Groups are created, but not Users

[tmylonidis]

Hi,

I've recently created two new groups in Google Workspace. The name of the groups is prefixed with what is configured idp-scim-sync filter and they are created successfully in AWS SSO. However, the users I have configured in these groups are not included in the SSO Group. In other words the groups are created, but they are empty.

What could I be missing here?

Thanks,

Theo

[mihallcloud]

I have a similar issue. The group had been created in Google Workspace empty, the lambda function and SSO had been set up . The user was created later and then the user has been added to the group. The lambda function has this code and is triggered once every 15 minutes.
But only the group and the user were synced to AWS. The user was not added to the group. I think it tries to create it instead of update it, which leads to a deny against duplicated users.
Even after deleting both the user and the group from AWS, and triggering the function once more, the user and the group get created separately, but the user is not added within the group.
Error message

Error: cannot sync groups and their members: error syncing state: error reconciling users: error creating users from SCIM provider: scim: error creating user: aws CreateOrGetUser: error updating user: statusCode: 409,  errCode: 409 Conflict, errMsg: 
{
    "schema": [
        "urn:ietf:params:scim:api:messages:2.0:Error"
    ],
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:Error"
    ],
    "detail": "Refused to create a new, duplicate resource.",
    "status": "409",
    "exceptionRequestId": "[removed]",
    "timeStamp": "[removed]"
}

[christiangda]

Hi, Thank you very much for detailed explanation and for reporting it.

I will try to simulate this in my personal account ASAP to see if I find the issue and the fix

[mihallcloud]

Hi! I've got a hint there might be a different issue that leads to this situation. Currently there are a bit over 100 users in total and a few less then 50 groups. Do you think it plays a role in triggering this issue? I add this as the error code is 409 and there was a situation similar in the past, that happened with the former project SSOSync.
issue