ldap.sync

Configures the background directory sync.

Key	Type	Default
ldap.sync.interval	duration	15m
ldap.sync.disable_after	duration	45m
ldap.sync.reenable	bool	true
ldap.sync.extra_groups	list	empty

interval

duration, default 15m

How often the sync runs. Zero disables the job entirely.

ldap:
  sync:
    interval: 15m

disable_after

duration, default 45m

How long a directory entry may stay missing before the user is auto-disabled, measured from the first successful search that found no entry. A directory outage is never a miss: only a search that succeeds and finds nothing starts or continues the window. Zero disables auto-disable entirely.

A duration rather than a count of passes, because a count was not a measure of time. Scheduled jobs are not leader-elected, so every instance runs its own sync and three replicas produced three increments per interval; an operator-triggered sync added more. The same absence now means the same thing however many passes observe it.

Admins are disabled like anyone else. One whose most recent login in the last 60 days carried the admin group is emailed when the sync disables them; that email is always sent and cannot be turned off.

ldap:
  sync:
    disable_after: 45m

reenable

bool, default true

Lets the sync clear its own disables when a directory entry reappears. It only ever clears disables whose source is exactly ldap_sync; a user disabled by an admin or SOC operator is never touched by the sync, in either direction.

ldap:
  sync:
    reenable: true

extra_groups

list, default empty

Group names to persist in addition to those the rest of the configuration references — a future notification target, say. See the allowlist rule on user_groups.