Repository: goauthentik/authentik

Issue:
SCIM provider automatic sync not triggering since 2023.5.0
**Describe the bug**
SCIM provider automatic sync is not triggering (hourly & on user/group change).
Just upgraded to 2023.5.0 yesterday and (I think) that sync is broken since upgrade. I was using 2023.3.1 and 2023.4.1 previously with the SCIM provider to provision AWS SSO (IAM Identity Center) and those triggers worked (but without PATCH added in 2023.5.0 so that was the main reason for this upgrade).

**To Reproduce**
Configure SCIM provider and wait for the full sync hourly, try to add/remove a member in a group or create a new user.

**Expected behavior**
From [documentation](https://goauthentik.io/docs/providers/scim/#syncing):

```
Data is synchronized in multiple ways:

When a user/group is created/modified/deleted, that action is sent to all SCIM providers
Periodically (once an hour), all SCIM providers are fully synchronized
```

**Screenshots**
No screenshots for this case.

**Logs**
There's no sync events events in logs. Logs are configured in trace level.
The only SCIM events I see are:

```
2023-05-17 09:24:58 | {"event": "Task started", "level": "info", "logger": "authentik.root.celery", "pid": 5476, "task_id": "d2f7357b-caf3-40b9-8750-93134c36badf", "task_name": "scim_signal_direct", "timestamp": "2023-05-17T12:24:58.174683"}
2023-05-17 09:24:58 | {"event": "Task finished", "level": "info", "logger": "authentik.root.celery", "pid": 5476, "state": "SUCCESS", "task_id": "d2f7357b-caf3-40b9-8750-93134c36badf", "task_name": "scim_signal_direct", "timestamp": "2023-05-17T12:24:58.210445"}
```

**Version and Deployment (please complete the following information):**

-   authentik version:2023.5.0
-   Deployment: Helm chart

**Additional context**
If I run the sync manually it works, but the full sync adds/replace objects it doesn't remove users from a group since I think it's only incremental and the removal of a member should be done whent the group is modified.


Discussion:
With 2023.5, the SCIM provider is only active when its assigned as a backchannel provider to an application. The docs/release notes might not make this clear

Resolving patch:
diff --git a/authentik/providers/scim/api/providers.py b/authentik/providers/scim/api/providers.py
--- a/authentik/providers/scim/api/providers.py
+++ b/authentik/providers/scim/api/providers.py
@@ -24,8 +24,8 @@ class Meta:
             "property_mappings",
             "property_mappings_group",
             "component",
-            "assigned_application_slug",
-            "assigned_application_name",
+            "assigned_backchannel_application_slug",
+            "assigned_backchannel_application_name",
             "verbose_name",
             "verbose_name_plural",
             "meta_model_name",
diff --git a/authentik/providers/scim/tasks.py b/authentik/providers/scim/tasks.py
--- a/authentik/providers/scim/tasks.py
+++ b/authentik/providers/scim/tasks.py
@@ -42,7 +42,9 @@ def scim_sync_all():
 @CELERY_APP.task(bind=True, base=MonitoredTask)
 def scim_sync(self: MonitoredTask, provider_pk: int) -> None:
     """Run SCIM full sync for provider"""
-    provider: SCIMProvider = SCIMProvider.objects.filter(pk=provider_pk).first()
+    provider: SCIMProvider = SCIMProvider.objects.filter(
+        pk=provider_pk, backchannel_application__isnull=False
+    ).first()
     if not provider:
         return
     self.set_uid(slugify(provider.name))


Test patch:
diff --git a/authentik/providers/scim/tests/test_membership.py b/authentik/providers/scim/tests/test_membership.py
--- a/authentik/providers/scim/tests/test_membership.py
+++ b/authentik/providers/scim/tests/test_membership.py
@@ -36,6 +36,7 @@ def configure(self) -> None:
             slug=generate_id(),
         )
         self.app.backchannel_providers.add(self.provider)
+        self.provider.save()
         self.provider.property_mappings.set(
             [SCIMMapping.objects.get(managed="goauthentik.io/providers/scim/user")]
         )