Allow both addition and removal of groups from expression policies

[Keyinator]

Describe the solution you'd like Allow expression policies to add and remove the current user from groups.

Describe alternatives you've considered None available to my knowledge.

Additional context Currently you can add a new users to groups using dynamic groups (https://goauthentik.io/docs/flow/stages/user_write#dynamic-groups). Sadly there's two missing features:

• You can't do it for existing users (Would love to update roles when users log in)
• You can't remove roles

[iexos]

This would allow to create flows which would allow users to manage their own groups. That would be very useful!

[geudrik]

👍 for this issue. The usecase we have is using an external IDP (Okta in our case) which returns a list of groups on login. We need to ensure that groups in Authentik match what's returned from the IDP. We have this configured for first-login (enrollment), but we need to update user info every login

[Wouter0100]

Afaik this is possible with the User model. In an expression policy you should be able to get it and update the user accordingly.