The Google provisioner can create groups and memberships, but when doing a full sync will try to add all the existing memberships. It considers these DUP errors which sets the job status to ERROR.

When API tracing is on, it's clear it's retrieving entities and groups, but not memberships.

It's possible the issue is that the capabilities are selectMembershipsAll=true, which may be incorrect. The setting selectMembershipsAllForGroup is also true, which I think does reflect what has been implemented in the api class.

If I set these below at the point of retrieving all target data, this does retrieve memberships correctly, and the job succeeds. I don't know if there are any repercussions though.

this.grouperProvisioner.retrieveGrouperProvisioningBehavior().setSelectMembershipsAll(false);

this.grouperProvisioner.getProvisioningStateGlobal().setSelectResultProcessedMemberships(false);