Group sync support

[adorton-adobe]

Add the ability for the sync tool to dynamically create new user groups in the Admin Console that reflect additional groups of interest (such as ACL groups) that the user belongs to in the LDAP directory.

This feature primarily exists to facilitate AEM instances that use Adobe's identity management system to manage AEM identities, but can potentially be used outside of that domain.

This update introduces a new optional configuration option in connector-ldap.yml that specifies a query to get a list of groups of which an individual user is a direct member.

member_group_filter_format: "(member={member_dn})"

A list of naming rules, specified in a new optional configuration option in user-sync-config.yml, governs how these additional groups are identified, and how their names should be translated for targeting on the Adobe side:

additional_groups:
  - source: "ACL-(.+)"
    target: "ACL-Grp-(\1)"
  - source: "(.+)-ACL"
    target: "ACL-Grp-(\1)"

Also introduced is the ability to automatically create user groups that do not already exist. This applies to any Adobe group targeted in the overall sync workflow - including the group mapping rules, extension hook, as well as the aforementioned "additional group" functionality.

The option to auto-create user groups is also specified in user-sync-config.yml:

group_sync_options:
  auto_create: True

NOTE: Auto-deletion is not planned at this time.

[phil-levy]

Does auto creation preemptively create the group, or only create it when someone is to be added to it? It could be problematic to create administrative groups when no one is to be added to it as that will burn considerable resources on the Adobe side.

[adorton-adobe]

It shouldn't ever create groups with no users.

If auto-create is enabled, Adobe groups that are targeted or introduced using any of the following mechanisms will be created.

1. Group mapping in user-sync-config.yml
2. The "additional groups" mechanism - groups identified by the member_group_filter_format and filtered/renamed by the additional_groups rules
3. Groups in the "extended groups" list in extension-config.yml that are targeted in the extension hook code

The way we designed the additional group feature makes it impossible to create groups that don't have any users (since it queries groups that each user directly belongs to).

I'm fairly certain that groups targeted from mapping and extension config should also only be auto-created if they are targeted by at least one user during sync. I will confirm that.