description of changes:

If user is deleted on Google Workspace UI, the default sync method will first delete the AWS user and then try to remove the AWS role memberships for the user.
As the user no longer exists, the user is also no longer member of any groups, so the RemoveUserFromGroup fails with the following:

WARN[0013] deleting user                                 [email protected]
DEBU[0014] updating aws users updated in google         
DEBU[0014] creating aws users added in google           
DEBU[0014] creating aws groups added in google          
DEBU[0014] getGroupUsersOperations()                    
DEBU[0014] validating groups members, equals in aws and google 
..
DEBU[0033] checking user is in group already             group="TestGroup" [email protected]
WARN[0033] removing user from group                      group="TestGroup" [email protected]
FATA[0034] ResourceNotFoundException: Group membership not found for given Pool/Group/Member.
{
  RespMetadata: {
    StatusCode: 400,
    RequestID: "d9a3e0b4-0d01-45e9-a7e7-d872a23cdb53"
  },
  Message_: "Group membership not found for given Pool/Group/Member.",
  RequestId: "d9a3e0b4-0d01-45e9-a7e7-d872a23cdb53",
  ResourceType: "GROUP_MEMBERSHIP"
} 

After getting this error, the sync fails and the rest of the users in the loop are not processed.
Fixed the issue by checking the status code of AWS error message and if the error type is ResourceNotFoundException, we will log the warning but not exit from the loop.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

@jjheinon
Copy link
Author

Additional comment about this: Not only user deletion on Google, but also administrator removing user from the group on AWS UI while ssosync is in progress could trigger this issue.
So the sync should never be stopped for ResourceNotFoundException when removing group memberships.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant