Design user reconciliation mechanism

[plittlewood-rpt]

Background context There are currently areas of the Platform where a user can be deactivated, removing the relevant user role/group memberships as desired that leave the account dormant in the IdP. We should design and build a system that periodically looks at all users in the IdP that marks for removal/removes dormant or dead accounts.

This ticket should be followed up with one or more implementation tickets

Specification

• This is a design ticket. Some thoughts
  • Check for users in the orgs service that do not exist in Cognito
  • Check for users that exist in Cognito that are deleted/do not exist in the orgs service
  • Check any last login/session information to confirm if an account is dormant
  • Check for active users with no groups
  • Automation 'prepares' a clean up job and outputs an email notification once a month that allows someone to check and sign off what it's going to do. This runs on a monthly basis but perhaps can also be invoked manually.
  • New endpoint on the orgs service?

[github-actions[bot]]

This issue has been updated and moved to our ‘Near Term’ column (typically completed within 1 - 4 months). We have assessed the effort required and outlined a technical specification - please take the time to review this detail. When we're ready to schedule the issue, it will be assigned to the relevant board where you can continue to track its progress to completion. For more information on our processes, please click here

[plittlewood-rpt]

Hold until Ory work is completed