Detach unmapped OIDC roles during user sync

[tiran133]

Description

Update OIDC role synchronisation, so existing users lose mapped global
roles when their provider claims no longer match the configured role
mapping.

Keep role matching behaviour for new users unchanged, while writing a
Role detach action for existing users when a mapped claim is missing or
does not contain the configured value.

Fixes

https://mantis.ilias.de/view.php?id=30142
It would be a change of behaviour, it might need to be gated behind a UI setting?

[mjansenDatabay]

Hi @tiran133 ,

thanks for the PR. I will label this PR with "jour fixe" since this is a behavioural change. If no one objects to apply this change for the stable releases, I will merge it.

Best regards,
Michael

[tiran133]

Hey,

thank you!

One question I have. We currently use Ilias 10. That's why I added this to ILIAS-eLearning:release_10

Once this is merged will it be included in to Ilias 11 automatically? Or do I need to create another PR.
Because it would be a shame when we upgrade at some stage to Ilias 11 to lose that functionality!

Not so familiar with the process here. This is my first contribution!
Thank you.

[matthiaskunkel]

Jour Fixe, 27 JUL 2026: @mjansenDatabay gave a short overview on the PR and recommends not to merge this PR for the following reasons:

• the PR is a fundamental change of behaviour in productive releases (10 and 11) and might come with irritations in running installations
• the PR is undermining a feature request to implement a complete revision of the configuration of role assignment mapping in all authentication methods and solves only a very specific use case (FR: https://docu.ilias.de/go/wiki/wpage_7762_1357)
• it is a very implicit removal of behaviour
  We do not consider the current behaviour as a bug as there was never implemented a de-assignment of roles for OIDC. To clarify this, Michael will add a short notice to the README of the Auth component.