@IvanVan Where you able to run gdeploy identity sync successfully after this update ? I'm seeing this error: "listing okta users from okta API: the API returned an error: Not found: Resource not found: 00g* (UserGroup): withStack
null" in the APIIdpSyncHandlerFunction

I tested using this format: groups: 00g*

@shwethaumashanker actually the only valid options are static values or just *, 00g* is not valid

the idea is that by having groups: * we are inversing the logic of the membership api queries, where the service will list all the groups accessible by the sync cluster, and check members for each.

This is great for our use case, because then we leverage the concept of ResourceSet in okta https://help.okta.com/en-us/content/topics/security/custom-admin-role/create-resource-set.htm to restrict which groups commonfate can see, and this way control a lot the API calls.

But yes, groups: * might be a bit confusing/misleading UX:

• groups refers to "groups to get user membership from". IMO a better name could be user_groups
• groups:* t effectivelly says "Sync membership from all accessible groups"
• groups: qwertyuio234,qwertyuio235,qwertyuio236 it effectivelly says "Sync membership from all accessible groups"

We are open to alternatives. Some options:

• Option 1: groups: * groups: qwertyuio234,qwertyuio235,qwertyuio236
• Option 2: groups: any groups: qwertyuio234,qwertyuio235,qwertyuio236
• Option 3: membership_from_groups: true + groups: qwertyuio234,qwertyuio235,qwertyuio236
  • if users_from_groups: true then pull members from groups
  • if groups: qwertyuio234,qwertyuio235,qwertyuio236 set, only sync/query those groups

@IvanVan Where you able to run gdeploy identity sync successfully after this update ? I'm seeing this error: "listing okta users from okta API: the API returned an error: Not found: Resource not found: 00g* (UserGroup): withStack
null" in the APIIdpSyncHandlerFunction

I tested using this format: groups: 00g*

Thank you @shwethaumashanker for reviewing!
As @keymon said there are only two available options in the current implementation: ""(all the groups) and "groupId1,groupId2"(group ids separated by comma). We tested it in our environment with "" option.

Hi @IvanVan and @keymon,

Thanks for the clarification – my bad for misunderstanding the options earlier. I tested groups: "*" and it seems to be working well. As long as we keep things well-documented, I think this implementation should do the trick.

I'll released v0.15.9 with the PR, and for future PRs, we're sticking with the release/v0.15 branch for OSS releases.

Appreciate your contributions – thank you both! 🙌