Repository: goauthentik/authentik
File: authentik/providers/scim/models.py (Python)

Code before:
            # Get queryset of all users with consistent ordering
            # according to the provider's settings
            base = User.objects.all().exclude_anonymous()
            if self.exclude_users_service_account:
                base = base.exclude(type=UserTypes.SERVICE_ACCOUNT).exclude(
                    type=UserTypes.INTERNAL_SERVICE_ACCOUNT
                )

            # Filter users by their access to the backchannel application if an application is set
            # This handles both policy bindings and group_filters
            if self.backchannel_application:
                base = base.filter(
                    pk__in=[
                        user.pk
                        for user in base
                        if PolicyEngine(self.backchannel_application, user, None).build().passing
                    ]
                )
            return base.order_by("pk")

        if type == Group:
            # Get a queryset of all groups with consistent ordering
            # according to the provider's settings
            base = Group.objects.all()
            if self.group_filters.exists():
                base = base.filter(pk__in=self.group_filters.all())
            return base.order_by("pk")
        raise ValueError(f"Invalid type {type}")

    @property
    def component(self) -> str:
        return "ak-provider-scim-form"

    @property
    def serializer(self) -> type[Serializer]:
        from authentik.providers.scim.api.providers import SCIMProviderSerializer

        return SCIMProviderSerializer

    def __str__(self):
        return f"SCIM Provider {self.name}"

    class Meta:
        verbose_name = _("SCIM Provider")
        verbose_name_plural = _("SCIM Providers")


class SCIMMapping(PropertyMapping):
    """Map authentik data to outgoing SCIM requests"""

    @property

Review comment (suggestion):
```suggestion
                base = base.filter(pk__in=self.group_filters)
```
``.all()`` is not necessary here.

Edit: It is necessary.

Code after:
    property_mappings_group = models.ManyToManyField(
        PropertyMapping,
        default=None,
        blank=True,
        help_text=_("Property mappings used for group creation/updating."),
    )

    compatibility_mode = models.CharField(
        max_length=30,
        choices=SCIMCompatibilityMode.choices,
        default=SCIMCompatibilityMode.DEFAULT,
        verbose_name=_("SCIM Compatibility Mode"),
        help_text=_("Alter authentik behavior for vendor-specific SCIM implementations."),
    )
    service_provider_config_cache_timeout = models.TextField(
        default="hours=1",
        validators=[timedelta_string_validator],
        help_text=_(
            "Cache duration for ServiceProviderConfig responses. Set minutes=0 to disable."
        ),
    )

    def scim_auth(self) -> AuthBase:
        if self.auth_mode == SCIMAuthenticationMode.OAUTH:
            try:
                from authentik.enterprise.providers.scim.auth_oauth2 import SCIMOAuthAuth

                return SCIMOAuthAuth(self)
            except ImportError:
                LOGGER.warning("Failed to import SCIM OAuth Client")
        return SCIMTokenAuth(self)

    @property
    def icon_url(self) -> str | None:
        return static("authentik/sources/scim.png")

    @property
    def sync_actor(self) -> Actor:
        from authentik.providers.scim.tasks import scim_sync

        return scim_sync

    def client_for_model(
        self, model: type[User | Group | SCIMProviderUser | SCIMProviderGroup]
    ) -> BaseOutgoingSyncClient[User | Group, Any, Any, Self]:
        if issubclass(model, User | SCIMProviderUser):
            from authentik.providers.scim.clients.users import SCIMUserClient

            return SCIMUserClient(self)
        if issubclass(model, Group | SCIMProviderGroup):
            from authentik.providers.scim.clients.groups import SCIMGroupClient