Split from #499. That report bundled two asks; the registration/login half (an OIDC sign-in provisioning a user who already exists in LDAP, even when the provider's registration is disabled) is fixed. This issue tracks the remaining half. Requested there by @balintbarna. Related: #114.
Problem
Tuwunel lazily creates a local account the first time an LDAP user logs in, but it never removes or deactivates that account when the user is later removed from the LDAP directory. Where LDAP is the source of truth for accounts, a deleted directory entry leaves a stale, still-usable local account behind.
Desired behavior
When a user no longer exists in the LDAP directory, their local Tuwunel account should be deactivated (or deleted) automatically, so the directory governs the whole lifecycle: created on first login, removed once the directory entry is gone.
Design questions:
- Trigger: a periodic reconciliation sweep, a check at login or token-refresh time, or both.
- Deactivate vs delete: deactivation is reversible and preserves room history and ownership; hard deletion matches "the account is gone" but is destructive. Configurable?
- Scope: likely only accounts with
origin = "ldap", to avoid touching password or SSO-native users.
Split from #499. That report bundled two asks; the registration/login half (an OIDC sign-in provisioning a user who already exists in LDAP, even when the provider's registration is disabled) is fixed. This issue tracks the remaining half. Requested there by @balintbarna. Related: #114.
Problem
Tuwunel lazily creates a local account the first time an LDAP user logs in, but it never removes or deactivates that account when the user is later removed from the LDAP directory. Where LDAP is the source of truth for accounts, a deleted directory entry leaves a stale, still-usable local account behind.
Desired behavior
When a user no longer exists in the LDAP directory, their local Tuwunel account should be deactivated (or deleted) automatically, so the directory governs the whole lifecycle: created on first login, removed once the directory entry is gone.
Design questions:
origin = "ldap", to avoid touching password or SSO-native users.