user config - ignore invalid group member 'user@domain.tld' (bug?)

[rdfeij]

Within our proxmox cluster we have an Active directory sync only used for login of our users (no OU assignments to automate grouprights).
One of our users has been remove from the OU allowing him to login to Proxmox so the sync removed his username.
However the user is still in the usergroup he was before and syslogging starts reporting: user config - ignore invalid group member 'user@domain.tld'

Since the user is no user anymore within Proxmox datacenter and i cannot remove users from groups manually this seems to be a bug? Shouldn't the user with removal also be removed from the group(s) he is in?
with LDAP Remove Vanished Options: ACL and Entry are ticked.

currently running at Proxmox 8.1.4

 

[rdfeij]

Anyone?

 

[fabian]

the user should be dropped from the group on the next read-modify-write cycle of the config.. could you file an issue at https://bugzilla.proxmox.com so that the cleanup can happen on sync as well?

 

[rdfeij]

Fixed by enabling 'Remove vanished properties from synced users'. It was disabled. I expected that Entry: Remove vanished users and group entries would be enough. Is this stil a bug then or did i misinterpret these functions?

 

[fabian]

I think that was just a side-effect of re-syncing (which causes a read-modify-write cycle, thus clearing out the group membership).

 

[rdfeij]

There is a sync job active running every 2 hours, shouldn't that have done the same?

 

[rdfeij]

I'm sorry, dug into the issue deeper since it was some time ago, users are still in the groups but do not exist as user anymore. So problem is still there. I will report a bug

 

[rdfeij]

https://bugzilla.proxmox.com/show_bug.cgi?id=5610