The Extra-Group-Cleanup process fetches the correct list of groups BEFORE it fetches the list of provisioned groups from the target system. This was done to ease the task of writing Provisioning subclasses, but introduces an unavoidable race condition where a group is created in Grouper and provisioned incrementally into the target system... all while the provisioner is fetching a list of groups from the target system.

Groups caught in the timing of this process will be rebuilt by future incremental events, but full correctness will be delayed until the next Full Sync.

In addition to the incorrect group memberships, other incremental provisioners may fail when they try to update the group that existed when they started processing events. The following are some possible error messages:

Ldap modification failed
org.ldaptive.LdapException@216617525::resultCode=NO_SUCH_OBJECT

LDAP: error code 32 - No Such Object]; remaining name ...