"GroupModifiedEvent" missing when user is automatically removed from group

[jochenehret]

What version of UAA are you running?

Version 76.5.0

How are you deploying the UAA?

We are using the BOSH release: https://github.com/cloudfoundry/uaa-release/releases/tag/v76.5.0

What did you do?

Created a new group with "zoneid: uaa". Added user with "origin: uaa" to the group. This produces a "GroupModifiedEvent" as expected. Manual removal of the user writes a "GroupModifiedEvent", too.

When the user logs in, he is automatically removed from the group (relevant coding for this should be https://github.com/cloudfoundry/uaa/blob/develop/server/src/main/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthAuthenticationManager.java#L247-L259). We have configured an external OAuth provider. @torsten-sap can provide more details on this automatic action.

The problem for us is that the automatic removal from the group does not log a "GroupModifiedEvent". We would like to see this event for debugging and operation purposes.

What did you expect to see? What goal are you trying to achieve with the UAA?

We expected to see a "GroupModifiedEvent" as specified in https://docs.cloudfoundry.org/running/managing-cf/uaa-audit-requirements.html#scim-admin-events.

What did you see instead?

There was no "GroupModifiedEvent" logged.

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/184370647

The labels on this github issue will be updated when the story is started.