v1.0.0-rc9: Initial Import Of Users And Group Fails With 404 about ssosync HOT 6 CLOSED

Since we currently happen to have a scratch AWS organisation for testing, I have been able to poke around here.

With an empty SSO and 11 selected groups in Google (max of 22 users per filtered group) using the default --sync-method groups running from master we consistently encounter this 404 error when it tries to add a user to a newly created group so it feels like a consistency/timing issue in SSO:

2021-11-24T03:15:26.439Z {"level":"debug","msg":"creating aws groups added in google","time":"2021-11-24T03:15:26Z"}
2021-11-24T03:15:26.439Z {"group":"AWS Foo Group","level":"info","msg":"creating group","time":"2021-11-24T03:15:26Z"}
2021-11-24T03:15:26.513Z {"group":"AWS Foo Group","level":"debug","msg":"finding user","time":"2021-11-24T03:15:26Z"}
2021-11-24T03:15:26.557Z {"group":"AWS Foo Group","level":"info","msg":"adding user to group","time":"2021-11-24T03:15:26Z","user":"[email protected]"}
2021-11-24T03:15:26.557Z {"group":"AWS Foo Group","level":"debug","msg":"Group Change","operations":"add","time":"2021-11-24T03:15:26Z","user":"[email protected]"}
2021-11-24T03:15:26.582Z status of http response was 404: errorString
null

I can also confirm that with #45 we still encounter it (in case anyone is wondering if that PR helps - we need that fix too for other reasons).

However having applied #47 on top of that and having removed the groups and users from SSO to start clean, I am not seeing this 404 at all.

from ssosync.

@mam8cc

This could be a nice improvement just to work as atomic operations in case the function reaches the AWS SSO-SCIM API limits before creating the groups or assigning users to their respective groups

I'll see how to implement this, but is a big refactor of the way the function SyncGroupsUsers works when --sync-method is groups

from ssosync.

This does not happen consistently with all groups. I am able to sync another group without issues without problems.

@mam8cc are the membership size for these groups different?

from ssosync.

Hey @joshuachong, thanks for getting back so quickly. Yes the AWS Admin group is 8 members, and AWS Power Users has around 60. It is worth noting that the 8 users in AWS Admin are also in AWS Power Users, but that wouldn't impact a clean run, I'd think.

from ssosync.

Just FYI: 404 is always spitted when adding a first user to a group that did not exist prior to ssosync run.
It's probably not waiting for the group to properly start "existing" as a second ssosync run passes that point.
I.e. if you have 5 new groups you need to run ssosync 6 times and only the last one will succeed.

from ssosync.

I believe this issue has been resolved. by release v2.0.0. Please let me know if you are still seeing this.

from ssosync.