providers/scim: fix error when user-group m2m is updated forward (#5082)

* providers/scim: fix error when user-group m2m is updated forward

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* fix

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

---------

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

authentik/providers/scim/signals.py

@@ -34,8 +34,16 @@ def pre_delete_scim(sender: type[Model], instance: User | Group, **_):
 
 
 @receiver(m2m_changed, sender=User.ak_groups.through)
-def m2m_changed_scim(sender: type[Model], instance, action: str, pk_set: set, **kwargs):
+def m2m_changed_scim(
+    sender: type[Model], instance, action: str, pk_set: set, reverse: bool, **kwargs
+):
     """Sync group membership"""
     if action not in ["post_add", "post_remove"]:
         return
+    # reverse: instance is a Group, pk_set is a list of user pks
+    # non-reverse: instance is a User, pk_set is a list of groups
+    if reverse:
         scim_signal_m2m.delay(str(instance.pk), action, list(pk_set))
+    else:
+        for group_pk in pk_set:
+            scim_signal_m2m.delay(group_pk, action, [instance.pk])

authentik/providers/scim/tasks.py

@@ -151,7 +151,7 @@ def scim_signal_direct(model: str, pk: Any, raw_op: str):
 
 
 @CELERY_APP.task()
-def scim_signal_m2m(group_pk: str, action: str, pk_set: set[int]):
+def scim_signal_m2m(group_pk: str, action: str, pk_set: list[int]):
     """Update m2m (group membership)"""
     group = Group.objects.filter(pk=group_pk).first()
     if not group: