One thing that might be helpful here is to add Display Name and/or Description to groups in Coder. The automatic group sync might want some sort of Coder specific annotations to help the admins in Coder know what the group is.

The group naming scheme from this particular customer is sometimes a bit cryptic as they are auto generated.

I would like to have a discussion on how to achieve this.

My concerns:

• Should we delete groups that are no longer in the IDP? How would we know that?
• A customer has 200 groups, and accidentally syncs them all to coder. We do not have a quick way to batch delete, so this could be frustrating.
• Should this be in the product, or some kind of external script to sync this information? We do have an api and cli that can achieve this.

One thing we should do is a "Identifier Name" vs "Display/Friendly Name".

The ID name must accept more characters and probably needs to be url escaped.

Should we delete groups that are no longer in the IDP? How would we know that?

No, I don't think this is necessary.

A customer has 200 groups, and accidentally syncs them all to coder. We do not have a quick way to batch delete, so this could be frustrating.

We could provide a basic bash script in the docs to do this with curl + jq. Query all group IDs that were created after a certain time and a second script to delete.

Should this be in the product, or some kind of external script to sync this information? We do have an api and cli that can achieve this.

On our call, we discussed doing it in the product. Since some customers may have less control over their OIDC claims. What are your thoughts on making this opt-in via a flag @Emyrk? It would suck if a bunch of groups to appear in a Coder deployment as a breaking change.

Deleting groups

One thing we discussed was that once imported, a group cannot be deleted from Coder. I think we should actually support this. When a user logs in again, the group can be re-created if the claim sent it. However, editing assignments should be disabled #6549

@bpmct Opt in flag to turn on auto-group creation from group sync seems like the way to go.

@coadler mentioned doing this would not prevent a SCIM solution later, and both could operate in parallel since their source of truth would be shared.