After deleting an account from a group in the OIDC provider, he is not deleted from this group in Stalwart
Expected Behavior
An account should be automatically removed from the group in Stalwart if they were removed from it in the OIDC provider.
Actual Behavior
The account remains in the group in Stalwart even though he was removed from it in the OIDC provider.
Reproduction Steps
Configure Stalvart to import groups from an external OIDC provider
Include the account in the OIDC provider group and make sure that it is in the same group in Salwart
Logout from Stalwart
Remove the account from a group in the OIDC provider
Log in to Stalwart and make sure the user is still in the group
Stalwart Version
v0.16.x
Installation Method
Docker
Database Backend
PostgreSQL
Blob Storage
Filesystem
Search Engine
Elasticsearch
Directory Backend
OIDC
Additional Context
Traefik, Roundcube
I have reviewed the documentation and FAQ and confirm that my issue is NOT addressed there.
on
I have searched this support forum (open and closed topics) and confirm this is not a duplicate.
on
I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.
Let me research how Stalwart handles OIDC group synchronization.
Based on both the documentation and the described behavior, this is a known architectural constraint of how Stalwart handles OIDC group membership. Here is what is happening:
Stalwart reads group memberships from the OIDC provider’s claims only at authentication time – when a user logs in and presents an access token, Stalwart resolves the claimGroups claim and updates group membership. However, the documentation’s Limitations section describes a fundamental constraint: Stalwart does not have an offline directory connection to the OIDC provider. It only learns about (and can update) account state when that account actively authenticates.
This means:
Group additions are picked up on the next login, because the new groups claim is present in the token.
Group removals may not be reliably reflected if Stalwart’s internal account cache/store retains the previously-synced membership and does not actively purge groups that are absent from the new token.
There is no background synchronization mechanism documented – Stalwart does not poll the OIDC provider for changes. The group state in Stalwart is a snapshot from the last successful authentication, not a live mirror of the provider.
What you can try in the meantime:
Manually remove the user from the group in Stalwart’s WebUI (Settings > Authentication > Principals) to immediately reflect the change.
Ensure the user’s cached token is fully expired before their next login, so a fresh token with updated claims is used.
Whether group removals are correctly reconciled on re-login (i.e., if Stalwart diffs the new groups claim against the stored membership and removes stale entries) is a behavior question that is not explicitly described in the current documentation. A human maintainer should confirm whether this is a known limitation or a bug.