Problem Definition

When using the delegated directory (internal directory with LDAP authentication) with Synchronise Group Memberships flag enabled, groups are created, if they do not exist, within the application when the user authenticates. On each authentication, their group memberships are synchronized.

However, if the group that was created in the application is deleted from the LDAP or all the users are removed, the group remains within the application when using embedded Crowd..

For enterprise customers, this can have adverse performance affects as the groups continue to grow but are never cleaned.

Suggested Solution

Embedded Crowd should detect if an LDAP group is deleted on syncs with directory membership and remove the group. Further, if embedded Crowd detects that all memberships of a group have been zeroed out, the group should be removed.

The end goal is to clean deleted and disregarded groups so that they do not collect and cause performance issues in the application.

Workaround

Identify the groups that have been deleted or zeroed out and manually remove the group in the application.